Environment Outputs

Environment Outputs streamline the process of exporting and sharing crucial data generated by OpenTofu/Terraform/Terragrunt/Pulumi/CloudFormation environments. This functionality facilitates efficient collaboration and integration across environments within env0, offering users easy access to valuable configurations. By providing a straightforward mechanism for leveraging environment outputs, users can enhance visibility and adaptability within their env0 environments.

📘

Environment Outputs Consumers

Any environment - no matter the IaC type - can consume environment outputs.
The list above names which IaC framework environment outputs can be exported.

🚧

Self-Hosted Agent Support

• Environment Outputs are not supported for self hosted agents prior to version 3.0.724
• Re-installation of the agent necessitates using the same encryption key: environmentOutputEncryptionKey(see below for details)
• Outputs between different agents can be supported by using the same environmentOutputEncryptionKey
• Outputs between Self-hosted agents and SaaS agent are not supported.

Environment Outputs Activation

To activate exporting Environment Outputs, a Project Admin must enable this feature within the project settings. This action necessitates opting in, signifying acknowledgment that env0 will store encrypted sensitive outputs on its platform. To opt in, navigate to the Policies tab within the project settings and locate the Environment Outputs checkbox.

🚧

Note

Environment Outputs are not consumable right after enabling the Environment Outputs policy.

For an Environment's Outputs to be consumable, it needs to be deployed at least once after the policy is enabled.

Self-Hosted Agents Activation

When employing a self-hosted agent, sensitive outputs undergo encryption using a key independent of env0 ownership. This approach ensures end-to-end encryption of sensitive values, thereby bolstering security measures to their fullest extent.

The encryption key should be provided by the environmentOutputEncryptionKey helm value. See our Self-Hosted Agent - optional configuration for how to configure your agent.

Access Restriction

env0 supports restricting access to Environment Outputs, each Environment can configure which Projects can access its outputs inside the "Settings" Tab.

If you don't want any access restrictions - select the "All environments in the organization" option.

By default, the outputs of every Environment are accessible to all Environments inside your organization until configured otherwise.

Using Environment Outputs

Environment Outputs are accessible as inputs for other environments. To utilize this functionality, simply add a variable of type "Environment Output," following the example below:

📘

Good to Know

• To utilize an output of an environment, the environment must be deployed initially for env0 to capture and store the output.
• Environment Output variables are exclusively accessible within Environment and Project scopes.
• Only strings are supported at this time. See the example below for working with maps and lists.

After adding the new variable to the list, you can select the relevant Environment Output by clicking the edit (pencil) button and selecting the relevant Environment/Sub-Environment Alias and Output Name:

Outputting Complex Types in Terraform

Currently, only string variable types are supported by Environment Outputs. This is partially to ensure interoperability between other frameworks (such as passing a TF variable to an Helm chart). So if your terraform code is outputting a map or a list, use jsonencode()to first convert the value to a string format. See example:

locals {
  tags = {"foo": "bar"}
}

# instead of this
# output "tags" {
#   value = local.tags
# }

# do this
output "tags" {
  value = jsonencode(local.tags)
}

📘

No changes needed on the input variabletype=list() or map()

Since Terraform allows input variables to be defined as strings with the proper JSON format, you don't need to make any additional changes to your input definition.

Using in Workflows

One of the strong use cases of Environment Outputs as Inputs is using them inside a Workflow.

If you want to configure an Environment Output of one Sub Environment as an Input of the other, you can do so by doing the same as the above step inside the context of the workflow deploy page.

1. Select the desired sub-environment you'd like to use the output on:

2. Down at the Variables section, create a new Environment Output (same as described above)

3. When opening the modal, you will see a section of Sub Environment Aliases:

   

4. Selecting an Alias that was never deployed before will provide you the option to free type the expected output name:

5. Click Save and continue with the regular deploy process.