Skip to main content

​
What is a template?

In env zero, a template defines the type of environment that can be deployed. Environments are created based on templates. A template includes a name, a description, a valid set of configuration files that describe the deployment, and a set of variables and secrets.

​
Why templates are useful

  • Reusability: A template can be reused across many environments, all pointing to the same code. This supports DRY (Don’t Repeat Yourself) architecture and reduces configuration drift.
  • Self-service with control: Templates let engineers deploy cloud resources while giving admins control over what can and cannot be configured.
  • Centralized variable management: Variables defined at the template level are automatically inherited by all environments created from that template.

​
Template types

Templates reference specific IaC tools, and the type of template defines the required tool. Terraform/OpenTofu: Requires relevant .tf files in your Git repository. Either the terraform or tofu executable handles deployment, depending on the template type selected. Terragrunt: Requires Terragrunt configurations and the correct folder hierarchy with .tf files. The terragrunt executable manages deployment. Pulumi: Requires code that describes your environment in the repository. The pulumi executable handles deployment. CloudFormation: Requires JSON or YAML CloudFormation templates. Managed by aws cloudformation commands. Kubernetes: Requires YAML or JSON files describing cluster resources. Kustomize labels resources, and kubectl manages them. Helm: Configurable via a Helm repo or Git repository with the chart definition. The helm executable and helm diff plugin handle deployment.

​
Create a template

To create a new template, click CREATE NEW TEMPLATE in the top right of the Templates screen (found in the Organization menu). Enter the Git repository details: the repository URL, a branch or tag name, and the path to the root directory of the IaC files.
Templates can only be created at the Organization level, not at the Project level.
If your VCS is not GitHub, GitLab, Bitbucket, or Azure DevOpsSelect the Other VCS option. You can enter the details manually or paste the full URL and let env zero extract the values. Auto-extraction works for HTTP/S repositories only. For SSH repositories, enter the URL manually.To access a private repository, select a Git access token from the Select Token field. To define tokens in env zero, see Manage Git connectivity below.
After creating the template, configure its variables by clicking Settings and selecting the Variables tab. By default, environments inherit variables set at the Organization level, but you can override or add new ones. If your repository URL uses SSH, the token field is replaced by an SSH key field.

​
Manage templates

Templates can only be added, deleted, or edited at the Organization level. At the Project level, you can only associate or disassociate a template with the project. You can view all templates in the Templates tab, view the template code, and create new environments from templates. If you have the appropriate permissions, you can edit a template’s settings, for example, changing the repository, branch, tag, or variables. You can delete a template. Deleted templates can no longer create new environments, but existing environments based on the deleted template are unaffected.
Changes to a template only affect new deployments. To apply template changes to an active environment, you must redeploy it.

​
On-premises Git server support

Full GitOps support is available for GitHub Enterprise, GitLab Enterprise, and Bitbucket Server. Communication with these VCS providers is done through a self-hosted agent, so you do not need to expose your VCS to external networks. If you use the Other VCS type to access a Git server on a private network, you need to enable port forwarding with a public IP and a high port number. Open that port in your firewall for incoming traffic only from env zero’s IP addresses. See Security overview: IP addresses.

​
Manage Git connectivity

​
Tokens (HTTP/S)

To access a private Git repository via HTTP/S, env zero needs a read-only access token. Only Organization Admins can manage Git tokens. To view or add tokens, open Organization Settings and select the Credentials tab. To add a token, click Add Token and enter a name and the token value from your Git hosting service. If your service requires a username (such as Bitbucket or GitLab), enter the value as username:token. Token generation docs for each provider:

​
SSH keys

To access a private Git repository via SSH, env zero needs a private SSH key that has access to the repository. SSH keys are configured at the Organization level by Admins. To enable SSH connectivity, associate an SSH key with your template.

​
Automatic retry policy

You can configure env zero to automatically retry a template after a failed deployment. Retries apply only to the apply or destroy step, not the plan step. To enable automatic retry:
  1. Open the template’s Settings page and find Retry on failure in the Advanced section.
  2. Choose whether to retry on Deploy, Destroy, or both, and set the number of retry attempts.
  3. Optionally define a regex pattern to retry only on specific errors. If no pattern is provided, all errors trigger a retry.

​
Finding a template ID

You may need the template ID when using the Terraform provider or making API calls. Find it in the Template Card on the Templates tab. Template card in the Templates tab showing the template ID location

​
Best practices

  • Design templates for reuse across multiple environments.
  • Use consistent naming and structure across templates.
  • Define shared variables at the Organization level; override only when necessary.
  • Use secrets for sensitive configuration values.
  • Rotate Git access tokens and SSH keys regularly.

​
Next steps