Channel/version:

Console utilities
Deckhouse CLI (d8)
Deckhouse CLI command reference

Starting from version 1.76, Deckhouse Kubernetes Platform has been renamed to Deckhouse Platform.

The platform now offers more features, and editions have changed. We are already updating the documentation, but if you have any questions, please contact your account manager or technical support.

Deckhouse CLI command reference

This page is generated automatically.

d8 controls the Deckhouse Kubernetes Platform

Version: v0.33.31

Common options:

--help, -h
help for d8
--version, -v
version for d8

d8 backup

Backup various parts of Deckhouse Kubernetes Platform

Backup various parts of Deckhouse Kubernetes Platform

 © Flant JSC 2025

Options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 backup cluster-config

Usage:

d8 backup cluster-config <backup-tarball-path> [options]

Take a snapshot of cluster configuration

Take a snapshot of cluster configuration.

 This command creates a snapshot various kubernetes resources.

 © Flant JSC 2025

Options

--compress, -c
Compress result file

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 backup etcd

Usage:

d8 backup etcd <snapshot-path> [options]

Take a snapshot of ETCD state

Take a snapshot of ETCD state.

 This command creates a snapshot of the Kubernetes underlying key-value database ETCD.

 © Flant JSC 2025

Options

--etcd-pod, -p
Name of the etcd pod to snapshot from. (optional)
--verbose
Verbose log output.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 backup loki

Usage:

d8 backup loki [options]

Dump logs from Loki api.

Dump Loki logs.

 This command dump all logs from Loki api or in given range timestamps in DKP.

 © Flant JSC 2025

Options

--days
Limit maximum number of days in range to output per queue from Loki. (Default 5 maximum number of days in range per queue.)
--end
Set end timestamp range to dump logs from Loki. (Default get max end timestamp from Loki, ex. "2025-01-14 15:04:05".)
--limit
Limit the number of lines to output per queue from Loki. (Default 5000 max limit strings per queue.)
--start
Set start timestamp range to dump logs from Loki. (Default get max start timestamp from Loki, ex. "2025-01-12 15:04:05".)

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 completion

Generate the autocompletion script for the specified shell

Generate the autocompletion script for d8 for the specified shell.
See each sub-command's help for details on how to use the generated script.

d8 completion bash

Usage:

d8 completion bash [options]

Generate the autocompletion script for bash

Generate the autocompletion script for the bash shell.

This script depends on the 'bash-completion' package.
If it is not installed already, you can install it via your OS's package manager.

To load completions in your current shell session:

	source <(d8 completion bash)

To load completions for every new session, execute once:

#### Linux:

	d8 completion bash > /etc/bash_completion.d/d8

#### macOS:

	d8 completion bash > $(brew --prefix)/etc/bash_completion.d/d8

You will need to start a new shell for this setup to take effect.

Options

--no-descriptions
disable completion descriptions

d8 completion fish

Usage:

d8 completion fish [options]

Generate the autocompletion script for fish

Generate the autocompletion script for the fish shell.

To load completions in your current shell session:

	d8 completion fish | source

To load completions for every new session, execute once:

	d8 completion fish > ~/.config/fish/completions/d8.fish

You will need to start a new shell for this setup to take effect.

Options

--no-descriptions
disable completion descriptions

d8 completion powershell

Usage:

d8 completion powershell [options]

Generate the autocompletion script for powershell

Generate the autocompletion script for powershell.

To load completions in your current shell session:

	d8 completion powershell | Out-String | Invoke-Expression

To load completions for every new session, add the output of the above command
to your powershell profile.

Options

--no-descriptions
disable completion descriptions

d8 completion zsh

Usage:

d8 completion zsh [options]

Generate the autocompletion script for zsh

Generate the autocompletion script for the zsh shell.

If shell completion is not already enabled in your environment you will need
to enable it.  You can execute the following once:

	echo "autoload -U compinit; compinit" >> ~/.zshrc

To load completions in your current shell session:

	source <(d8 completion zsh)

To load completions for every new session, execute once:

#### Linux:

	d8 completion zsh > "${fpath[1]}/_d8"

#### macOS:

	d8 completion zsh > $(brew --prefix)/share/zsh/site-functions/_d8

You will need to start a new shell for this setup to take effect.

Options

--no-descriptions
disable completion descriptions

d8 cr

Work with container registries

Work with container images in OCI/Docker registries: inspect metadata,
transfer (pull/push), and browse contents.

Authentication uses the Docker config (~/.docker/config.json) - run
"d8 cr login" (or "docker login") first if the registry requires
credentials, or pass --username/--password to any command directly.

Options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr catalog

Usage:

d8 cr catalog REGISTRY [options]

List the repositories in a registry

Options

--full-ref
Print the full repository reference (registry/repo)

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr config

Usage:

d8 cr config IMAGE [options]

Print the config of an image

Print the raw config JSON of an image to stdout. Multi-arch indices are
resolved to a single image via --platform.

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr digest

Usage:

d8 cr digest [IMAGE] [options]

Print the digest of an image

By default, fetches the digest of IMAGE from the registry. With --tarball,
reads it from a local tarball instead; IMAGE then becomes optional and
selects an entry by tag (the first entry is used if omitted).

--full-ref is incompatible with --tarball.

Options

--full-ref
Print the full image reference with digest (registry/repo@sha256:...); incompatible with --tarball
--tarball
Read the digest from a local tarball instead of the registry

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr export

Usage:

d8 cr export IMAGE [TARBALL] [options]

Export the filesystem of an image as a tarball

Export writes the merged filesystem of IMAGE as a tar stream to TARBALL
(default: "-" = stdout). Output is byte-for-byte equivalent to crane export:
linknames are not rewritten, whiteouts are filtered.

For a directory-target extraction with symlink/path-traversal safety checks,
use "d8 cr fs extract".

Examples:
  d8 cr export alpine:3.19 -          # stream to stdout
  d8 cr export alpine:3.19 fs.tar     # write to file
  d8 cr export alpine:3.19 - | tar tf -   # list contents

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr fs

Usage:

d8 cr fs [options]

Inspect or extract files inside a container image

Inspect or extract files inside a container image without running it.

Subcommands show the merged filesystem - what a running container would see,
with deleted files hidden.

Path conventions:
  - Input PATH is tolerant: "/etc/nginx", "etc/nginx", and "./etc/nginx"
    are all accepted and refer to the same entry.
  - Output paths are tar-relative (no leading "/"), matching the convention
    of "crane export IMAGE - | tar tf -" and POSIX tar archives. JSON output
    uses the same tar-relative form.

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr fs cat

Usage:

d8 cr fs cat IMAGE PATH [options]

Print a file from a container image

Print a file from a container image to stdout.

Only regular files are supported. Directories, symlinks, hardlinks and
other non-regular entries return an error. Reads the merged filesystem -
files deleted by upper layers are reported as not-found.

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr fs extract

Usage:

d8 cr fs extract IMAGE [options]

Extract a container image filesystem to a local directory

Extract the merged filesystem of a container image into --output. To
inspect or copy a single file, use "fs cat"; to list a subpath, use
"fs ls IMAGE PATH". An extraction summary is printed when finished.

On interruption (Ctrl+C): partially-written files stay in --output for inspection.
Rerun extract to overwrite them; there is no per-file skip, the full filesystem is
re-materialized from layer 0.

Options

--output, -o
Write the filesystem into this directory

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr fs ls

Usage:

d8 cr fs ls IMAGE [PATH] [options]

List files inside a container image

List files inside a container image.

PATH limits output to that path and its descendants. Leading "./" or "/" is
stripped, so "/etc" and "etc" are equivalent. Output paths are tar-relative
(no leading "/"), matching "crane export | tar tf -".

Options

--long, -l
Long format with mode and size

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr fs tree

Usage:

d8 cr fs tree IMAGE [PATH] [options]

Show the filesystem of a container image as a tree

Render the filesystem of a container image as a tree.

PATH (if given) becomes the tree root and is normalized the same way as in
"fs ls" (leading "./" or "/" stripped, "..", trailing "/" cleaned).

The merged filesystem is rendered.

Options

--depth, -L
Max depth to descend (0 = unlimited)
--dirsfirst
List directories before files
--size
Show file sizes (human-readable: B / KB / MB)

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr login

Usage:

d8 cr login [REGISTRY] [options]

Log in to a container registry.

Verifies the credentials against the registry and, on success, writes them to
the Docker config (~/.docker/config.json, honouring $DOCKER_CONFIG). Every
other "d8 cr" command then authenticates from that config automatically, the
same way "docker login" works.

Credentials come from the --username/--password flags; either may be omitted
to be prompted interactively (the password is read without echo). With no
REGISTRY argument the default Docker Hub registry is used.

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr ls

Usage:

d8 cr ls REPO [options]

List the tags in a repository

Options

--full-ref
Print the full image reference (registry/repo:tag)
--omit-digest-tags, -O
Skip digest-based tags (sha256-*) created by signing tools

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr manifest

Usage:

d8 cr manifest IMAGE [options]

Print the manifest of an image

Print the raw manifest bytes of an image to stdout, exactly as the
registry returned them. Suitable for piping to jq or for signature verification.

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr pull

Usage:

d8 cr pull IMAGE... PATH [options]

Pull one or more remote images to a local path

Pull one or more images and save them to PATH. PATH is a tarball file
for formats "tarball"/"legacy", or a directory for format "oci".

Formats:
  tarball (default)  docker-compatible multi-image tarball
  legacy             single-image format compatible with "docker load" (tags only, digests not preserved)
  oci                OCI image-layout directory; keeps all platforms unless --platform is set

When to use:
  tarball  - default. Best for shipping one or more images as a single
             file: "docker load" / "podman load" reads it natively.
             Multi-arch indices flatten to one platform - pin it with
             --platform to avoid an ambiguity error.
  oci      - prefer when the destination is OCI-aware tooling (skopeo,
             crane, buildkit, another registry via "cr push --index").
             Preserves the full multi-arch index without --platform.
             Resumable: re-running the same pull skips already-downloaded
             blobs.
  legacy   - last-resort compatibility with very old "docker load" or
             tooling that rejects newer manifests. Lossy: digests are
             not preserved, single-image only. Avoid unless you have a
             specific consumer that fails on tarball.

On interruption (Ctrl+C):
  --format oci       Layer-level resume. Rerun the same pull; existing valid blobs are skipped
                     and in-flight layer temp-files are cleaned up automatically.
  --format tarball|  No resume. Rerun replaces the partial archive from scratch.
   legacy
  --cache-path       Layer cache is self-healing: corrupt partial entries are detected on
                     next access and re-downloaded.

Options

--cache-path, -c
Cache image layers under this directory (reused between pulls)
--format
Output format (one of: tarball, legacy, oci)

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 cr push

Usage:

d8 cr push PATH IMAGE [options]

Push a local image to a registry

A directory PATH is read as an OCI image layout; a file is treated as a
docker-style tarball. Multi-manifest OCI layouts must be pushed with --index.

