How to parameterize a template with a tfvars file

Reuse the same OpenTofu template in development, staging, and production without forking the HCL. Store environment-specific values in .tfvars files and pass them with -var-file at plan and apply time.

This guide applies to any template under Automation templates that declares variables in variables.tf.

Prerequisites#

• OpenTofu or Terraform installed and Quake AI credentials configured (see Get started with IaC)
• A template copied from iac/templates/ or checked out as your working directory, with tofu init already run
• Familiarity with OpenTofu variables (see How to manage multiple environments with OpenTofu for the broader per-environment pattern)

Identify variables to externalize#

Open variables.tf in your template directory. Every template exposes a set of input variables with optional defaults. Values you change per environment or per deployment belong in a tfvars file, not in edited defaults inside variables.tf.

The simple-vm template declares six variables:

The edge-reverse-proxy template adds proxy and upstream settings:

Required variables such as key_name have no default. You must set them in a tfvars file or pass them with -var on the command line.

Create a base tfvars file#

Add terraform.tfvars in the template directory for values that apply to every environment:

# terraform.tfvars: shared across all environments
key_name         = "deploy-key"
external_network = "PublicStatic"
image_name       = "Ubuntu-24.04"

OpenTofu loads terraform.tfvars automatically on every plan and apply. You do not pass a flag for this file.

Add per-environment override files#

Create one tfvars file per environment under an envs/ subdirectory:

iac/templates/simple-vm/
  main.tf
  variables.tf
  terraform.tfvars
  envs/
    dev.tfvars
    prod.tfvars

envs/dev.tfvars:

instance_name = "dev-simple-vm"
flavor_name   = "s1a.small"
private_cidr  = "10.10.10.0/24"

envs/prod.tfvars:

instance_name = "prod-simple-vm"
flavor_name   = "m2a.large"
private_cidr  = "10.10.100.0/24"

For edge-reverse-proxy, set the hostname and upstream per environment:

envs/dev.tfvars:

domain        = "dev.example.com"
upstream_host = "10.40.0.20"
flavor_name   = "s1a.small"
private_cidr  = "10.40.0.0/24"

envs/prod.tfvars:

domain        = "www.example.com"
upstream_host = "10.41.0.20"
flavor_name   = "m2a.large"
private_cidr  = "10.41.0.0/24"

Later files passed with -var-file override earlier values. OpenTofu merges terraform.tfvars first, then each -var-file in the order you specify.

Plan and apply with -var-file#

From the template directory, pass the environment file explicitly:

tofu plan -var-file=envs/dev.tfvars
tofu apply -var-file=envs/dev.tfvars

For production:

tofu plan -var-file=envs/prod.tfvars
tofu apply -var-file=envs/prod.tfvars

Pass multiple var-files when a shared baseline and an environment override live in separate files:

tofu apply -var-file=envs/common.tfvars -var-file=envs/prod.tfvars

Values in prod.tfvars win over common.tfvars for any variable defined in both.

Pair tfvars with separate state#

Variable files control what OpenTofu provisions. They do not isolate state. Dev and production must use different state files so a tofu destroy in dev never touches production resources.

If you use a remote backend, pass a different state key per environment during init:

tofu init -backend-config="key=dev/simple-vm.tfstate"
tofu apply -var-file=envs/dev.tfvars

For production, re-init with a different key:

tofu init -reconfigure -backend-config="key=prod/simple-vm.tfstate"
tofu apply -var-file=envs/prod.tfvars

The full remote-backend setup lives in How to manage OpenTofu state with Quake AI S3. The directory-per-environment alternative is in How to manage multiple environments with OpenTofu.

Verify the active variable values#

After apply, read the values OpenTofu wrote to state:

tofu show

Search the output for resource attributes such as flavor_name and instance_name. State reflects the -var-file values from apply, not the defaults in variables.tf.

To inspect variable resolution before a plan, pass the same -var-file flag to the console:

tofu console -var-file=envs/dev.tfvars

At the prompt, read a variable:

> var.flavor_name
"s1a.small"

Type exit to leave the console.

For compute templates, cross-check the flavor against the live catalog:

openstack server list -f table -c Name -c Flavor

If a plan fails with value must be known or No value for required variable, the variable is missing from both terraform.tfvars and the -var-file you passed. Add it to the tfvars file or pass -var 'key_name=deploy-key' on the command line.

See also#

• Automation templates: reference pages for all deployment patterns
• How to customize a template's image and flavor: pick catalog values to put in tfvars
• How to manage multiple environments with OpenTofu: variable files vs directory-per-environment
• How to manage OpenTofu state with Quake AI S3: remote state keys per environment
• How to debug Terraform errors: missing variables and name mismatches