> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/tanzu/tanzu-command-step.md).

# Tanzu Command step

Run CF CLI commands and scripts in a Tanzu deployment stage, and use input and output variables to pass data between pipeline steps.

The Tanzu Command step runs scripts in the same Tanzu environment you use for deployment in your pipeline. Harness performs `cf login` using the credentials in the stage Infrastructure Definition before executing the script.

You can use the step for multiple purposes, such as provisioning the org and space or creating environment variables.

***

## What you will learn from this topic

* **Step configuration:** How to add and configure a Tanzu Command step in a deployment stage execution.
* **Script source options:** How to provide a script inline or from the Harness File Store.
* **Input and output variables:** How to declare input variables as environment variables and export output variables to subsequent pipeline steps.
* **Manifest access:** How to reference service manifests inside a Tanzu Command script using the `${service.manifest}` expression.
* **Script logging:** How to suppress script output from console logs using a project-level setting.

***

## Important notes

Keep the following in mind when working with the Tanzu Command step:

* You can use the CF CLI to run any [CF CLI command](https://cli.cloudfoundry.org/en-US/v6/) or script at any point in the step.
* Secret variable types are not supported for **Input Variables** and **Output Variables**. Only String and Number types are supported as input variables.
* The Tanzu Command step can be added to a Deploy stage only.
* Output variables have a maximum size of 512 KB.

***

## Add the Tanzu Command step

The Tanzu Command step can be added anywhere in the **Execution** section of a Tanzu deployment stage.

To add the Tanzu Command step, do the following:

1. In your Tanzu deployment stage **Execution**, select **Add Step**, and then select **Tanzu Command**.
2. Enter a name for the command. An ID is generated automatically. You will use this ID in expressions that reference the step settings and output variables.
3. Enter a timeout for the step. The following time units are supported:

   * `w` for weeks
   * `d` for days
   * `h` for hours
   * `m` for minutes
   * `s` for seconds
   * `ms` for milliseconds

   The maximum timeout is `53w`. You can also set timeouts at the pipeline level in the pipeline **Advanced Options**.
4. In **Script**, enter the script you want to run.
5. In **Input Variables**, enter any environment variables you want to use in the script.
6. In **Output Variables**, reference any variables in the script that you want to use in subsequent steps or settings.

***

## Script source

You can enter the script inline or use the [Harness File Store](/continuous-delivery/use-continuous-delivery/cd-building-blocks/services/add-inline-manifests-using-file-store.md) to provide the script.

***

## Script input variables and output variables

The Tanzu Command step supports **Input Variables** and **Output Variables** to pass data into and out of the script.

### Input variables

While you can declare a variable in your script directly using a Harness expression or string for its value, using **Input Variables** provides the following benefits:

* You can identify and manage the Harness expressions used in your script.
* You can template your script.

These variables are set as environment variables and can be accessed in the script using `$variable_name`.

The following variable types are supported for input variables:

* String
* Number

### Output variables

To export variables from the script to other steps in the stage, use the **Output Variables** option.

The following variable types are supported for output variables:

* String
* Secret

Output variables are passed from the script output to the Harness pipeline and can be referenced in subsequent steps and settings using expressions.

The **name** of the variable is used to reference it in subsequent steps and settings.

The following is a simple example of a script with a variable named `name`:

```bash
name=123
```

The `name` variable cannot be used outside the script unless you use **Output Variables**. You do not need to use `export` for the variables when using **Output Variables**. You can declare them, as shown above. Use `export` only when you need the variable in child processes within the script.

In **Output Variables**, in **Value**, enter the name of the script variable you want to output (for example, `name`).

