Deployment Template¶

A Deployment Template (.dunedpt.yaml) is the top-level template that describes a complete application infrastructure. It bundles one or more Resource Group Templates and defines parameters that users fill in when creating a deployment.

Structure¶

---
schemaVersion: 1
name: my-app                         # unique identifier, technical name
displayName: My Application          # human-readable name
version: 1.0.0                       # semantic version
description: Web app with database   # template description
parameters:                          # optional — user inputs at deployment time
  - name: webCpu
    type: number
    description: Web server vCPU count
    default: 4
variables:                           # optional — key/value pairs
  CUSTOM_SUBNET_NAME: my-subnet
tags:                                # optional — metadata tags
  costCenter: IT-1234
resourceGroups:                      # required — at least one
  - name: web
    displayName: Web Server
    template: webserver              # references an RGT by name
    templateVersion: 1.0.0           # references an RGT by version
    templateParameters:              # values passed to the RGT
      cpu: "{{parameters.webCpu}}"
  - name: db
    displayName: Database
    template: genericsql
    templateVersion: 1.0.0
    templateParameters:
      cpu: 4
postConfig:                          # optional — runs after all RGs complete
  - name: invoke-psscript
    limit: "{{resourcegroup.web.vmweb.fqdn}}"
    variables:
      script: |
        Write-Host "All resources deployed"

Resource Groups¶

The resourceGroups array is the core of the Deployment Template. Each entry references a Resource Group Template:

Key	Required	Description
`name`	Yes	Unique identifier, technical name (kebab-case).
`displayName`	Yes	Human-readable name shown in the portal
`template`	Yes	Name of the Resource Group Template to use
`templateVersion`	Yes	Version of the Resource Group Template
`templateParameters`	No	Key/value pairs passed to the RGT's parameters
`resources`	No	Inline resource definitions (extend the RGT)
`postConfig`	No	Config tasks that run after this RG's resources are deployed

Passing Parameters to Resource Group Templates¶

Use templateParameters to pass values from the Deployment Template down to Resource Group Templates. You can pass static values or use expressions:

templateParameters:
  cpu: 4                           # static value
  memory: "{{parameters.memory}}"  # from a deployment parameter
  alias: "db-{{deployment.shortid}}" # combining text with an expression

Warning

When an expression is the entire value, it must be quoted: "{{parameters.cpu}}". Without quotes, YAML may misinterpret the braces.

Reusing Resource Group Templates¶

The same RGT can be referenced multiple times:

resourceGroups:
  - name: web0
    displayName: Web Server 1
    template: webserver
    templateVersion: 1.0.0
    templateParameters:
      cpu: 2
  - name: web1
    displayName: Web Server 2
    template: webserver
    templateVersion: 1.0.0
    templateParameters:
      cpu: 4

Extending with Additional Resources and PostConfig¶

The resources array on a resource group lets you append resources to the ones defined in the RGT, without modifying the RGT itself. This is useful when an RGT covers a common base (e.g. a SQL VM) and individual deployments need extra resources alongside it — service accounts, RBAC groups, additional aliases, and so on.

The inline resources are deployed as part of the resource group and can be referenced from postConfig blocks just like resources defined inside the RGT.

resourceGroups:
  - name: db
    displayName: Database
    template: mssqlvm                          # base RGT — provisions the SQL VM
    templateVersion: 1.0.0
    templateParameters:
      sqlVersion: sql22dev
      sqlFeatures: SQLENGINE,FULLTEXT,IS
    resources:                                 # extra resources on top of the RGT
      - type: serviceAccount
        name: svcssis
        svcName: "ssis-{{resourcegroup.shortid}}"
        memberOf:
          - "yourdomain\\{{rbacresourcegroup.rbacsysadmin}}"
      - type: rbacResourceGroup
        name: rbacdbreader
        groupName: "sql-{{computenode.vmdb}}-dbreader"
      - type: rbacResourceGroup
        name: rbacdbwriter
        groupName: "sql-{{computenode.vmdb}}-dbwriter"
    postConfig:
      - name: user-rights-assignment
        displayName: Add ServiceLogonRights for SSIS account
        limit: "{{computenode.vmdb.fqdn}}"
        variables:
          user_rights:
            - permission: SeServiceLogonRight
              identities: "yourdomain\\{{serviceaccount.svcssis.svcname}}"

Parameters¶

Parameters defined at the Deployment Template level are prompted to the user in the Dune portal when creating a deployment. See Parameters for the full reference.

parameters:
  - name: cpu
    type: number
    description: Number of vCPUs
    default: 4
  - name: adminPassword
    type: secureString
    description: Administrator password

Variables¶

Variables at the deployment level affect how resources are provisioned. They can also be set via the Dune portal at the Tenant, Collection, or Deployment level. See Variables for inheritance and scoping.