Prints the pushed reference (with digest) to stdout; use --image-refs to also
write it to a file. --image-refs overwrites the target file if it exists.

Options

--image-refs
Persist the pushed reference (with digest) to this file
--index
Push a multi-manifest OCI layout as an index (OCI layout dirs only)

Global options

--allow-nondistributable-artifacts
Include non-distributable (foreign) layers when pushing
--insecure
Allow plain HTTP and skip TLS verification (localhost and RFC1918 hosts already auto-allow HTTP)
--password, -p
Registry password or token (overrides the Docker config; use with --username)
--platform
Resolve images to platform os/arch[/variant][:osversion] (image-level commands only)
--username, -u
Registry username (overrides the Docker config; use with --password)
--verbose, -v
Enable debug logs on stderr

d8 data

Data operations (export/import)

d8 data create

Usage:

d8 data create [flags] data_export_name volume_type/volume_name [options]

Deprecated: use 'd8 data export create'

Options

--namespace, -n
data volume namespace
--publish
Provide access outside of cluster
--ttl
Time to live

d8 data delete

Usage:

d8 data delete [flags] data_export_name [options]

Deprecated: use 'd8 data export delete'

Options

--namespace, -n
data volume namespace

d8 data download

Usage:

d8 data download [flags] [KIND/]data_export_name [path/file.ext] [options]

Deprecated: use 'd8 data export download'

Options

--namespace, -n
data volume namespace
--output, -o
file to save data (default: same as resource)
--publish
Provide access outside of cluster
--ttl
Time to live for auto-created DataExport

d8 data export

Usage:

d8 data export [options]

Export data (DataExport)

d8 data export create

Usage:

d8 data export create [flags] data_export_name volume_type/volume_name [options]

Create dataexport kubernetes resource

Options

--namespace, -n
data volume namespace
--publish
Provide access outside of cluster
--ttl
Time to live

d8 data export delete

Usage:

d8 data export delete [flags] data_export_name [options]

Delete dataexport kubernetes resource

Options

--namespace, -n
data volume namespace

d8 data export download

Usage:

d8 data export download [flags] [KIND/]data_export_name [path/file.ext] [options]

Download exported data

Options

--cleanup
Delete auto-created DataExport without prompting (--cleanup=true to delete, --cleanup=false to keep)
--namespace, -n
data volume namespace
--output, -o
file to save data (default: same as resource)
--publish
Provide access outside of cluster
--ttl
Time to live for auto-created DataExport

d8 data export list

Alias: ls

Usage:

d8 data export list [flags] data_export_name [/path/] [options]

List DataExported content information

Options

--cleanup
Delete auto-created DataExport without prompting (--cleanup=true to delete, --cleanup=false to keep)
--namespace, -n
data volume namespace
--publish
Provide access outside of cluster
--ttl
Time to live for auto-created DataExport

d8 data import

Usage:

d8 data import [options]

Import data (DataImport)

d8 data import create

Usage:

d8 data import create [flags] data_import_name [options]

Create DataImport

Options

--file, -f
PVC manifest file path
--namespace, -n
data volume namespace
--publish
Provide access outside of cluster
--ttl
Time to live
--wffc
Wait for first consumer

d8 data import delete

Usage:

d8 data import delete [flags] data_import_name [options]

Delete dataimport kubernetes resource

Options

--namespace, -n
data volume namespace

d8 data import upload

Usage:

d8 data import upload [flags] data_import_name path/file.ext [options]

Upload a file to the provided url

Options

--chunks, -c
number of chunks to upload
--dstPath, -d
destination path of the uploaded file
--file, -f
file to upload
--namespace, -n
data volume namespace
--publish, -P
publish the uploaded file
--resume
resume upload if process was interrupted

d8 data list

Usage:

d8 data list [flags] data_export_name [/path/] [options]

Deprecated: use 'd8 data export list'

Options

--namespace, -n
data volume namespace
--publish
Provide access outside of cluster
--ttl
Time to live for auto-created DataExport

d8 delivery-kit

Alias: dk

A set of tools for building, distributing, and deploying containerized applications

A set of tools for building, distributing, and deploying containerized applications.

LICENSE NOTE: The Deckhouse Delivery Kit functionality is exclusively available to users holding a valid license for any commercial version of the Deckhouse Kubernetes Platform.

© Flant JSC 2026

d8 delivery-kit build

Usage:

d8 delivery-kit build [IMAGE_NAME...] [options]

Build images

Build images that are described in werf.yaml.

The result of build command is built images pushed into the specified repo (or locally if repo is   
not specified).

If one or more IMAGE_NAME parameters specified, werf will build only these images.

Options

--add-custom-tag
Set tag alias for the content-based tag. The alias may contain the following shortcuts: - %image%, %image_slug% or %image_safe_slug% to use the image name (necessary if there is more than one image in the werf config); - %image_content_based_tag% to use a content-based tag. For cleaning custom tags and associated content-based tag are treated as one. Also can be defined with $WERF_ADD_CUSTOM_TAG_* (e.g. $WERF_ADD_CUSTOM_TAG_1="%image%-tag1", $WERF_ADD_CUSTOM_TAG_2="%image%-tag2")
--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-operations
Collect low-level operations statistics: add Operations and StageCache sections to the build report and print operations summary after the build (by default $WERF_BUILD_REPORT_OPERATIONS or false). Also enabled by --log-debug
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--check-built-images
Check that all used images are previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_CHECK_BUILT_IMAGES)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo, to pull base images
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or false by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--follow
Enable follow mode (default $WERF_FOLLOW). The mode allows restarting the command on a new commit. In development mode (--dev), werf restarts the command on any changes (including untracked files) in the git repository worktree
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--introspect-before-error
Introspect failed stage in the clean state, before running all assembly instructions of the stage
--introspect-error
Introspect failed stage in the state, right after running failed assembly instruction
--introspect-stage
Introspect a specific stage. The option can be used multiple times to introspect several stages. There are the following formats to use: * specify IMAGE_NAME/STAGE_NAME to introspect stage STAGE_NAME of either image or artifact IMAGE_NAME * specify STAGE_NAME or */STAGE_NAME for the introspection of all existing stages with name STAGE_NAME IMAGE_NAME is the name of an image or artifact described in werf.yaml, the nameless image specified with ~. STAGE_NAME should be one of the following: from, beforeInstall, dependenciesBeforeInstall, gitArchive, install, dependenciesAfterInstall, beforeSetup, dependenciesBeforeSetup, setup, dependenciesAfterSetup, gitCache, gitLatestPatch, dockerInstructions, dockerfile, imageSpec
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Check that all used images are previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions
--save-build-report
Save build report (by default $WERF_SAVE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)

d8 delivery-kit bundle

Usage:

d8 delivery-kit bundle [options]

Work with werf bundles: publish bundles into container registry and deploy bundles into Kubernetes cluster

d8 delivery-kit bundle apply

Usage:

d8 delivery-kit bundle apply [options]

