Expressions¶

Expressions use double-brace syntax {{reference.path}} to dynamically insert values into templates at deployment time. They work similarly to Mustache templates.

Syntax¶

{{scope.property}}
{{scope.name.property}}
{{scope.name.subname.property}}

Rules:

Expressions are enclosed in double braces: {{ }}
Use dot notation to traverse the reference path: deployment.shortid
Array access is supported: computenode.vmfoo.alias[0]
Expressions are single-level only — you cannot nest expressions like {{{{...}}}}
Pattern: \{\{(?<Reference>[a-zA-Z0-9\-.\[\]]+)\}\}

Always quote standalone expressions

When an expression is the entire YAML value, it must be quoted to avoid YAML parsing issues:

cpu: "{{parameters.cpu}}"          # correct
cpu: {{parameters.cpu}}            # wrong — YAML will misinterpret the braces
label: App-{{deployment.shortid}}  # OK — expression is part of a larger string

Scopes¶

The set of available expressions depends on where the template runs from — its scope. The same resource appears under different paths depending on scope.

Scope	Template
Deployment	Deployment Template (DPT), Action Template with `scope: deployment`
ResourceGroup	Resource Group Template (RGT), Action Template with `scope: resourcegroup`
Resource	Action Template with `scope: resource`

Example — a compute node vmdb in resource group db:

Used from	Expression
Deployment scope	`{{resourcegroup.db.vmdb.fqdn}}`
ResourceGroup scope (in `db`)	`{{computenode.vmdb.fqdn}}`
Resource scope (`this` is `vmdb`)	`{{this.fqdn}}`

Common to All Scopes¶

These expressions are available regardless of where the template runs.

Tenant¶

Expression	Description	Example
`{{tenant.name}}`	Tenant identifier	`acme`
`{{tenant.displayname}}`	Tenant display name	`ACME Corp`

Collection¶

Expression	Description	Example
`{{collection.name}}`	Collection identifier	`booking`
`{{collection.displayname}}`	Collection display name	`Booking Application`

Deployment¶

Expression	Description	Example
`{{deployment.name}}`	Deployment identifier	`booking-prod`
`{{deployment.displayname}}`	Deployment display name	`Booking App Production`
`{{deployment.environment}}`	Environment	`Prod`
`{{deployment.environment.shortcode}}`	Environment	`P`
`{{deployment.shortid}}`	Short unique ID	`0fa0bb`

AD Resource Provider¶

Configuration keys exposed by the ActiveDirectoryServices Resource Provider referenced via DEFAULT_AD_RESOURCEPROVIDER. Use {{adresourceprovider.<key>}} for any config key on the provider — the most commonly used keys are listed below.

Expression	Description	Example
`{{adresourceprovider.worker}}`	FQDN of the AD worker host (commonly used as `limit:` for AD-side scripts)	`worker.yourdomain.local`
`{{adresourceprovider.ad_computers_join_ou}}`	OU where computer objects are created	`OU=Computers,DC=yourdomain,DC=local`
`{{adresourceprovider.ad_user_resource_ou}}`	OU where service-account user objects are created	`OU=ServiceAccounts,DC=yourdomain,DC=local`
`{{adresourceprovider.ad_group_resource_ou}}`	OU where rbac group objects are created	`OU=Groups,DC=yourdomain,DC=local`
`{{adresourceprovider.ad_serviceaccount_format}}`	Format applied to service-account names	`svc-{0}`
`{{adresourceprovider.ad_rbacresourcegroup_format}}`	Format applied to rbac group names	`.acme-{0}-l`
`{{adresourceprovider.ad_serviceaccount_memberof}}`	Default group memberships for new service accounts	`yourdomain\.acme-svc-g`
`{{adresourceprovider.ad_localadminaccessgroup_ou}}`	OU for the per-host local-admin access group	`OU=LocalAdmin,DC=yourdomain,DC=local`
`{{adresourceprovider.ad_localadminaccessgroup_members}}`	Default members of local-admin access groups	`[".acme-admins"]`
`{{adresourceprovider.ad_cluster_quorum_path}}`	UNC path used for WSFC quorum witnesses	`\\dfs\witness`
`{{adresourceprovider.ad_cluster_rbac_role}}`	Group granted cluster RBAC	`.acme-cluster-wsfc-g`

DNS Resource Provider¶

Configuration keys exposed by the DomainNameSystem Resource Provider referenced via DEFAULT_DNS_RESOURCEPROVIDER. Use {{dnsresourceprovider.<key>}} for any config key on the provider.