The following deployment-level variables are built into Dune:

Variable	Type	Description	Example
`AD_SERVICEACCOUNT_FORMAT`	String	Format string for AD service account names. `{0}` is replaced with the service account's `svcName`.	`svc-{0}`
`CLUSTER_HOSTNAME_PREFIX`	String	Prefix used when generating cluster hostnames.	`cl`
`CUSTOM_SUBNET_NAME`	String	Add resources to an existing subnet instead of generating one per resource group. The subnet must exist in the Resource Provider's default virtual network and is not removed on teardown.	`my-shared-subnet`
`DEFAULT_AD_RESOURCEPROVIDER`	String	Name of the `ActiveDirectoryServices` Dune Resource Provider used for all generated AD objects (OUs, users for service accounts, groups for rbacResourceGroups).	`ad-yendico-local`
`DEFAULT_DNS_RESOURCEPROVIDER`	String	Name of the `DomainNameSystem` Dune Resource Provider used for DNS entries (aliases).	`dns-yco-loc`
`DEFAULT_VAULT_RESOURCEPROVIDER`	String	Name of the `AzureKeyVault` Dune Resource Provider used for secret entries (serviceaccount passwords, etc).	`kv-foobar`
`DISABLE_TRUSTED_LAUNCH`	Bool	Disables trusted launch for Azure VMs. Required for certain VM SKUs that don't support trusted launch.	`true`
`DISK_ENCRYPTION_SET`	String	Name of a custom disk encryption set to apply to managed disks.	`yendico_prod_des`
`DISK_ENCRYPTION_SET_RG`	String	Azure resource group containing the custom disk encryption set.	`yendico_prod_rg`
`SKIP_ACTION_STEP_LIST`	List	Action steps to skip when executing an action. Each entry is the step `name`, optionally combined with `displayName` as `[name]:[displayName]`.	`["reboot-service", "invoke-psscript:Service Restart"]`
`SKIP_REMOVAL_CONFIG_LIST`	List	Config items to skip during teardown (the `removal` step of a config task). Each entry is `name` or `[name]:[displayName]`.	`["invoke-psscript:DFS Folder"]`
`SKIP_PARAMETER_VALIDATION`	Bool	If `true`, the regex `validation` defined on parameters is skipped.	`true`
`VIRTUALMACHINE_HOSTNAME_PREFIX`	String	Prefix used when generating VM hostnames.	`vm`

Deployment Order¶

All Resource Groups deploy in parallel — the order in the YAML does not matter
After all Resource Groups are fully deployed, postConfig tasks execute

PostConfig¶

The postConfig block defines tasks that run after all resource groups have been deployed. This is useful for cross-resource-group configuration.

Use the same tasks available for compute node configuration — see Config Tasks. You typically need the limit key to target a specific host:

postConfig:
  - name: invoke-psscript
    limit: "{{resourcegroup.web.vmweb.fqdn}}"
    variables:
      script: |
        Write-Host "Post-deployment configuration"

Expressions¶

A Deployment Template runs in deployment scope, where resources from any resource group are accessed via the resourcegroup.<rg>.<resource> prefix. The expressions below are the deployment-scope-specific ones — see Expressions for the full reference (including tenant, collection, deployment, and resource provider expressions, which are available in all scopes).

Deployment parameters¶

Expression	Description
`{{parameters.<name>}}`	Value of a Deployment Template parameter

Cross-resource-group references¶

Use these to reference resources of any resource group — typically from postConfig or templateParameters:

Expression	Description
`{{resourcegroup.<rg>.<vm>}}`	Compute node hostname (shorthand for `.hostname`)
`{{resourcegroup.<rg>.<vm>.fqdn}}`	Compute node FQDN
`{{resourcegroup.<rg>.<vm>.<property>}}`	Any compute node property (`hostname`, `displayname`, `alias[0]`, etc.)
`{{resourcegroup.<rg>.<svc>.svcname}}`	Service account name
`{{resourcegroup.<rg>.<svc>.svcpassword}}`	Service account password (secure)
`{{resourcegroup.<rg>.<rbac>.groupname}}`	Rbac group name

<rg> is the resource group name and the second segment is the resource name within that resource group.

Tags¶

Tags are metadata key/value pairs attached to the deployment and its resources. They are useful for cost tracking, ownership, and organization.

tags:
  costCenter: IT-1234
  owner: team-platform

Next: ResourceGroup Template