Apply bundle into Kubernetes

Take latest bundle from the specified container registry using specified version tag or version     
mask and apply it as a helm chart into Kubernetes cluster.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--atomic
Enable auto rollback of the failed release to the previous deployed release version when current deploy process have failed ($WERF_ATOMIC by default)
--auto-rollback, -R
Enable auto rollback of the failed release to the previous deployed release version when current deploy process have failed ($WERF_AUTO_ROLLBACK by default)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--delete-propagation
Set default delete propagation strategy (default $WERF_DELETE_PROPAGATION or Foreground).
--deno-binary-path
Path to the Deno binary to use instead of auto-downloading (default $WERF_DENO_BINARY_PATH)
--deploy-graph-path
Save deploy graph path to the specified file (by default $WERF_DEPLOY_GRAPH_PATH). Extension must be .dot or not specified. If extension not specified, then .dot is used
--deploy-report-path
Change deploy report path and format (by default $WERF_DEPLOY_REPORT_PATH or ".werf-deploy-report.json" if not set). Extension must be .json for JSON format. If extension not specified, then .json is used
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--disable-default-values
Do not use values from the default .helm/values.yaml file (default $WERF_DISABLE_DEFAULT_VALUES or false)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo, to pull base images
--env
Use specified environment (default $WERF_ENV)
--force-adoption
Always adopt resources, even if they belong to a different Helm release (default $WERF_FORCE_ADOPTION or false)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--hooks-status-progress-period
No-op
--ignore-bundle-js
Do not use the existing bundle.js file. Requires TypeScript source files and Deno to rebuild (default $WERF_IGNORE_BUNDLE_JS)
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--insecure-helm-dependencies
Allow insecure oci registries to be used in the Chart.yaml dependencies configuration (default $WERF_INSECURE_HELM_DEPENDENCIES)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-api-server
Kubernetes API server address (default $WERF_KUBE_API_SERVER)
--kube-auth-password
Basic auth password for Kubernetes API (default $WERF_KUBE_AUTH_PASSWORD)
--kube-auth-provider
Auth provider name for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER)
--kube-auth-provider-config
Auth provider config for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER_CONFIG)
--kube-auth-username
Basic auth username for Kubernetes API (default $WERF_KUBE_AUTH_USERNAME)
--kube-burst-limit
Kubernetes client burst limit (default $WERF_KUBE_BURST_LIMIT or 100)
--kube-ca-data
Pass Kubernetes API server TLS CA data (default $WERF_KUBE_CA_DATA)
--kube-ca-path
Kubernetes API server CA path (default $WERF_KUBE_CA_PATH)
--kube-cert
Path to PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT
--kube-cert-data
Pass PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT_DATA)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--kube-context-cluster
Use cluster from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_CLUSTER)
--kube-context-user
Use user from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_USER)
--kube-impersonate-group
Sets Impersonate-Group headers when authenticating in Kubernetes. Can be also set with $WERF_KUBE_IMPERSONATE_GROUP_* environment variables
--kube-impersonate-uid
Sets Impersonate-Uid header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_UID)
--kube-impersonate-user
Sets Impersonate-User header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_USER)
--kube-key
Path to PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY)
--kube-key-data
Pass PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY_DATA)
--kube-proxy-url
Proxy URL to use for proxying all requests to Kubernetes API (default $WERF_KUBE_PROXY_URL)
--kube-qps-limit
Kubernetes client QPS limit (default $WERF_KUBE_QPS_LIMIT or 30)
--kube-request-timeout
Timeout for all requests to Kubernetes API (default $WERF_KUBE_REQUEST_TIMEOUT)
--kube-tls-server
Server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used (default $WERF_KUBE_TLS_SERVER)
--kube-token
Kubernetes bearer token used for authentication (default $WERF_KUBE_TOKEN)
--kube-token-path
Path to file with bearer token for authentication in Kubernetes (default $WERF_KUBE_TOKEN_PATH)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace
Use specified Kubernetes namespace (default $WERF_NAMESPACE)
--network-parallelism
Parallelize some network operations (default $WERF_NETWORK_PARALLELISM or 30)
--no-create-namespace
Don't create the release namespace (default $WERF_NO_CREATE_NAMESPACE)
--no-final-tracking
By default disable tracking operations that have no create/update/delete resource operations after them, which are most tracking operations, to speed up the release (default $WERF_NO_FINAL_TRACKING)
--no-install-crds
Do not install CRDs from "crds/" directories of installed charts (default $WERF_NO_INSTALL_CRDS)
--no-notes
Don't show release notes at the end of the release (default $WERF_NO_NOTES)
--no-pod-logs
Disable Pod logs collection and printing (default $WERF_NO_POD_LOGS or false)
--no-remove-manual-changes
Don't remove fields added manually to the resource in the cluster if fields aren't present in the manifest (default $WERF_NO_REMOVE_MANUAL_CHANGES)
--provenance-keyring
Path to keyring containing public keys to verify chart provenance (default $WERF_PROVENANCE_KEYRING)
--provenance-strategy
Strategy for provenance verifying (default $WERF_PROVENANCE_STRATEGY).
--quiet
Disable explanatory output (default $WERF_QUIET).
--release
Use specified Helm release name (default $WERF_RELEASE)
--release-info-annotations
Add annotations to release metadata (default $WERF_RELEASE_INFO_ANNOTATIONS)
--release-label
Add Helm release labels (can specify multiple). Kind of labels depends or release storage driver. Format: labelName=labelValue. Also, can be specified with $WERF_RELEASE_LABEL_* (e.g. $WERF_RELEASE_LABEL_1=labelName1=labelValue1, $WERF_RELEASE_LABEL_2=labelName2=labelValue2)
--release-storage
How releases should be stored (default $WERF_RELEASE_STORAGE)
--release-storage-sql-connection
SQL Connection String for Helm SQL Storage (default $WERF_RELEASE_STORAGE_SQL_CONNECTION)
--releases-history-max
Max releases to keep in release storage ($WERF_RELEASES_HISTORY_MAX or 5 by default)
--render-subchart-notes
If set, render subchart notes along with the parent (by default $WERF_RENDER_SUBCHART_NOTES or false)
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--rollback-graph-path
Save rollback graph path to the specified file (by default $WERF_ROLLBACK_GRAPH_PATH). Extension must be .dot or not specified. If extension not specified, then .dot is used
--runtime-annotations
Add annotations which will not trigger resource updates to all resources (default $WERF_RUNTIME_ANNOTATIONS)
--runtime-labels
Add labels which will not trigger resource updates to all resources (default $WERF_RUNTIME_LABELS)
--save-deploy-report
Save deploy report (by default $WERF_SAVE_DEPLOY_REPORT or false). Its path and format configured with --deploy-report-path
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
Set helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_* (e.g. $WERF_SET_1=key1=val1, $WERF_SET_2=key2=val2)
--set-docker-config-json-value
Shortcut to set current docker config into the .Values.global.werf.dockerconfigjson
--set-file
Set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2). Also, can be defined with $WERF_SET_FILE_* (e.g. $WERF_SET_FILE_1=key1=path1, $WERF_SET_FILE_2=key2=val2)
--set-json
Set new values, where the key is the value path and the value is JSON (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_JSON_* (e.g. $WERF_SET_JSON_1=key1=val1, $WERF_SET_JSON_2=key2=val2)
--set-literal
Set new values, where the key is the value path and the value is the value. The value will always become a literal string (can specify multiple or separate values with commas: key1=val1,key2=val2).) Also, can be defined with $WERF_SET_LITERAL_* (e.g. $WERF_SET_LITERAL_1=key1=val1, $WERF_SET_LITERAL_2=key2=val2)
--set-root-json
Set new keys in arbitrary things in the global root context ("$"), where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you REALLY know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_ROOT_JSON_* (e.g. $WERF_SET_ROOT_JSON_1=key1=val1, $WERF_SET_ROOT_JSON_2=key2=val2)
--set-runtime-json
Set new keys in $.Runtime, where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_RUNTIME_JSON_* (e.g. $WERF_SET_RUNTIME_JSON_1=key1=val1, $WERF_SET_RUNTIME_JSON_2=key2=val2)
--set-string
Set STRING helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_STRING_* (e.g. $WERF_SET_STRING_1=key1=val1, $WERF_SET_STRING_2=key2=val2)
--skip-dependencies-repo-refresh, -L
Do not refresh helm chart repositories locally cached index
--skip-tls-verify-helm-dependencies
Skip TLS certificate validation when accessing a Helm charts repository (default $WERF_SKIP_TLS_VERIFY_HELM_DEPENDENCIES)
--skip-tls-verify-kube
Skip TLS certificate validation when accessing a Kubernetes cluster (default $WERF_SKIP_TLS_VERIFY_KUBE)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--tag
Provide exact tag version or semver-based pattern, werf will install or upgrade to the latest version of the specified bundle ($WERF_TAG or latest by default)
--templates-allow-dns
Allow performing DNS requests in templating (default $WERF_TEMPLATES_ALLOW_DNS)
--timeout, -t
Resources tracking timeout in seconds ($WERF_TIMEOUT by default)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--values
Specify helm values in a YAML file or a URL (can specify multiple). Also, can be defined with $WERF_VALUES_* (e.g. $WERF_VALUES_1=.helm/values_1.yaml, $WERF_VALUES_2=.helm/values_2.yaml)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit bundle copy

Usage:

d8 delivery-kit bundle copy [options]

Copy published bundle into another location

Take latest bundle from the specified container registry using specified version tag and copy it    
either into a different tag within the same container registry or into another container registry.

Options

--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repos
--from
Source address of the bundle to copy, specify bundle archive using schema `archive:PATH_TO_ARCHIVE.tar.gz`, specify remote bundle with schema `[docker://]REPO:TAG` or without schema.
--helm-compatible-chart, -C
Set chart name in the Chart.yaml of the published chart to the last path component of container registry repo (for REGISTRY/PATH/TO/REPO address chart name will be REPO, more info https://helm.sh/docs/topics/registries/#oci-feature-deprecation-and-behavior-changes-with-v370). In helm compatibility mode chart is fully conforming with the helm OCI registry requirements. Default true or $WERF_HELM_COMPATIBLE_CHART.
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--rename-chart
Force setting of chart name in the Chart.yaml of the published chart to the specified value (can be set by the $WERF_RENAME_CHART, no rename by default, could not be used together with the '--helm-compatible-chart' option).
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--to
Destination address of the bundle to copy, specify bundle archive using schema `archive:PATH_TO_ARCHIVE.tar.gz`, specify remote bundle with schema `[docker://]REPO:TAG` or without schema.
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit bundle plan

Usage:

d8 delivery-kit bundle plan [options]

Plan bundle apply into Kubernetes

Take latest bundle from the specified container registry using specified version tag or version     
mask and plan its deployment as a helm chart into Kubernetes cluster.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--delete-propagation
Set default delete propagation strategy (default $WERF_DELETE_PROPAGATION or Foreground).
--deno-binary-path
Path to the Deno binary to use instead of auto-downloading (default $WERF_DENO_BINARY_PATH)
--deploy-graph-path
Save deploy graph path to the specified file (by default $WERF_DEPLOY_GRAPH_PATH). Extension must be .dot or not specified. If extension not specified, then .dot is used
--diff-context-lines
Show N lines of context around diffs ($WERF_DIFF_CONTEXT_LINES by default)
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--disable-default-values
Do not use values from the default .helm/values.yaml file (default $WERF_DISABLE_DEFAULT_VALUES or false)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo, to pull base images
--env
Use specified environment (default $WERF_ENV)
--exit-code
Return exit code 0 if no changes, 1 if error, 2 if any changes planned (default $WERF_EXIT_CODE or false)
--force-adoption
Always adopt resources, even if they belong to a different Helm release (default $WERF_FORCE_ADOPTION or false)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--ignore-bundle-js
Do not use the existing bundle.js file. Requires TypeScript source files and Deno to rebuild (default $WERF_IGNORE_BUNDLE_JS)
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--insecure-helm-dependencies
Allow insecure oci registries to be used in the Chart.yaml dependencies configuration (default $WERF_INSECURE_HELM_DEPENDENCIES)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-api-server
Kubernetes API server address (default $WERF_KUBE_API_SERVER)
--kube-auth-password
Basic auth password for Kubernetes API (default $WERF_KUBE_AUTH_PASSWORD)
--kube-auth-provider
Auth provider name for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER)
--kube-auth-provider-config
Auth provider config for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER_CONFIG)
--kube-auth-username
Basic auth username for Kubernetes API (default $WERF_KUBE_AUTH_USERNAME)
--kube-burst-limit
Kubernetes client burst limit (default $WERF_KUBE_BURST_LIMIT or 100)
--kube-ca-data
Pass Kubernetes API server TLS CA data (default $WERF_KUBE_CA_DATA)
--kube-ca-path
Kubernetes API server CA path (default $WERF_KUBE_CA_PATH)
--kube-cert
Path to PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT
--kube-cert-data
Pass PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT_DATA)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--kube-context-cluster
Use cluster from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_CLUSTER)
--kube-context-user
Use user from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_USER)
--kube-impersonate-group
Sets Impersonate-Group headers when authenticating in Kubernetes. Can be also set with $WERF_KUBE_IMPERSONATE_GROUP_* environment variables
--kube-impersonate-uid
Sets Impersonate-Uid header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_UID)
--kube-impersonate-user
Sets Impersonate-User header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_USER)
--kube-key
Path to PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY)
--kube-key-data
Pass PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY_DATA)
--kube-proxy-url
Proxy URL to use for proxying all requests to Kubernetes API (default $WERF_KUBE_PROXY_URL)
--kube-qps-limit
Kubernetes client QPS limit (default $WERF_KUBE_QPS_LIMIT or 30)
--kube-request-timeout
Timeout for all requests to Kubernetes API (default $WERF_KUBE_REQUEST_TIMEOUT)
--kube-tls-server
Server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used (default $WERF_KUBE_TLS_SERVER)
--kube-token
Kubernetes bearer token used for authentication (default $WERF_KUBE_TOKEN)
--kube-token-path
Path to file with bearer token for authentication in Kubernetes (default $WERF_KUBE_TOKEN_PATH)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace
Use specified Kubernetes namespace (default $WERF_NAMESPACE)
--network-parallelism
Parallelize some network operations (default $WERF_NETWORK_PARALLELISM or 30)
--no-final-tracking
By default disable tracking operations that have no create/update/delete resource operations after them, which are most tracking operations, to speed up the release (default $WERF_NO_FINAL_TRACKING)
--no-install-crds
Do not install CRDs from "crds/" directories of installed charts (default $WERF_NO_INSTALL_CRDS)
--no-remove-manual-changes
Don't remove fields added manually to the resource in the cluster if fields aren't present in the manifest (default $WERF_NO_REMOVE_MANUAL_CHANGES)
--provenance-keyring
Path to keyring containing public keys to verify chart provenance (default $WERF_PROVENANCE_KEYRING)
--provenance-strategy
Strategy for provenance verifying (default $WERF_PROVENANCE_STRATEGY).
--quiet
Disable explanatory output (default $WERF_QUIET).
--release
Use specified Helm release name (default $WERF_RELEASE)
--release-info-annotations
Add annotations to release metadata (default $WERF_RELEASE_INFO_ANNOTATIONS)
--release-label
Add Helm release labels (can specify multiple). Kind of labels depends or release storage driver. Format: labelName=labelValue. Also, can be specified with $WERF_RELEASE_LABEL_* (e.g. $WERF_RELEASE_LABEL_1=labelName1=labelValue1, $WERF_RELEASE_LABEL_2=labelName2=labelValue2)
--release-storage
How releases should be stored (default $WERF_RELEASE_STORAGE)
--release-storage-sql-connection
SQL Connection String for Helm SQL Storage (default $WERF_RELEASE_STORAGE_SQL_CONNECTION)
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--runtime-annotations
Add annotations which will not trigger resource updates to all resources (default $WERF_RUNTIME_ANNOTATIONS)
--runtime-labels
Add labels which will not trigger resource updates to all resources (default $WERF_RUNTIME_LABELS)
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
Set helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_* (e.g. $WERF_SET_1=key1=val1, $WERF_SET_2=key2=val2)
--set-docker-config-json-value
Shortcut to set current docker config into the .Values.global.werf.dockerconfigjson
--set-file
Set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2). Also, can be defined with $WERF_SET_FILE_* (e.g. $WERF_SET_FILE_1=key1=path1, $WERF_SET_FILE_2=key2=val2)
--set-json
Set new values, where the key is the value path and the value is JSON (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_JSON_* (e.g. $WERF_SET_JSON_1=key1=val1, $WERF_SET_JSON_2=key2=val2)
--set-literal
Set new values, where the key is the value path and the value is the value. The value will always become a literal string (can specify multiple or separate values with commas: key1=val1,key2=val2).) Also, can be defined with $WERF_SET_LITERAL_* (e.g. $WERF_SET_LITERAL_1=key1=val1, $WERF_SET_LITERAL_2=key2=val2)
--set-root-json
Set new keys in arbitrary things in the global root context ("$"), where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you REALLY know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_ROOT_JSON_* (e.g. $WERF_SET_ROOT_JSON_1=key1=val1, $WERF_SET_ROOT_JSON_2=key2=val2)
--set-runtime-json
Set new keys in $.Runtime, where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_RUNTIME_JSON_* (e.g. $WERF_SET_RUNTIME_JSON_1=key1=val1, $WERF_SET_RUNTIME_JSON_2=key2=val2)
--set-string
Set STRING helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_STRING_* (e.g. $WERF_SET_STRING_1=key1=val1, $WERF_SET_STRING_2=key2=val2)
--show-insignificant-diffs
Show insignificant diff lines ($WERF_SHOW_INSIGNIFICANT_DIFFS by default)
--show-sensitive-diffs
Show sensitive diff lines ($WERF_SHOW_SENSITIVE_DIFFS by default)
--show-verbose-crd-diffs
Show verbose CRD diff lines ($WERF_SHOW_VERBOSE_CRD_DIFFS by default)
--show-verbose-diffs
Show verbose diff lines ($WERF_SHOW_VERBOSE_DIFFS by default)
--skip-dependencies-repo-refresh, -L
Do not refresh helm chart repositories locally cached index
--skip-tls-verify-helm-dependencies
Skip TLS certificate validation when accessing a Helm charts repository (default $WERF_SKIP_TLS_VERIFY_HELM_DEPENDENCIES)
--skip-tls-verify-kube
Skip TLS certificate validation when accessing a Kubernetes cluster (default $WERF_SKIP_TLS_VERIFY_KUBE)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--tag
Provide exact tag version or semver-based pattern, werf will install or upgrade to the latest version of the specified bundle ($WERF_TAG or latest by default)
--templates-allow-dns
Allow performing DNS requests in templating (default $WERF_TEMPLATES_ALLOW_DNS)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--values
Specify helm values in a YAML file or a URL (can specify multiple). Also, can be defined with $WERF_VALUES_* (e.g. $WERF_VALUES_1=.helm/values_1.yaml, $WERF_VALUES_2=.helm/values_2.yaml)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit bundle publish