Expression	Description	Example
`{{dnsresourceprovider.provider}}`	DNS provider type	`Azure`
`{{dnsresourceprovider.computer_dns_domain}}`	DNS domain used for VM FQDNs	`yourdomain.local`
`{{dnsresourceprovider.az_dns_zone_name}}`	Azure Private DNS zone name	`yourdomain.local`
`{{dnsresourceprovider.az_dns_resourcegroup_name}}`	Azure resource group containing the DNS zone	`rg-privatedns`
`{{dnsresourceprovider.az_subscription_id}}`	Azure subscription ID for the DNS zone	`00000000-0000-0000-0000-000000000000`
`{{dnsresourceprovider.az_tenant_id}}`	Azure tenant ID for the DNS provider	`00000000-0000-0000-0000-000000000000`
`{{dnsresourceprovider.az_client_id}}`	Azure client ID used by the DNS provider	`00000000-0000-0000-0000-000000000000`

Deployment Scope¶

Available in Deployment Templates and action templates with scope: deployment.

Parameters¶

Expression	Description
`{{parameters.<name>}}`	Value of a Deployment Template parameter

Resources (cross-resource-group)¶

At deployment scope, all resources of all resource groups are accessed via the resourcegroup.<rg>.<name> prefix.

ComputeNode¶

Expression	Description	Example
`{{resourcegroup.<rg>.<vm>}}`	Hostname (shorthand for `.hostname`)	`vm-7a1893cb`
`{{resourcegroup.<rg>.<vm>.hostname}}`	Hostname	`vm-7a1893cb`
`{{resourcegroup.<rg>.<vm>.fqdn}}`	FQDN	`vm-7a1893cb.yourdomain.local`
`{{resourcegroup.<rg>.<vm>.dnsdomain}}`	DNS domain	`yourdomain.local`
`{{resourcegroup.<rg>.<vm>.displayname}}`	Display name	`DB Server`
`{{resourcegroup.<rg>.<vm>.alias[0]}}`	Nth alias (0-based)	`db-alias`
`{{resourcegroup.<rg>.<vm>.environment}}`	Environment	`Prod`
`{{resourcegroup.<rg>.<vm>.environment.shortcode}}`	Environment	`P`
`{{resourcegroup.<rg>.<vm>.location}}`	Location	`westeurope`
`{{resourcegroup.<rg>.<vm>.subnetmask}}`	Subnet mask	`255.255.255.248`
`{{resourcegroup.<rg>.<vm>.operatingsystem}}`	OS image	`win2022`
`{{resourcegroup.<rg>.<vm>.logicalcpus}}`	vCPU count	`4`
`{{resourcegroup.<rg>.<vm>.memorymb}}`	Memory in MB	`8192`

ServiceAccount¶

Expression	Description	Example
`{{resourcegroup.<rg>.<svc>}}`	Account name (shorthand for `.svcname`)	`svc-db-gjoef9`
`{{resourcegroup.<rg>.<svc>.svcname}}`	Account name (after format applied)	`svc-db-gjoef9`
`{{resourcegroup.<rg>.<svc>.svcpassword}}`	Auto-generated password (secure)	(masked)

RbacResourceGroup¶

Expression	Description	Example
`{{resourcegroup.<rg>.<rbac>}}`	Group name (shorthand for `.groupname`)	`.acme-db-readers-l`
`{{resourcegroup.<rg>.<rbac>.groupname}}`	Group name (after format applied)	`.acme-db-readers-l`

ResourceGroup Scope¶

Available in Resource Group Templates and action templates with scope: resourcegroup.

Resource Group properties¶

Expression	Description	Example
`{{resourcegroup.name}}`	RG identifier	`db`
`{{resourcegroup.displayname}}`	RG display name	`Database`
`{{resourcegroup.shortid}}`	Short unique ID of the RG	`gjoef9`
`{{resourcegroup.environment}}`	RG environment	`Prod`
`{{resourcegroup.environment.shortcode}}`	RG environment	`P`

RG parameters¶

Expression	Description
`{{parameters.<name>}}`	Value of an RGT parameter (received via `templateParameters`)
`{{deployment.parameters.<name>}}`	Value of a deployment-level parameter

Resources (current RG only)¶

At RGT scope, resources of the current resource group are accessed flat — without the resourcegroup.<rg>. prefix. Resources in other RGs are not accessible.

