Dagger
Search

terraform

This module provides functionality to run Terraform operations inside a
containerized Dagger pipeline. It supports applying, destroying, and
initializing Terraform configurations with optional variable injection.

The module executes Terraform in a controlled container environment,
optionally injecting HCL-style variables and secret JSON variables. It
is especially useful in CI/CD scenarios where reproducibility and
secure secret handling are required.

Supported features include:
- Running `terraform init`, `apply`, or `destroy` inside a Dagger container
- Supplying key-value `-var` arguments via a comma-separated string
- Injecting a `terraform.tfvars.json` file via a mounted Dagger secret
- Fetching outputs from the Terraform state in JSON format

This module is intended to encapsulate Terraform workflows inside a
container runtime, simplifying automation across cloud or local environments.

Installation

dagger install github.com/stuttgart-things/dagger/terraform@v0.133.0

Entrypoint

Return Type 
Terraform
Example
dagger -m github.com/stuttgart-things/dagger/terraform@7228d65097efda4d607fbd7e335567b608d04f65 call \

func (m *MyModule) Example() *dagger.Terraform  {
	return dag.
			Terraform()
}
@function
def example() -> dagger.Terraform:
	return (
		dag.terraform()
	)
@func()
example(): Terraform {
	return dag
		.terraform()
}

Types

Terraform 🔗

baseImage() 🔗

Return Type 
String !
Example
dagger -m github.com/stuttgart-things/dagger/terraform@7228d65097efda4d607fbd7e335567b608d04f65 call \
 base-image
func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Terraform().
			Baseimage(ctx)
}
@function
async def example() -> str:
	return await (
		dag.terraform()
		.baseimage()
	)
@func()
async example(): Promise<string> {
	return dag
		.terraform()
		.baseImage()
}

execute() 🔗

Return Type 
Directory !
Arguments
NameTypeDefault ValueDescription
terraformDirDirectory !-No description provided
operationString "apply"No description provided
variablesString -

e.g., “name=patrick,food=schnitzel”

awsAccessKeyIdSecret -

AWS S3/MinIO credentials

awsSecretAccessKeySecret -No description provided
secretJsonVariablesSecret -No description provided
vaultRoleIdSecret -

vaultRoleID

vaultSecretIdSecret -

vaultSecretID

vaultTokenSecret -

vaultToken

vaultAddrString -

Vault address (e.g. “https://vault.example.com”)

kubeConfigSecret -

Kubeconfig secret for Kubernetes backend access

kubeConfigPathString "/root/.kube/config"

Path to mount the kubeconfig inside the container (must match backend config_path)

exportTfOutputBoolean -

Run terraform output –json after the operation and write result to output.json

targetsString -

Resource addresses to limit apply/destroy to, comma-separated, one -target each (e.g. ‘vault_kv_secret_v2.this[“kv/a”],null_resource.b’). Use it when the configuration manages more than the caller owns: an untargeted apply would also plan everything the caller’s inputs omit.

refuseDestroyBoolean -

Apply only if the plan deletes nothing. Plans to a file, aborts if any resource change contains “delete” (a replace does too), then applies exactly that plan – not a fresh one that could differ. apply only.

bindServiceService -

A service to bind under bindServiceAlias – from the CLI tcp://<ip>:<port>, which the caller’s host forwards. Pins a hostname to an address while TLS and SNI still see the real name. For names the engine’s resolver cannot answer reliably, e.g. a lab zone without public NS. (/etc/hosts is read-only inside a Dagger exec.)

bindServiceAliasString -

Hostname bindService is reachable under, e.g. the host in VAULT_ADDR.

Example
dagger -m github.com/stuttgart-things/dagger/terraform@7228d65097efda4d607fbd7e335567b608d04f65 call \
 execute --terraform-dir DIR_PATH
func (m *MyModule) Example(terraformDir *dagger.Directory) *dagger.Directory  {
	return dag.
			Terraform().
			Execute(terraformDir)
}
@function
def example(terraformdir: dagger.Directory) -> dagger.Directory:
	return (
		dag.terraform()
		.execute(terraformdir)
	)
@func()
example(terraformDir: Directory): Directory {
	return dag
		.terraform()
		.execute(terraformDir)
}

output() 🔗

Return Type 
String !
Arguments
NameTypeDefault ValueDescription
terraformDirDirectory !-No description provided
awsAccessKeyIdSecret -No description provided
awsSecretAccessKeySecret -No description provided
kubeConfigSecret -

Kubeconfig secret for Kubernetes backend access

kubeConfigPathString "/root/.kube/config"

Path to mount the kubeconfig inside the container (must match backend config_path)

Example
dagger -m github.com/stuttgart-things/dagger/terraform@7228d65097efda4d607fbd7e335567b608d04f65 call \
 output --terraform-dir DIR_PATH
func (m *MyModule) Example(ctx context.Context, terraformDir *dagger.Directory) string  {
	return dag.
			Terraform().
			Output(ctx, terraformDir)
}
@function
async def example(terraformdir: dagger.Directory) -> str:
	return await (
		dag.terraform()
		.output(terraformdir)
	)
@func()
async example(terraformDir: Directory): Promise<string> {
	return dag
		.terraform()
		.output(terraformDir)
}

version() 🔗

Return Type 
String !
Example
dagger -m github.com/stuttgart-things/dagger/terraform@7228d65097efda4d607fbd7e335567b608d04f65 call \
 version
func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Terraform().
			Version(ctx)
}
@function
async def example() -> str:
	return await (
		dag.terraform()
		.version()
	)
@func()
async example(): Promise<string> {
	return dag
		.terraform()
		.version()
}