Usage:

d8 delivery-kit bundle publish [IMAGE_NAME...] [options]

Publish bundle

Publish bundle into the container registry. werf bundle contains built images defined in the        
werf.yaml, Helm chart, Service values which contain built images tags, any custom values and set    
values params provided during publish invocation, werf addon templates.

Published into container registry bundle can be rolled out by the "werf bundle" command.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-custom-tag
Set tag alias for the content-based tag. The alias may contain the following shortcuts: - %image%, %image_slug% or %image_safe_slug% to use the image name (necessary if there is more than one image in the werf config); - %image_content_based_tag% to use a content-based tag. For cleaning custom tags and associated content-based tag are treated as one. Also can be defined with $WERF_ADD_CUSTOM_TAG_* (e.g. $WERF_ADD_CUSTOM_TAG_1="%image%-tag1", $WERF_ADD_CUSTOM_TAG_2="%image%-tag2")
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-operations
Collect low-level operations statistics: add Operations and StageCache sections to the build report and print operations summary after the build (by default $WERF_BUILD_REPORT_OPERATIONS or false). Also enabled by --log-debug
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--deno-binary-path
Path to the Deno binary to use instead of auto-downloading (default $WERF_DENO_BINARY_PATH)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--disable-default-values
Do not use values from the default .helm/values.yaml file (default $WERF_DISABLE_DEFAULT_VALUES or false)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo and to pull base images
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or true by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--helm-compatible-chart, -C
Set chart name in the Chart.yaml of the published chart to the last path component of container registry repo (for REGISTRY/PATH/TO/REPO address chart name will be REPO, more info https://helm.sh/docs/topics/registries/#oci-feature-deprecation-and-behavior-changes-with-v370). In helm compatibility mode chart is fully conforming with the helm OCI registry requirements. Default false or $WERF_HELM_COMPATIBLE_CHART.
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--insecure-helm-dependencies
Allow insecure oci registries to be used in the Chart.yaml dependencies configuration (default $WERF_INSECURE_HELM_DEPENDENCIES)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--introspect-before-error
Introspect failed stage in the clean state, before running all assembly instructions of the stage
--introspect-error
Introspect failed stage in the state, right after running failed assembly instruction
--introspect-stage
Introspect a specific stage. The option can be used multiple times to introspect several stages. There are the following formats to use: * specify IMAGE_NAME/STAGE_NAME to introspect stage STAGE_NAME of either image or artifact IMAGE_NAME * specify STAGE_NAME or */STAGE_NAME for the introspection of all existing stages with name STAGE_NAME IMAGE_NAME is the name of an image or artifact described in werf.yaml, the nameless image specified with ~. STAGE_NAME should be one of the following: from, beforeInstall, dependenciesBeforeInstall, gitArchive, install, dependenciesAfterInstall, beforeSetup, dependenciesBeforeSetup, setup, dependenciesAfterSetup, gitCache, gitLatestPatch, dockerInstructions, dockerfile, imageSpec
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--quiet
Disable explanatory output (default $WERF_QUIET).
--rename-chart
Force setting of chart name in the Chart.yaml of the published chart to the specified value (can be set by the $WERF_RENAME_CHART, no rename by default, could not be used together with the '--helm-compatible-chart' option).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--save-build-report
Save build report (by default $WERF_SAVE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
Set helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_* (e.g. $WERF_SET_1=key1=val1, $WERF_SET_2=key2=val2)
--set-file
Set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2). Also, can be defined with $WERF_SET_FILE_* (e.g. $WERF_SET_FILE_1=key1=path1, $WERF_SET_FILE_2=key2=val2)
--set-json
Set new values, where the key is the value path and the value is JSON (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_JSON_* (e.g. $WERF_SET_JSON_1=key1=val1, $WERF_SET_JSON_2=key2=val2)
--set-literal
Set new values, where the key is the value path and the value is the value. The value will always become a literal string (can specify multiple or separate values with commas: key1=val1,key2=val2).) Also, can be defined with $WERF_SET_LITERAL_* (e.g. $WERF_SET_LITERAL_1=key1=val1, $WERF_SET_LITERAL_2=key2=val2)
--set-root-json
Set new keys in arbitrary things in the global root context ("$"), where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you REALLY know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_ROOT_JSON_* (e.g. $WERF_SET_ROOT_JSON_1=key1=val1, $WERF_SET_ROOT_JSON_2=key2=val2)
--set-runtime-json
Set new keys in $.Runtime, where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_RUNTIME_JSON_* (e.g. $WERF_SET_RUNTIME_JSON_1=key1=val1, $WERF_SET_RUNTIME_JSON_2=key2=val2)
--set-string
Set STRING helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_STRING_* (e.g. $WERF_SET_STRING_1=key1=val1, $WERF_SET_STRING_2=key2=val2)
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-dependencies-repo-refresh, -L
Do not refresh helm chart repositories locally cached index
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-helm-dependencies
Skip TLS certificate validation when accessing a Helm charts repository (default $WERF_SKIP_TLS_VERIFY_HELM_DEPENDENCIES)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tag
Publish bundle into container registry repo by the provided tag ($WERF_TAG or latest by default)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--use-custom-tag
Use a tag alias in helm templates instead of an image content-based tag (NOT RECOMMENDED). The alias may contain the following shortcuts: - %image%, %image_slug% or %image_safe_slug% to use the image name (necessary if there is more than one image in the werf config); - %image_content_based_tag% to use a content-based tag. For cleaning custom tags and associated content-based tag are treated as one. Also, can be defined with $WERF_USE_CUSTOM_TAG (e.g. $WERF_USE_CUSTOM_TAG="%image%-tag")
--values
Specify helm values in a YAML file or a URL (can specify multiple). Also, can be defined with $WERF_VALUES_* (e.g. $WERF_VALUES_1=.helm/values_1.yaml, $WERF_VALUES_2=.helm/values_2.yaml)
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)
--without-images
Disable building of images defined in the werf.yaml (if any) and usage of such images in the .helm/templates ($WERF_WITHOUT_IMAGES or false by default — e.g. enable all images defined in the werf.yaml by default)

d8 delivery-kit bundle render

Usage:

d8 delivery-kit bundle render [options]

