Bash runs

A Bash run executes a shell script with bash -c. The script is the run's command, so it can drive any tool on the host: kubectl, aws, terraform, make, and so on. It is the general-purpose escape hatch when a task is not an Ansible play.

What runs

The command is passed to bash -c. The working directory is the project checkout when the run sources a project, so the script reaches the repository's files. A dry run passes bash -n, which parses the script and reports syntax errors without executing it.

How values reach the script

Extra vars, including survey answers and template vars, arrive as SWITCHTENDER_VARS, a JSON object.
Each var whose name a shell variable can hold and whose value is a string, a number, or a boolean also arrives on its own as SWITCHTENDER_VAR_<name>, so one answer needs no JSON parser:
```
  region=${SWITCHTENDER_VAR_region:-us-east-1}
```
Read a list or an object from the JSON with jq, which the container image carries and a host needs installed:
```
  zones=$(printf '%s' "$SWITCHTENDER_VARS" | jq -r '.zones | join(",")')
```
The prefix keeps an answer from ever setting PATH or any other variable the shell runs by.
An env credential's KEY=VALUE lines are set in the environment directly.
A token credential is set as SWITCHTENDER_TOKEN.
Credentials attached to the run's inventory arrive the same way, so a fleet's secret variables reach the script without naming them on the run.

Example

set -euo pipefail
region=${SWITCHTENDER_VAR_region:-us-east-1}
echo "Draining $region"
kubectl --context "$region" drain node-1 --ignore-daemonsets

See also Terraform runs, Python runs, Go runs, and the tutorials.