Skip to main content
Apply resource manifests from a YAML file. The command creates each resource if it does not exist, updates it if the manifest describes something different from what the platform holds, and leaves it alone when the two already agree. Supported kinds are Namespace, Deployment, ReplicaSet, Pod, Job, Sandbox, CronJob, Service, WebApp, Gateway, HTTPRoute, TLSRoute, ReferenceGrant, RegistryCredential, Secret, TLSCertificate, Fleet, FleetLease, CloudAccount, and Node. A file can contain multiple YAML documents separated by ---, and they are applied in file order. Pass ”-” as the filename to read the manifest from standard input. A manifest is the complete desired state of the resource it names, not a patch. A field the manifest leaves out is written as empty: omitting spec.subnet detaches a fleet, omitting spec.fleet takes a node out of its fleet, and omitting spec.suspended returns one to service. Fields the platform assigns rather than you — a resource’s ID, a cloud connection’s external ID — are carried through from what the platform holds and are never emptied this way. When an apply empties something, it says what. Fleet, FleetLease, and CloudAccount manifests are matched to what the account already holds by metadata.name; a Node manifest is matched by metadata.id. Nodes are never created from a manifest, so a Node manifest naming a node the account does not have is an error. Container specs may include imagePullCredentialRef.name for private image pulls. The retired imagePullSecret field is rejected. RegistryCredential manifests must include spec.passwordData with the base64 encoded registry password. Secret and TLSCertificate manifests accept write-only base64 fields. Base64 is not encryption; do not commit manifests containing customer secret material.

Usage

Flags

Inherited flags

Examples