Render Kubernetes manifests from bundle

Take locally extracted bundle or download bundle from the specified container registry using        
specified version tag or version mask and render it as Kubernetes manifests.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--bundle-dir, -b
Get extracted bundle from directory instead of registry (default $WERF_BUNDLE_DIR)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--deno-binary-path
Path to the Deno binary to use instead of auto-downloading (default $WERF_DENO_BINARY_PATH)
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--disable-default-values
Do not use values from the default .helm/values.yaml file (default $WERF_DISABLE_DEFAULT_VALUES or false)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo, to pull base images
--env
Use specified environment (default $WERF_ENV)
--extra-apiversions
Extra Kubernetes API versions passed to $.Capabilities.APIVersions. Can be also set with $WERF_EXTRA_APIVERSIONS_* environment variables, values can be comma-separated
--force-adoption
Always adopt resources, even if they belong to a different Helm release (default $WERF_FORCE_ADOPTION or false)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--ignore-bundle-js
Do not use the existing bundle.js file. Requires TypeScript source files and Deno to rebuild (default $WERF_IGNORE_BUNDLE_JS)
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--include-crds
Include CRDs in the templated output (default $WERF_INCLUDE_CRDS)
--insecure-helm-dependencies
Allow insecure oci registries to be used in the Chart.yaml dependencies configuration (default $WERF_INSECURE_HELM_DEPENDENCIES)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-api-server
Kubernetes API server address (default $WERF_KUBE_API_SERVER)
--kube-auth-password
Basic auth password for Kubernetes API (default $WERF_KUBE_AUTH_PASSWORD)
--kube-auth-provider
Auth provider name for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER)
--kube-auth-provider-config
Auth provider config for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER_CONFIG)
--kube-auth-username
Basic auth username for Kubernetes API (default $WERF_KUBE_AUTH_USERNAME)
--kube-burst-limit
Kubernetes client burst limit (default $WERF_KUBE_BURST_LIMIT or 100)
--kube-ca-data
Pass Kubernetes API server TLS CA data (default $WERF_KUBE_CA_DATA)
--kube-ca-path
Kubernetes API server CA path (default $WERF_KUBE_CA_PATH)
--kube-cert
Path to PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT
--kube-cert-data
Pass PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT_DATA)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--kube-context-cluster
Use cluster from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_CLUSTER)
--kube-context-user
Use user from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_USER)
--kube-impersonate-group
Sets Impersonate-Group headers when authenticating in Kubernetes. Can be also set with $WERF_KUBE_IMPERSONATE_GROUP_* environment variables
--kube-impersonate-uid
Sets Impersonate-Uid header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_UID)
--kube-impersonate-user
Sets Impersonate-User header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_USER)
--kube-key
Path to PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY)
--kube-key-data
Pass PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY_DATA)
--kube-proxy-url
Proxy URL to use for proxying all requests to Kubernetes API (default $WERF_KUBE_PROXY_URL)
--kube-qps-limit
Kubernetes client QPS limit (default $WERF_KUBE_QPS_LIMIT or 30)
--kube-request-timeout
Timeout for all requests to Kubernetes API (default $WERF_KUBE_REQUEST_TIMEOUT)
--kube-tls-server
Server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used (default $WERF_KUBE_TLS_SERVER)
--kube-token
Kubernetes bearer token used for authentication (default $WERF_KUBE_TOKEN)
--kube-token-path
Path to file with bearer token for authentication in Kubernetes (default $WERF_KUBE_TOKEN_PATH)
--kube-version
Set specific Capabilities.KubeVersion (default $WERF_KUBE_VERSION)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace
Use specified Kubernetes namespace (default $WERF_NAMESPACE)
--network-parallelism
Parallelize some network operations (default $WERF_NETWORK_PARALLELISM or 30)
--output
Write render output to the specified file instead of stdout ($WERF_RENDER_OUTPUT by default)
--provenance-keyring
Path to keyring containing public keys to verify chart provenance (default $WERF_PROVENANCE_KEYRING)
--provenance-strategy
Strategy for provenance verifying (default $WERF_PROVENANCE_STRATEGY).
--quiet
Disable explanatory output (default $WERF_QUIET).
--release
Use specified Helm release name (default $WERF_RELEASE)
--release-storage
How releases should be stored (default $WERF_RELEASE_STORAGE)
--release-storage-sql-connection
SQL Connection String for Helm SQL Storage (default $WERF_RELEASE_STORAGE_SQL_CONNECTION)
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
Set helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_* (e.g. $WERF_SET_1=key1=val1, $WERF_SET_2=key2=val2)
--set-docker-config-json-value
Shortcut to set current docker config into the .Values.global.werf.dockerconfigjson
--set-file
Set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2). Also, can be defined with $WERF_SET_FILE_* (e.g. $WERF_SET_FILE_1=key1=path1, $WERF_SET_FILE_2=key2=val2)
--set-json
Set new values, where the key is the value path and the value is JSON (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_JSON_* (e.g. $WERF_SET_JSON_1=key1=val1, $WERF_SET_JSON_2=key2=val2)
--set-literal
Set new values, where the key is the value path and the value is the value. The value will always become a literal string (can specify multiple or separate values with commas: key1=val1,key2=val2).) Also, can be defined with $WERF_SET_LITERAL_* (e.g. $WERF_SET_LITERAL_1=key1=val1, $WERF_SET_LITERAL_2=key2=val2)
--set-root-json
Set new keys in arbitrary things in the global root context ("$"), where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you REALLY know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_ROOT_JSON_* (e.g. $WERF_SET_ROOT_JSON_1=key1=val1, $WERF_SET_ROOT_JSON_2=key2=val2)
--set-runtime-json
Set new keys in $.Runtime, where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_RUNTIME_JSON_* (e.g. $WERF_SET_RUNTIME_JSON_1=key1=val1, $WERF_SET_RUNTIME_JSON_2=key2=val2)
--set-string
Set STRING helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_STRING_* (e.g. $WERF_SET_STRING_1=key1=val1, $WERF_SET_STRING_2=key2=val2)
--show-only, -s
only show manifests rendered from the given templates
--skip-dependencies-repo-refresh, -L
Do not refresh helm chart repositories locally cached index
--skip-tls-verify-helm-dependencies
Skip TLS certificate validation when accessing a Helm charts repository (default $WERF_SKIP_TLS_VERIFY_HELM_DEPENDENCIES)
--skip-tls-verify-kube
Skip TLS certificate validation when accessing a Kubernetes cluster (default $WERF_SKIP_TLS_VERIFY_KUBE)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--tag
Provide exact tag version or semver-based pattern, werf will render the latest version of the specified bundle ($WERF_TAG or latest by default)
--templates-allow-dns
Allow performing DNS requests in templating (default $WERF_TEMPLATES_ALLOW_DNS)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--validate
Validate your manifests against the Kubernetes cluster you are currently pointing at (default $WERF_VALIDATE)
--values
Specify helm values in a YAML file or a URL (can specify multiple). Also, can be defined with $WERF_VALUES_* (e.g. $WERF_VALUES_1=.helm/values_1.yaml, $WERF_VALUES_2=.helm/values_2.yaml)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit chart

Usage:

d8 delivery-kit chart [options]

Work with charts

d8 delivery-kit chart ts

Usage:

d8 delivery-kit chart ts [options]

Work with TypeScript charts

d8 delivery-kit chart ts build

Usage:

d8 delivery-kit chart ts build [PATH] [options]

Build TypeScript chart.

Build TypeScript chart in the specified directory. If PATH is not specified, uses the current       
directory.

Options

--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--deno-binary-path
Path to the Deno binary to use instead of auto-downloading (default $WERF_DENO_BINARY_PATH)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--env
Use specified environment (default $WERF_ENV)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit chart ts init

Usage:

d8 delivery-kit chart ts init [PATH] [options]

Initialize the files needed to render manifests using TypeScript.

Initialize the files needed to render manifests using TypeScript. If PATH is not specified, uses    
the current directory.

Options

--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--env
Use specified environment (default $WERF_ENV)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit ci-env

Usage:

d8 delivery-kit ci-env CI_SYSTEM [options]

Generate werf environment variables for specified CI system

Generate werf environment variables for specified CI system.

Currently supported only GitLab (gitlab) and GitHub (github) CI systems

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--as-env-file
Create the .env file and print the path for sourcing (default $WERF_AS_ENV_FILE).
--as-file
Create the script and print the path for sourcing (default $WERF_AS_FILE).
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command will copy specified or default (~/.docker) config to the temporary directory and may perform additional login with new config.
--env
Use specified environment (default $WERF_ENV)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--login-to-registry
Log in to CI-specific registry automatically if possible (default $WERF_LOGIN_TO_REGISTRY).
--loose-giterminism
Loose werf giterminism mode restrictions
--output-file-path, -o
Write to custom file (default $WERF_OUTPUT_FILE_PATH).
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--shell
Set to cmdexe, powershell or use the default behavior that is compatible with any unix shell (default $WERF_SHELL).
--tagging-strategy
stub
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-docker-auth-config
Generate Docker config from DOCKER_AUTH_CONFIG environment variable instead of copying current Docker config (default $WERF_USE_DOCKER_AUTH_CONFIG).
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit cleanup

Usage:

d8 delivery-kit cleanup [options]

Cleanup project images in the container registry

Safely cleanup unused project images in the container registry.

The command works according to special rules called cleanup policies, which the user defines in     
werf.yaml.

It is safe to run this command periodically (daily is enough) by automated cleanup job in parallel  
with other werf commands such as build, converge and host cleanup.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--cleanup-report-path
Change cleanup report path (by default $WERF_CLEANUP_REPORT_PATH or ".werf-cleanup-report.json" if not set). Extension must be .json for JSON format. If extension not specified, then .json is used
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and delete images from the specified repo
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--dry-run
Indicate what the command would do without actually doing that (default $WERF_DRY_RUN)
--env
Use specified environment (default $WERF_ENV)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--keep-list
Set path to keep list file (default $WERF_KEEP_LIST)
--keep-stages-built-within-last-n-hours
Keep stages that were built within last hours (default $WERF_KEEP_STAGES_BUILT_WITHIN_LAST_N_HOURS or 2)
--kube-api-server
Kubernetes API server address (default $WERF_KUBE_API_SERVER)
--kube-ca-data
Pass Kubernetes API server TLS CA data (default $WERF_KUBE_CA_DATA)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Scan for used images only in the specified kube context, scan all contexts from kube config otherwise (default false or $WERF_SCAN_CONTEXT_ONLY)
--kube-scan-namespaces
Kubernetes namespaces to scan for each selected context (can specify multiple). Takes precedence over --scan-context-namespace-only when set.
--kube-token
Kubernetes bearer token used for authentication (default $WERF_KUBE_TOKEN)
--kube-token-path
Path to file with bearer token for authentication in Kubernetes (default $WERF_KUBE_TOKEN_PATH)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--save-cleanup-report
Save cleanup report (by default $WERF_SAVE_CLEANUP_REPORT or false). Its path configured with --cleanup-report-path
--scan-context-namespace-only
Scan for used images only in namespace linked with context for each available context in kube-config (or only for the context specified with option --kube-context). When disabled will scan all namespaces in all contexts (or only for the context specified with option --kube-context), unless --kube-scan-namespaces is set. (Default $WERF_SCAN_CONTEXT_NAMESPACE_ONLY)
--scan-context-only
Scan for used images only in the specified kube context, scan all contexts from kube config otherwise (default false or $WERF_SCAN_CONTEXT_ONLY)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--skip-tls-verify-kube
Skip TLS certificate validation when accessing a Kubernetes cluster (default $WERF_SKIP_TLS_VERIFY_KUBE)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).
--without-kube
Do not skip deployed Kubernetes images (default $WERF_WITHOUT_KUBE)

d8 delivery-kit completion

Usage:

d8 delivery-kit completion [options]

Generate bash completion scripts

Options

--shell
Set to bash, zsh, fish or powershell (default $WERF_SHELL or bash)

d8 delivery-kit compose

Usage:

d8 delivery-kit compose [options]

Work with docker-compose

d8 delivery-kit compose config

Usage:

d8 delivery-kit compose config [IMAGE_NAME...] [options] [--docker-compose-options="OPTIONS"] [--docker-compose-command-options="OPTIONS"]

Run docker-compose config command with forwarded image names.

