idyl apply
Apply resource manifests from a file
Apply resource manifests from a YAML file.
The command creates each resource if it does not exist, updates it if the
manifest describes something different from what the platform holds, and
leaves it alone when the two already agree. Supported kinds are Namespace,
Deployment, ReplicaSet, DaemonSet, HostPodSet, Pod, Job, Sandbox, CronJob,
Service, WebApp, Gateway, HTTPRoute, TLSRoute, ReferenceGrant,
RegistryCredential, Secret, TLSCertificate, Fleet, FleetLease, CloudAccount,
Node, and Supervisor. A file can contain multiple YAML documents separated by
---, and they are applied in file order.
Pass ”-” as the filename to read the manifest from standard input.
A manifest is the complete desired state of the resource it names, not a patch.
A field the manifest leaves out is written as empty: omitting a fleet’s
spec.provisioning removes its capacity, and omitting a node’s spec.suspended
returns it to service. A fleet’s spec.subnet and a node’s spec.fleet are
required: a fleet serves the subnet it was created in for its whole life, and
a node is always in one fleet. Fields the platform assigns rather than you — a
resource’s ID, a cloud connection’s external ID — are carried through from
what the platform holds and are never emptied this way.
When an apply empties something, it says what.
Fleet, FleetLease, and CloudAccount manifests are matched to what the account
already holds by metadata.name; a Node manifest is matched by metadata.id.
Nodes are never created from a manifest, so a Node manifest naming a node the
account does not have is an error.
A Supervisor has no name: a Supervisor manifest addresses the Supervisor of
its metadata.namespace in its metadata.subnet, or of the selected Namespace
and subnet when it states neither. Its spec.placement is fixed at creation,
so a manifest stating a different one is refused, and —fleet and —node do
not apply to it.
Container specs may include imagePullCredentialRef.name for private image
pulls. The retired imagePullSecret field is rejected.
RegistryCredential manifests must include spec.passwordData with the base64
encoded registry password.
Secret and TLSCertificate manifests accept write-only base64 fields. Base64 is
not encryption; do not commit manifests containing customer secret material.