![Output Variables field showing the name variable mapped to its output value](https://3694223630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fy1JhZ4oKIppwY7d5AhPj%2Fuploads%2Fgit-blob-811344909d6a7d94b11797dd035424371854cdb4%2F6f6260d9bd24a28eb8c496626129149796a27ba3b4a1f9edd41bfda0ad5944d8.png?alt=media)

The format to reference the output variable can be one of the following:

* Within the stage:

  `<+execution.steps.[step_id].output.outputVariables.[output_variable_name]>`
* Anywhere in the pipeline:

  `<+pipeline.stages.[stage_Id].spec.execution.steps.[step_Id].output.outputVariables.[output_variable_name]>`
* When the step is inside a step group:

  `<+pipeline.stages.[stage_Id].spec.execution.steps.[step_group_Id].steps.stepId.build.[output_variable_name]`

To find the expression to reference your output variables, begin typing `<+pipeline.stages.[stage_Id].spec.execution.steps...` and Harness will autocomplete. Alternatively, find the step in the pipeline execution and select its **Output** tab.

![Pipeline execution Output tab showing the output variables for a completed step](https://3694223630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fy1JhZ4oKIppwY7d5AhPj%2Fuploads%2Fgit-blob-9becb255e417cdedabe8b9a8cd5d4d9bb8d0f886%2F81d68966ddb64d7a3c2f84008df38d459f70738f51db9f57a42fd182db1d9f33.png?alt=media)

{% hint style="info" %}
**Exiting the script stops output variable population**

If you exit from the script using `exit 0`, Harness does not populate the output variables because the step has exited.
{% endhint %}

You can access a secret configured in the **Secrets Manager** using an expression. For example, `<+secrets.getValue('SECRET_NAME')>`.

You can also configure variables of type Secret as output variables. When an output variable is configured as a secret, its value is encrypted.

![Tanzu Command step Output Variables panel showing a secret-type output variable](https://3694223630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fy1JhZ4oKIppwY7d5AhPj%2Fuploads%2Fgit-blob-5450ac2580426019a7db7c79bb448a37fd02d38e%2Ftanzu-secrets-output-variable.png?alt=media)

The encrypted secret is decrypted and made available for use in the script. However, the script output will not display the secret, even if it is explicitly passed to the output stream.

![Console log showing script output with a masked secret value](https://3694223630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fy1JhZ4oKIppwY7d5AhPj%2Fuploads%2Fgit-blob-9b1e063a4b4b5749eaf406105216f7dec5bf6ba8%2Foutput-variable-logs.png?alt=media)

### Use manifests in scripts

To use defined manifests from the Service in a Tanzu Command script, use the special expression `${service.manifest}`.

If you are accessing remote manifest files from a Git repository, the following expressions are available:

* `${service.manifest}` refers to the file or folder path containing your manifest files.
* `${service.manifest.repoRoot}` refers to the root folder of the repository.

For example, use `${service.manifest.repoRoot}/tas/manifest.yml` to access `/tas/manifest.yml` from your repository, and `${service.manifest.repoRoot}/tas/vars.yml` to access `/tas/vars.yml`.

***

## Use Harness expressions in scripts

If you need quotes around Harness variable expressions in your script, use single quotes, as shown in the following example:

```bash
export EVENT_PAYLOAD='<+trigger.eventPayload>'
```

If you use Harness variable expressions in comments in your script, Harness still attempts to evaluate and render those expressions. Do not use variable expressions that Harness cannot evaluate, such as expressions that will not be resolved until later in the stage.

***

## Disable script logging

You can suppress the full shell script from being printed in logs for Tanzu Command steps.

By default, Harness logs the entire script before executing it. To suppress this output using a project-level setting, do the following:

1. Go to your **Project Settings** in Harness.
2. Under **Continuous Delivery**, enable the **Disable printing script in Tanzu command step logs** setting.

This setting applies only to Tanzu Command steps and is project-scoped. When enabled, the script content is not printed in the console log. Only the output of the executed commands appears.

***

## Next steps

Explore other Tanzu deployment capabilities:

* [Tanzu deployments overview](/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/tanzu.md): Review the full deployment flow and supported deployment types for Tanzu Application Service.
* [Harness File Store](/continuous-delivery/use-continuous-delivery/cd-building-blocks/services/add-inline-manifests-using-file-store.md): Store and manage scripts and manifests using the Harness File Store.
* [Use Harness expressions](https://developer.harness.io/docs/platform/variables-and-expressions/harness-variables): Reference pipeline values, secrets, and variables in your scripts.