Ctrlk
Sign UpGet a DemoContact Us
For the complete documentation index, see llms.txt. This page is also available as Markdown.

IaCM plugins

Configure IaCM plugin behavior using environment variables on your workspace, including proxy trust configuration and pre-baked provisioner binary detection.

IaCM executes provisioner operations through a Harness-managed plugin. The plugin runs automatically as part of IaCM operations, and you configure its behavior by setting environment variables on your workspace. Plugin variables control capabilities such as proxy trust configuration and pre-baked provisioner binary detection.

What is a plugin?

Using a plugin enables IaCM to:

  • Run provisioners in an isolated, reproducible environment.

  • Configure plugin behavior through environment variables on your workspace.

  • Deliver fixes and new capabilities without pipeline changes.

  • Run consistently across Harness-hosted and self-managed infrastructure, including environments behind proxies.

Before you begin

  • You need the IaCM Workspace Edit role or higher to add environment variables to a workspace.

Set a plugin environment variable

The plugin reads its configuration from the environment variables on your workspace.

  1. Navigate to your workspace and select the Connectors and Variables tab.

  2. In the Environment Variables section, select + Add Variable.

  3. Set Type to string or secret, depending on the sensitivity of the value.

  4. Set Key to the full variable name (for example, PLUGIN_CA_CERT_PATH) and set the Value. Harness passes all workspace environment variables through to the plugin container.

  5. Select Save Changes.

Plugin environment variables

The following environment variables are available on the IaCM plugin. Select a variable name to view its full configuration details.

Variable

Applies to

Description

PLUGIN_CA_CERT_PATH

Terraform, OpenTofu, Terragrunt, and AWS CDK

Trusts a corporate CA certificate for provisioner binary downloads behind a TLS-intercepting proxy.

PLUGIN_BINARY_DIR

Terraform, OpenTofu, and Terragrunt

Skips the runtime provisioner download by using a pre-baked binary found in the specified directory of a custom image.

PLUGIN_CA_CERT_PATH

Points the IaCM plugin to a corporate CA certificate so it can trust a TLS-intercepting proxy during provisioner binary downloads. A corporate CA certificate is your organization's internal certificate authority certificate. Corporate proxies commonly use this certificate to re-sign intercepted HTTPS traffic, which causes standard certificate validation to fail unless the plugin explicitly trusts it.

When to use it: Use this variable when IaCM runs on customer-managed infrastructure behind an HTTP(S) forward proxy that re-signs TLS certificates with a corporate CA. If provisioner downloads fail or hang while calls to *.harness.io succeed, configure PLUGIN_CA_CERT_PATH.

Requirements

  • The value must point to a single PEM file containing one or more certificates (a CA bundle), not a directory.

  • Mount the certificate file into the runner or plugin container before referencing it.

How it works: When set, the plugin creates a trust bundle that combines your corporate CA certificate with the operating system's default trusted root certificates and configures the provisioner download process to use this bundle automatically. The plugin also sets SSL_CERT_FILE, CURL_CA_BUNDLE, and SSL_CERT_DIR for troubleshooting. You do not need to configure these variables manually.

Configure PLUGIN_CA_CERT_PATH

  1. Mount your corporate CA certificate into the runner or plugin container. For example:

  2. Add a workspace environment variable with:

    • Key: PLUGIN_CA_CERT_PATH

    • Value: The mounted certificate path.

  3. Re-run the pipeline.

Verify: Check the step logs for a message similar to:

The Installing provisioner step downloads the provisioner binary successfully through the proxy, and the pipeline continues with the remaining IaCM operations.

PLUGIN_BINARY_DIR

Specifies the directory in a custom plugin image that contains a pre-baked provisioner binary. When set, the IaCM plugin uses the binary from this directory instead of downloading the provisioner at runtime. This is useful in environments where runtime downloads are unreliable or restricted, such as environments with no outbound internet access or environments with intermittent access to external registries.

When to use it: Use this variable when you build a custom plugin image that includes a pre-baked OpenTofu or Terraform binary and want the plugin to use that binary instead of downloading it at runtime. Pre-baking the binary can help avoid failures caused by restricted or unreliable network access to external registries.

Requirements

  • Place the provisioner binary directly in the specified directory, not in a subdirectory.

  • Include the binary in the custom plugin image before using the image in a pipeline.

  • Set the variable to the directory containing the binary.

How it works: When PLUGIN_BINARY_DIR is set, the IaCM plugin scans the specified directory for a binary that matches the provisioner version declared in the workspace. If the directory holds more than one pre-baked binary, the plugin picks the matching version automatically. If none of the binaries match, the plugin downloads the required version at runtime instead.

Configure PLUGIN_BINARY_DIR

  1. Build a custom plugin image that includes the pre-baked binary. For example:

  2. Add a workspace environment variable with:

    • Key: PLUGIN_BINARY_DIR

    • Value: The directory containing the binary (for example, /opt/iacm-binaries).

  3. Re-run the pipeline.

Verify: Check the Installing provisioner step logs to confirm that the pre-baked binary is detected and used instead of being downloaded at runtime.

Related concepts

PreviousAWS Connector Authentication
NextPolicy & Governance

Last updated

Was this helpful?