External variables file (basedOn)

[etho201]

Is it possible to define the parameters from an external file (for example, variables.yaml) in order to keep custom/sensitive parameters out of the template files?

I asked this same question back in November and was informed that this will be possible when the implementation of basedOn is complete. That is exactly what I'm looking for. Any status updates or estimates as to when this will be available?

[jandubois]

I think it is (but the key is now called base instead of basedOn). Can you provide a concrete example of how you specify and use the parameters? Then I could show you how you could implement that using base.

[etho201]

For example, if I have a template called oraclelinux9.yaml:

- location: "https://yum.oracle.com/templates/OracleLinux/OL9/u5/x86_64/OL9U5_x86_64-kvm-b253.qcow2"
  arch: "x86_64"
  digest: "sha256:3b00bbbefc8e78dd28d9f538834fb9e2a03d5ccdc2cadf2ffd0036c0a8f02021"
- location: "https://yum.oracle.com/templates/OracleLinux/OL9/u5/aarch64/OL9U5_aarch64-kvm-cloud-b117.qcow2"
  arch: "aarch64"
  digest: "sha256:6b62b633eb66cd1769015c25699d4d5f15c41c8fe5ef6ec3e81f0f2d5ed9e4d4"
mountTypesUnsupported: ["9p"]
mounts:
- location: "~"
- location: "/tmp/lima"
  writable: true
firmware:
  # Oracle Linux 9 still requires legacyBIOS, while AlmaLinux 9 and Rocky Linux 9 do not.
  legacyBIOS: true

provision:
  # `system` is executed with the root privilege
  - mode: system
    script: |
      #!/bin/bash
      echo "Hello $secret" > test.txt

And I have a variables.yaml file like the following:

base: [oraclelinux9.yaml]

param:
  secret: password123

If I type:

limactl start variables.yaml

I am getting the following error: error="[1:1] unknown field \"base\"\n> 1 | base: oraclelinux9.yaml\n

I have limactl version 1.0.7

[etho201]

In that example, I would want "Hello password123" printed to the test.txt file. Also, it's been a while since I looked at this, and can't remember if it needs to be:

param:
  secret: password123

or

env:
  secret: password123

[jandubois]

You need to use the v1.1.0-alpha.0 pre-release to get the support for base. It is not yet available in the regular release.

[jandubois]

can't remember if it needs to be [param or env]

Either should work, but if you use param then the script needs to use $PARAM_secret.

[jandubois]

base: [oraclelinux9.yaml]

If you have just a single base template, then you can also specify it like this:

base: oraclelinux9.yaml

[etho201]

@jandubois -- the new base functionality works great! I realize it's an experimental feature and subject to change, so I'll monitor the documentation and release notes to be aware of any changes.

I was able to simplify my example with:

variables.yaml

env:
  secret: password123

oraclelinux9.yaml

base: [template://oraclelinux-9, variables.yaml]

provision:
  - mode: system
    script: |
      #!/bin/bash
      echo "Hello $secret" > /tmp/test.txt

I think I can work with this. Thank you for all your hard work!

[jandubois]

Just to make sure you are aware of it: the variable will be merged into the ~/.lima/oraclelinux9/lima.yaml file and be unencrypted on the local file system. It is just not part of the source template.

I assume this is fine for your use case, as you already have variables.yaml on the filesystem as well.