Run docker-compose config command with forwarded image names.
Image environment name format: $WERF_<FORMATTED_WERF_IMAGE_NAME>_DOCKER_IMAGE_NAME                  
($WERF_DOCKER_IMAGE_NAME for nameless image).
<FORMATTED_WERF_IMAGE_NAME> is werf image name from werf.yaml modified according to the following   
rules:
- all characters are uppercase (app -> APP);
- charset /- is replaced with _ (DEV/APP-FRONTEND -> DEV_APP_FRONTEND).
If one or more IMAGE_NAME parameters specified, werf will build and forward only these images.
Given the following werf configuration:
# werf.yaml
project: x
configVersion: 1
---
image: frontend
dockerfile: frontend.Dockerfile
---
image: geodata-backend
dockerfile: backend.Dockerfile
Use described images as follows in your docker compose configuration:
# docker-compose.yaml
services:
  frontend:
    image: $WERF_FRONTEND_DOCKER_IMAGE_NAME
  backend:
    image: $WERF_GEODATA_BACKEND_DOCKER_IMAGE_NAME

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--docker-compose-bin-path
DEPRECATED: "docker compose" command always used now, this option is ignored. Define docker-compose bin path (default $WERF_DOCKER_COMPOSE_BIN_PATH)
--docker-compose-command-options
Define docker-compose command options (default $WERF_DOCKER_COMPOSE_COMMAND_OPTIONS)
--docker-compose-options
Define docker-compose options (default $WERF_DOCKER_COMPOSE_OPTIONS)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read and pull images from the specified repo
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--dry-run
Indicate what the command would do without actually doing that (default $WERF_DRY_RUN)
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or false by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--stub-tags
Use stubs instead of real tags (default $WERF_STUB_TAGS)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)
--without-images
Disable building of images defined in the werf.yaml (if any) and usage of such images in the .helm/templates ($WERF_WITHOUT_IMAGES or false by default — e.g. enable all images defined in the werf.yaml by default)

d8 delivery-kit compose down

Usage:

d8 delivery-kit compose down [IMAGE_NAME...] [options] [--docker-compose-options="OPTIONS"] [--docker-compose-command-options="OPTIONS"]

Run docker-compose down command with forwarded image names.

Run docker-compose down command with forwarded image names.
Image environment name format: $WERF_<FORMATTED_WERF_IMAGE_NAME>_DOCKER_IMAGE_NAME                  
($WERF_DOCKER_IMAGE_NAME for nameless image).
<FORMATTED_WERF_IMAGE_NAME> is werf image name from werf.yaml modified according to the following   
rules:
- all characters are uppercase (app -> APP);
- charset /- is replaced with _ (DEV/APP-FRONTEND -> DEV_APP_FRONTEND).
If one or more IMAGE_NAME parameters specified, werf will build and forward only these images.
Given the following werf configuration:
# werf.yaml
project: x
configVersion: 1
---
image: frontend
dockerfile: frontend.Dockerfile
---
image: geodata-backend
dockerfile: backend.Dockerfile
Use described images as follows in your docker compose configuration:
# docker-compose.yaml
services:
  frontend:
    image: $WERF_FRONTEND_DOCKER_IMAGE_NAME
  backend:
    image: $WERF_GEODATA_BACKEND_DOCKER_IMAGE_NAME

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--docker-compose-bin-path
DEPRECATED: "docker compose" command always used now, this option is ignored. Define docker-compose bin path (default $WERF_DOCKER_COMPOSE_BIN_PATH)
--docker-compose-command-options
Define docker-compose command options (default $WERF_DOCKER_COMPOSE_COMMAND_OPTIONS)
--docker-compose-options
Define docker-compose options (default $WERF_DOCKER_COMPOSE_OPTIONS)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read and pull images from the specified repo
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--dry-run
Indicate what the command would do without actually doing that (default $WERF_DRY_RUN)
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or false by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--stub-tags
Use stubs instead of real tags (default $WERF_STUB_TAGS)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)
--without-images
Disable building of images defined in the werf.yaml (if any) and usage of such images in the .helm/templates ($WERF_WITHOUT_IMAGES or false by default — e.g. enable all images defined in the werf.yaml by default)

d8 delivery-kit compose run

Usage:

d8 delivery-kit compose run [IMAGE_NAME...] [options] [--docker-compose-options="OPTIONS"] [--docker-compose-command-options="OPTIONS"] -- SERVICE [COMMAND] [ARGS...]

Run docker-compose run command with forwarded image names.

Run docker-compose run command with forwarded image names.
Image environment name format: $WERF_<FORMATTED_WERF_IMAGE_NAME>_DOCKER_IMAGE_NAME                  
($WERF_DOCKER_IMAGE_NAME for nameless image).
<FORMATTED_WERF_IMAGE_NAME> is werf image name from werf.yaml modified according to the following   
rules:
- all characters are uppercase (app -> APP);
- charset /- is replaced with _ (DEV/APP-FRONTEND -> DEV_APP_FRONTEND).
If one or more IMAGE_NAME parameters specified, werf will build and forward only these images.
Given the following werf configuration:
# werf.yaml
project: x
configVersion: 1
---
image: frontend
dockerfile: frontend.Dockerfile
---
image: geodata-backend
dockerfile: backend.Dockerfile
Use described images as follows in your docker compose configuration:
# docker-compose.yaml
services:
  frontend:
    image: $WERF_FRONTEND_DOCKER_IMAGE_NAME
  backend:
    image: $WERF_GEODATA_BACKEND_DOCKER_IMAGE_NAME

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--docker-compose-bin-path
DEPRECATED: "docker compose" command always used now, this option is ignored. Define docker-compose bin path (default $WERF_DOCKER_COMPOSE_BIN_PATH)
--docker-compose-command-options
Define docker-compose command options (default $WERF_DOCKER_COMPOSE_COMMAND_OPTIONS)
--docker-compose-options
Define docker-compose options (default $WERF_DOCKER_COMPOSE_OPTIONS)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read and pull images from the specified repo
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--dry-run
Indicate what the command would do without actually doing that (default $WERF_DRY_RUN)
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or false by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--stub-tags
Use stubs instead of real tags (default $WERF_STUB_TAGS)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)
--without-images
Disable building of images defined in the werf.yaml (if any) and usage of such images in the .helm/templates ($WERF_WITHOUT_IMAGES or false by default — e.g. enable all images defined in the werf.yaml by default)

d8 delivery-kit compose up

Usage:

d8 delivery-kit compose up [IMAGE_NAME...] [options] [--docker-compose-options="OPTIONS"] [--docker-compose-command-options="OPTIONS"] [--] [SERVICE...]

Run docker-compose up command with forwarded image names.

Run docker-compose up command with forwarded image names.
Image environment name format: $WERF_<FORMATTED_WERF_IMAGE_NAME>_DOCKER_IMAGE_NAME                  
($WERF_DOCKER_IMAGE_NAME for nameless image).
<FORMATTED_WERF_IMAGE_NAME> is werf image name from werf.yaml modified according to the following   
rules:
- all characters are uppercase (app -> APP);
- charset /- is replaced with _ (DEV/APP-FRONTEND -> DEV_APP_FRONTEND).
If one or more IMAGE_NAME parameters specified, werf will build and forward only these images.
Given the following werf configuration:
# werf.yaml
project: x
configVersion: 1
---
image: frontend
dockerfile: frontend.Dockerfile
---
image: geodata-backend
dockerfile: backend.Dockerfile
Use described images as follows in your docker compose configuration:
# docker-compose.yaml
services:
  frontend:
    image: $WERF_FRONTEND_DOCKER_IMAGE_NAME
  backend:
    image: $WERF_GEODATA_BACKEND_DOCKER_IMAGE_NAME

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--docker-compose-bin-path
DEPRECATED: "docker compose" command always used now, this option is ignored. Define docker-compose bin path (default $WERF_DOCKER_COMPOSE_BIN_PATH)
--docker-compose-command-options
Define docker-compose command options (default $WERF_DOCKER_COMPOSE_COMMAND_OPTIONS)
--docker-compose-options
Define docker-compose options (default $WERF_DOCKER_COMPOSE_OPTIONS)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read and pull images from the specified repo
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--dry-run
Indicate what the command would do without actually doing that (default $WERF_DRY_RUN)
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or false by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--follow
Enable follow mode (default $WERF_FOLLOW). The mode allows restarting the command on a new commit. In development mode (--dev), werf restarts the command on any changes (including untracked files) in the git repository worktree
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--stub-tags
Use stubs instead of real tags (default $WERF_STUB_TAGS)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)
--without-images
Disable building of images defined in the werf.yaml (if any) and usage of such images in the .helm/templates ($WERF_WITHOUT_IMAGES or false by default — e.g. enable all images defined in the werf.yaml by default)

d8 delivery-kit config

Usage:

d8 delivery-kit config [options]

Work with werf.yaml

d8 delivery-kit config graph

Usage:

d8 delivery-kit config graph [IMAGE_NAME...] [options]

Print dependency graph for images in werf.yaml.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or false by default)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit config list

Usage:

d8 delivery-kit config list [options]

List image and artifact names defined in werf.yaml.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Show only final images
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--images-only
Show only final images
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit config render

Usage:

d8 delivery-kit config render [IMAGE_NAME...] [options]

Render werf.yaml.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--env
Use specified environment (default $WERF_ENV)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit converge

Usage:

d8 delivery-kit converge [options]

Build and push images, then deploy application into Kubernetes

Build and push images, then deploy application into Kubernetes.

The result of converge command is an application deployed into Kubernetes for current git state.    
Command will create release and wait until all resources of the release will become ready.