ComputeNode (current RG)¶

Expression	Description	Example
`{{computenode.<vm>}}`	Hostname (shorthand for `.hostname`)	`vm-7a1893cb`
`{{computenode.<vm>.hostname}}`	Hostname	`vm-7a1893cb`
`{{computenode.<vm>.fqdn}}`	FQDN	`vm-7a1893cb.yourdomain.local`
`{{computenode.<vm>.dnsdomain}}`	DNS domain	`yourdomain.local`
`{{computenode.<vm>.displayname}}`	Display name	`DB Server`
`{{computenode.<vm>.alias[0]}}`	Nth alias (0-based)	`db-alias`
`{{computenode.<vm>.environment}}`	Environment	`Prod`
`{{computenode.<vm>.environment.shortcode}}`	Environment	`P`
`{{computenode.<vm>.location}}`	Location	`westeurope`
`{{computenode.<vm>.subnetmask}}`	Subnet mask	`255.255.255.248`
`{{computenode.<vm>.operatingsystem}}`	OS image	`win2022`
`{{computenode.<vm>.logicalcpus}}`	vCPU count	`4`
`{{computenode.<vm>.memorymb}}`	Memory in MB	`8192`

ServiceAccount (current RG)¶

Expression	Description	Example
`{{serviceaccount.<svc>}}`	Account name (shorthand for `.svcname`)	`svc-db-gjoef9`
`{{serviceaccount.<svc>.svcname}}`	Account name (after format applied)	`svc-db-gjoef9`
`{{serviceaccount.<svc>.svcpassword}}`	Auto-generated password (secure)	(masked)

RbacResourceGroup (current RG)¶

Expression	Description	Example
`{{rbacresourcegroup.<rbac>}}`	Group name (shorthand for `.groupname`)	`.acme-db-readers-l`
`{{rbacresourcegroup.<rbac>.groupname}}`	Group name (after format applied)	`.acme-db-readers-l`

Cluster¶

Expression	Description
`{{cluster.<name>.listeners.<listener>.hostname}}`	Cluster listener hostname

Resource Scope¶

Available only in action templates with scope: resource.

`this` — the selected resource¶

Expression	Description	Example
`{{this}}`	Default property (hostname for compute nodes)	`vm-7a1893cb`
`{{this.<property>}}`	Any property of the resource (e.g. `hostname`, `fqdn`, `displayname`, `alias[0]`)	`vm-7a1893cb.yourdomain.local`

Resource Group (containing the resource)¶

Expression	Description	Example
`{{resourcegroup.name}}`	RG identifier	`db`
`{{resourcegroup.displayname}}`	RG display name	`Database`
`{{resourcegroup.shortid}}`	Short unique ID of the RG	`gjoef9`

Deployment parameters¶

Expression	Description
`{{deployment.parameters.<name>}}`	Value of a deployment-level parameter

Resolution¶

Expressions are resolved at runtime during deployment, not at template upload time:

When a deployment runs, Dune populates a variable store with all scope-specific values (tenant, collection, deployment, resource properties)
Each {{reference}} is matched and replaced with the resolved value
If a reference cannot be resolved immediately (e.g., the resource hasn't been created yet), Dune retries for up to 900 seconds (15 minutes) before failing

Note

The 900-second timeout means that slow-resolving references or circular dependencies can silently block a deployment for up to 15 minutes before an error is raised.

Common Patterns¶

Unique resource names using deployment.shortid¶

svcName: "myapp-{{deployment.shortid}}"          # e.g., myapp-0fa0bb
groupName: "{{deployment.shortid}}-sysadmin"      # e.g., 0fa0bb-sysadmin

Cross-resource references within an RGT¶

config:
  - name: invoke-psscript
    variables:
      script: |
        sc.exe config "nginx" obj= "{{serviceaccount.svcapp.svcname}}" password= "{{serviceaccount.svcapp.svcpassword}}"

AD group membership using other resources¶

memberOf:
  - "yourdomain\\{{rbacresourcegroup.rbacsysadmin.groupname}}"
  - "yourdomain\\.serveradmins-{{computenode.vmdb}}"

Cross-resource-group reference from a Deployment Template¶

postConfig:
  - name: invoke-psscript
    limit: "{{resourcegroup.web.vmweb.fqdn}}"
    variables:
      script: |
        Set-Connection -Server "{{resourcegroup.db.vmdb.fqdn}}"

Next: Parameters