Environment is a required param for the deploy by default, because it is needed to construct Helm   
Release name and Kubernetes Namespace. Either --env or $WERF_ENV should be specified for command.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-custom-tag
Set tag alias for the content-based tag. The alias may contain the following shortcuts: - %image%, %image_slug% or %image_safe_slug% to use the image name (necessary if there is more than one image in the werf config); - %image_content_based_tag% to use a content-based tag. For cleaning custom tags and associated content-based tag are treated as one. Also can be defined with $WERF_ADD_CUSTOM_TAG_* (e.g. $WERF_ADD_CUSTOM_TAG_1="%image%-tag1", $WERF_ADD_CUSTOM_TAG_2="%image%-tag2")
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--atomic
Enable auto rollback of the failed release to the previous deployed release version when current deploy process have failed ($WERF_ATOMIC by default)
--auto-rollback, -R
Enable auto rollback of the failed release to the previous deployed release version when current deploy process have failed ($WERF_AUTO_ROLLBACK by default)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-operations
Collect low-level operations statistics: add Operations and StageCache sections to the build report and print operations summary after the build (by default $WERF_BUILD_REPORT_OPERATIONS or false). Also enabled by --log-debug
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--delete-propagation
Set default delete propagation strategy (default $WERF_DELETE_PROPAGATION or Foreground).
--deno-binary-path
Path to the Deno binary to use instead of auto-downloading (default $WERF_DENO_BINARY_PATH)
--deploy-graph-path
Save deploy graph path to the specified file (by default $WERF_DEPLOY_GRAPH_PATH). Extension must be .dot or not specified. If extension not specified, then .dot is used
--deploy-report-path
Change deploy report path and format (by default $WERF_DEPLOY_REPORT_PATH or ".werf-deploy-report.json" if not set). Extension must be .json for JSON format. If extension not specified, then .json is used
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--disable-default-values
Do not use values from the default .helm/values.yaml file (default $WERF_DISABLE_DEFAULT_VALUES or false)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo, to pull base images
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or true by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--follow
Enable follow mode (default $WERF_FOLLOW). The mode allows restarting the command on a new commit. In development mode (--dev), werf restarts the command on any changes (including untracked files) in the git repository worktree
--force-adoption
Always adopt resources, even if they belong to a different Helm release (default $WERF_FORCE_ADOPTION or false)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--hooks-status-progress-period
No-op
--ignore-bundle-js
Do not use the existing bundle.js file. Requires TypeScript source files and Deno to rebuild (default $WERF_IGNORE_BUNDLE_JS)
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--insecure-helm-dependencies
Allow insecure oci registries to be used in the Chart.yaml dependencies configuration (default $WERF_INSECURE_HELM_DEPENDENCIES)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--introspect-before-error
Introspect failed stage in the clean state, before running all assembly instructions of the stage
--introspect-error
Introspect failed stage in the state, right after running failed assembly instruction
--introspect-stage
Introspect a specific stage. The option can be used multiple times to introspect several stages. There are the following formats to use: * specify IMAGE_NAME/STAGE_NAME to introspect stage STAGE_NAME of either image or artifact IMAGE_NAME * specify STAGE_NAME or */STAGE_NAME for the introspection of all existing stages with name STAGE_NAME IMAGE_NAME is the name of an image or artifact described in werf.yaml, the nameless image specified with ~. STAGE_NAME should be one of the following: from, beforeInstall, dependenciesBeforeInstall, gitArchive, install, dependenciesAfterInstall, beforeSetup, dependenciesBeforeSetup, setup, dependenciesAfterSetup, gitCache, gitLatestPatch, dockerInstructions, dockerfile, imageSpec
--kube-api-server
Kubernetes API server address (default $WERF_KUBE_API_SERVER)
--kube-auth-password
Basic auth password for Kubernetes API (default $WERF_KUBE_AUTH_PASSWORD)
--kube-auth-provider
Auth provider name for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER)
--kube-auth-provider-config
Auth provider config for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER_CONFIG)
--kube-auth-username
Basic auth username for Kubernetes API (default $WERF_KUBE_AUTH_USERNAME)
--kube-burst-limit
Kubernetes client burst limit (default $WERF_KUBE_BURST_LIMIT or 100)
--kube-ca-data
Pass Kubernetes API server TLS CA data (default $WERF_KUBE_CA_DATA)
--kube-ca-path
Kubernetes API server CA path (default $WERF_KUBE_CA_PATH)
--kube-cert
Path to PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT
--kube-cert-data
Pass PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT_DATA)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--kube-context-cluster
Use cluster from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_CLUSTER)
--kube-context-user
Use user from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_USER)
--kube-impersonate-group
Sets Impersonate-Group headers when authenticating in Kubernetes. Can be also set with $WERF_KUBE_IMPERSONATE_GROUP_* environment variables
--kube-impersonate-uid
Sets Impersonate-Uid header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_UID)
--kube-impersonate-user
Sets Impersonate-User header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_USER)
--kube-key
Path to PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY)
--kube-key-data
Pass PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY_DATA)
--kube-proxy-url
Proxy URL to use for proxying all requests to Kubernetes API (default $WERF_KUBE_PROXY_URL)
--kube-qps-limit
Kubernetes client QPS limit (default $WERF_KUBE_QPS_LIMIT or 30)
--kube-request-timeout
Timeout for all requests to Kubernetes API (default $WERF_KUBE_REQUEST_TIMEOUT)
--kube-tls-server
Server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used (default $WERF_KUBE_TLS_SERVER)
--kube-token
Kubernetes bearer token used for authentication (default $WERF_KUBE_TOKEN)
--kube-token-path
Path to file with bearer token for authentication in Kubernetes (default $WERF_KUBE_TOKEN_PATH)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--namespace
Use specified Kubernetes namespace (default [[ project ]]-[[ env ]] template or deploy.namespace custom template from werf.yaml or $WERF_NAMESPACE)
--network-parallelism
Parallelize some network operations (default $WERF_NETWORK_PARALLELISM or 30)
--no-create-namespace
Don't create the release namespace (default $WERF_NO_CREATE_NAMESPACE)
--no-final-tracking
By default disable tracking operations that have no create/update/delete resource operations after them, which are most tracking operations, to speed up the release (default $WERF_NO_FINAL_TRACKING)
--no-install-crds
Do not install CRDs from "crds/" directories of installed charts (default $WERF_NO_INSTALL_CRDS)
--no-notes
Don't show release notes at the end of the release (default $WERF_NO_NOTES)
--no-pod-logs
Disable Pod logs collection and printing (default $WERF_NO_POD_LOGS or false)
--no-remove-manual-changes
Don't remove fields added manually to the resource in the cluster if fields aren't present in the manifest (default $WERF_NO_REMOVE_MANUAL_CHANGES)
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--plan-lifetime
How long plan artifact is valid
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--provenance-keyring
Path to keyring containing public keys to verify chart provenance (default $WERF_PROVENANCE_KEYRING)
--provenance-strategy
Strategy for provenance verifying (default $WERF_PROVENANCE_STRATEGY).
--quiet
Disable explanatory output (default $WERF_QUIET).
--release
Use specified Helm release name (default [[ project ]]-[[ env ]] template or deploy.helmRelease custom template from werf.yaml or $WERF_RELEASE)
--release-info-annotations
Add annotations to release metadata (default $WERF_RELEASE_INFO_ANNOTATIONS)
--release-label
Add Helm release labels (can specify multiple). Kind of labels depends or release storage driver. Format: labelName=labelValue. Also, can be specified with $WERF_RELEASE_LABEL_* (e.g. $WERF_RELEASE_LABEL_1=labelName1=labelValue1, $WERF_RELEASE_LABEL_2=labelName2=labelValue2)
--release-storage
How releases should be stored (default $WERF_RELEASE_STORAGE)
--release-storage-sql-connection
SQL Connection String for Helm SQL Storage (default $WERF_RELEASE_STORAGE_SQL_CONNECTION)
--releases-history-max
Max releases to keep in release storage ($WERF_RELEASES_HISTORY_MAX or 5 by default)
--render-subchart-notes
If set, render subchart notes along with the parent (by default $WERF_RENDER_SUBCHART_NOTES or false)
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--rollback-graph-path
Save rollback graph path to the specified file (by default $WERF_ROLLBACK_GRAPH_PATH). Extension must be .dot or not specified. If extension not specified, then .dot is used
--runtime-annotations
Add annotations which will not trigger resource updates to all resources (default $WERF_RUNTIME_ANNOTATIONS)
--runtime-labels
Add labels which will not trigger resource updates to all resources (default $WERF_RUNTIME_LABELS)
--save-build-report
Save build report (by default $WERF_SAVE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--save-deploy-report
Save deploy report (by default $WERF_SAVE_DEPLOY_REPORT or false). Its path and format configured with --deploy-report-path
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
Set helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_* (e.g. $WERF_SET_1=key1=val1, $WERF_SET_2=key2=val2)
--set-docker-config-json-value
Shortcut to set current docker config into the .Values.global.werf.dockerconfigjson
--set-file
Set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2). Also, can be defined with $WERF_SET_FILE_* (e.g. $WERF_SET_FILE_1=key1=path1, $WERF_SET_FILE_2=key2=val2)
--set-json
Set new values, where the key is the value path and the value is JSON (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_JSON_* (e.g. $WERF_SET_JSON_1=key1=val1, $WERF_SET_JSON_2=key2=val2)
--set-literal
Set new values, where the key is the value path and the value is the value. The value will always become a literal string (can specify multiple or separate values with commas: key1=val1,key2=val2).) Also, can be defined with $WERF_SET_LITERAL_* (e.g. $WERF_SET_LITERAL_1=key1=val1, $WERF_SET_LITERAL_2=key2=val2)
--set-root-json
Set new keys in arbitrary things in the global root context ("$"), where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you REALLY know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_ROOT_JSON_* (e.g. $WERF_SET_ROOT_JSON_1=key1=val1, $WERF_SET_ROOT_JSON_2=key2=val2)
--set-runtime-json
Set new keys in $.Runtime, where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_RUNTIME_JSON_* (e.g. $WERF_SET_RUNTIME_JSON_1=key1=val1, $WERF_SET_RUNTIME_JSON_2=key2=val2)
--set-string
Set STRING helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_STRING_* (e.g. $WERF_SET_STRING_1=key1=val1, $WERF_SET_STRING_2=key2=val2)
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-dependencies-repo-refresh, -L
Do not refresh helm chart repositories locally cached index
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-helm-dependencies
Skip TLS certificate validation when accessing a Helm charts repository (default $WERF_SKIP_TLS_VERIFY_HELM_DEPENDENCIES)
--skip-tls-verify-kube
Skip TLS certificate validation when accessing a Kubernetes cluster (default $WERF_SKIP_TLS_VERIFY_KUBE)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--templates-allow-dns
Allow performing DNS requests in templating (default $WERF_TEMPLATES_ALLOW_DNS)
--timeout, -t
Resources tracking timeout in seconds ($WERF_TIMEOUT by default)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--use-custom-tag
Use a tag alias in helm templates instead of an image content-based tag (NOT RECOMMENDED). The alias may contain the following shortcuts: - %image%, %image_slug% or %image_safe_slug% to use the image name (necessary if there is more than one image in the werf config); - %image_content_based_tag% to use a content-based tag. For cleaning custom tags and associated content-based tag are treated as one. Also, can be defined with $WERF_USE_CUSTOM_TAG (e.g. $WERF_USE_CUSTOM_TAG="%image%-tag")
--use-plan
Use the gzip-compressed JSON plan file from the specified path during release install
--values
Specify helm values in a YAML file or a URL (can specify multiple). Also, can be defined with $WERF_VALUES_* (e.g. $WERF_VALUES_1=.helm/values_1.yaml, $WERF_VALUES_2=.helm/values_2.yaml)
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)
--without-images
Disable building of images defined in the werf.yaml (if any) and usage of such images in the .helm/templates ($WERF_WITHOUT_IMAGES or false by default — e.g. enable all images defined in the werf.yaml by default)

d8 delivery-kit cr

Usage:

d8 delivery-kit cr [options]

Authenticate with container registry.

d8 delivery-kit cr login

Usage:

d8 delivery-kit cr login registry [options]

Options

--debug
Enable debug (default $WERF_DEBUG).
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--password, -p
Use specified password for login (default $WERF_PASSWORD)
--password-stdin
Read password from stdin for login (default $WERF_PASSWORD_STDIN)
--quiet
Disable explanatory output (default $WERF_QUIET).
--username, -u
Use specified username for login (default $WERF_USERNAME)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit cr logout

Usage:

d8 delivery-kit cr logout registry [options]

Logout from a remote registry.

Logout from a remote registry.

Options

--debug
Enable debug (default $WERF_DEBUG).
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--quiet
Disable explanatory output (default $WERF_QUIET).
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit dismiss

Usage:

d8 delivery-kit dismiss [options]

Delete werf release from Kubernetes

Delete application from Kubernetes.

Helm Release will be purged and optionally Kubernetes Namespace.

Environment is a required param for the dismiss by default, because it is needed to construct Helm  
Release name and Kubernetes Namespace. Either --env or $WERF_ENV should be specified for command.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--deploy-report-path
Change deploy report path and format (by default $WERF_DEPLOY_REPORT_PATH or ".werf-deploy-report.json" if not set). Extension must be .json for JSON format. If extension not specified, then .json is used
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority)
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--env
Use specified environment (default $WERF_ENV)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--hooks-status-progress-period
No-op
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-api-server
Kubernetes API server address (default $WERF_KUBE_API_SERVER)
--kube-auth-password
Basic auth password for Kubernetes API (default $WERF_KUBE_AUTH_PASSWORD)
--kube-auth-provider
Auth provider name for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER)
--kube-auth-provider-config
Auth provider config for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER_CONFIG)
--kube-auth-username
Basic auth username for Kubernetes API (default $WERF_KUBE_AUTH_USERNAME)
--kube-burst-limit
Kubernetes client burst limit (default $WERF_KUBE_BURST_LIMIT or 100)
--kube-ca-data
Pass Kubernetes API server TLS CA data (default $WERF_KUBE_CA_DATA)
--kube-ca-path
Kubernetes API server CA path (default $WERF_KUBE_CA_PATH)
--kube-cert
Path to PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT
--kube-cert-data
Pass PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT_DATA)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--kube-context-cluster
Use cluster from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_CLUSTER)
--kube-context-user
Use user from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_USER)
--kube-impersonate-group
Sets Impersonate-Group headers when authenticating in Kubernetes. Can be also set with $WERF_KUBE_IMPERSONATE_GROUP_* environment variables
--kube-impersonate-uid
Sets Impersonate-Uid header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_UID)
--kube-impersonate-user
Sets Impersonate-User header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_USER)
--kube-key
Path to PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY)
--kube-key-data
Pass PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY_DATA)
--kube-proxy-url
Proxy URL to use for proxying all requests to Kubernetes API (default $WERF_KUBE_PROXY_URL)
--kube-qps-limit
Kubernetes client QPS limit (default $WERF_KUBE_QPS_LIMIT or 30)
--kube-request-timeout
Timeout for all requests to Kubernetes API (default $WERF_KUBE_REQUEST_TIMEOUT)
--kube-tls-server
Server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used (default $WERF_KUBE_TLS_SERVER)
--kube-token
Kubernetes bearer token used for authentication (default $WERF_KUBE_TOKEN)
--kube-token-path
Path to file with bearer token for authentication in Kubernetes (default $WERF_KUBE_TOKEN_PATH)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--namespace
Use specified Kubernetes namespace (default [[ project ]]-[[ env ]] template or deploy.namespace custom template from werf.yaml or $WERF_NAMESPACE)
--network-parallelism
Parallelize some network operations (default $WERF_NETWORK_PARALLELISM or 30)
--no-final-tracking
By default disable tracking operations that have no create/update/delete resource operations after them, which are most tracking operations, to speed up the release (default $WERF_NO_FINAL_TRACKING)
--no-pod-logs
Disable Pod logs collection and printing (default $WERF_NO_POD_LOGS or false)
--no-remove-manual-changes
Don't remove fields added manually to the resource in the cluster if fields aren't present in the manifest (default $WERF_NO_REMOVE_MANUAL_CHANGES)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--release
Use specified Helm release name (default [[ project ]]-[[ env ]] template or deploy.helmRelease custom template from werf.yaml or $WERF_RELEASE)
--release-storage
How releases should be stored (default $WERF_RELEASE_STORAGE)
--release-storage-sql-connection
SQL Connection String for Helm SQL Storage (default $WERF_RELEASE_STORAGE_SQL_CONNECTION)
--releases-history-max
Max releases to keep in release storage ($WERF_RELEASES_HISTORY_MAX or 5 by default)
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--skip-tls-verify-kube
Skip TLS certificate validation when accessing a Kubernetes cluster (default $WERF_SKIP_TLS_VERIFY_KUBE)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--timeout, -t
Resources tracking timeout in seconds ($WERF_TIMEOUT by default)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-deploy-report
Use deploy report, previously saved with --save-deploy-report (by default $WERF_USE_DEPLOY_REPORT or false). Its path and format configured with --deploy-report-path
--verbose
Enable verbose output (default $WERF_VERBOSE).
--with-hooks
Delete Helm Release hooks getting from existing revisions (default $WERF_WITH_HOOKS or true)
--with-namespace
Delete Kubernetes Namespace after purging Helm Release (default $WERF_WITH_NAMESPACE)

d8 delivery-kit export

Usage:

d8 delivery-kit export [IMAGE_NAME...] [options]

Export images

Export images to an arbitrary repository according to a template specified by the --tag option      
(build if needed).
The tag may contain the following shortcuts:
- %image%, %image_slug% or %image_safe_slug% to use the image name (necessary if there is more than 
one image in the werf config);
- %image_content_based_tag% to use a content-based tag.
All meta-information related to werf is removed from the exported images, and then images are       
completely under the user's responsibility.

Options

--add-label
Add label to exported images (can specify multiple). Format: labelName=labelValue[labelName=labelValue ...]. The default separator is a newline ("\n"), but it can be customized using the --add-label-separator flag. Also, can be specified with $WERF_EXPORT_ADD_LABEL_* (e.g. $WERF_EXPORT_ADD_LABEL_1=labelName1=labelValue1, $WERF_EXPORT_ADD_LABEL_2=labelName2=labelValue2)
--add-label-separator
Separator for --add-label values (default $WERF_EXPORT_ADD_LABEL_SEPARATOR or "\n")
--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read and pull images from the specified repo
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or true by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--introspect-before-error
Introspect failed stage in the clean state, before running all assembly instructions of the stage
--introspect-error
Introspect failed stage in the state, right after running failed assembly instruction
--introspect-stage
Introspect a specific stage. The option can be used multiple times to introspect several stages. There are the following formats to use: * specify IMAGE_NAME/STAGE_NAME to introspect stage STAGE_NAME of either image or artifact IMAGE_NAME * specify STAGE_NAME or */STAGE_NAME for the introspection of all existing stages with name STAGE_NAME IMAGE_NAME is the name of an image or artifact described in werf.yaml, the nameless image specified with ~. STAGE_NAME should be one of the following: from, beforeInstall, dependenciesBeforeInstall, gitArchive, install, dependenciesAfterInstall, beforeSetup, dependenciesBeforeSetup, setup, dependenciesAfterSetup, gitCache, gitLatestPatch, dockerInstructions, dockerfile, imageSpec
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tag
Set a tag template (can specify multiple). It is necessary to use image name shortcut %image% or %image_slug% if multiple images are exported (e.g. REPO:TAG-%image% or REPO-%image%:TAG)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)

d8 delivery-kit helm

Usage:

d8 delivery-kit helm [options]

Manage application deployment with helm

Options

--debug
Enable debug (default $WERF_DEBUG).
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--hooks-status-progress-period
No-op
--insecure-helm-dependencies
Allow insecure oci registries to be used in the Chart.yaml dependencies configuration (default $WERF_INSECURE_HELM_DEPENDENCIES)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--releases-history-max
Max releases to keep in release storage ($WERF_RELEASES_HISTORY_MAX or 5 by default)
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm create

Usage:

d8 delivery-kit helm create NAME [options]

create a new chart with the given name

This command creates a chart directory along with the common files and
directories used in a chart.

For example, 'helm create foo' will create a directory structure that looks
something like this:

    foo/
    ├── .helmignore   # Contains patterns to ignore when packaging Helm charts.
    ├── Chart.yaml    # Information about your chart
    ├── values.yaml   # The default values for your templates
    ├── charts/       # Charts that this chart depends on
    └── templates/    # The template files
        └── tests/    # The test files

'helm create' takes a path for an argument. If directories in the given path
do not exist, Helm will attempt to create them as it goes. If the given
destination exists and there are files in that directory, conflicting files
will be overwritten, but other files will be left alone.

Options

--starter, -p
the name or absolute path to Helm starter scaffold

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm dependency

Aliases: dep, dependencies

Usage:

d8 delivery-kit helm dependency update|build|list [options]

manage a chart's dependencies

Manage the dependencies of a chart.

Helm charts store their dependencies in 'charts/'. For chart developers, it is
often easier to manage dependencies in 'Chart.yaml' which declares all
dependencies.

The dependency commands operate on that file, making it easy to synchronize
between the desired dependencies and the actual dependencies stored in the
'charts/' directory.

For example, this Chart.yaml declares two dependencies:

    # Chart.yaml
    dependencies:
    - name: nginx
      version: "1.2.3"
      repository: "https://example.com/charts"
    - name: memcached
      version: "3.2.1"
      repository: "https://another.example.com/charts"


The 'name' should be the name of a chart, where that name must match the name
in that chart's 'Chart.yaml' file.

The 'version' field should contain a semantic version or version range.

The 'repository' URL should point to a Chart Repository. Helm expects that by
appending '/index.yaml' to the URL, it should be able to retrieve the chart
repository's index. Note: 'repository' can be an alias. The alias must start
with 'alias:' or '@'.

Starting from 2.2.0, repository can be defined as the path to the directory of
the dependency charts stored locally. The path should start with a prefix of
"file://". For example,

    # Chart.yaml
    dependencies:
    - name: nginx
      version: "1.2.3"
      repository: "file://../dependency_chart/nginx"

If the dependency chart is retrieved locally, it is not required to have the
repository added to helm by "helm add repo". Version matching is also supported
for this case.

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm dependency build

Usage:

d8 delivery-kit helm dependency update|build|list build CHART [options]

rebuild the charts/ directory based on the Chart.lock file

Build out the charts/ directory from the Chart.lock file.

Build is used to reconstruct a chart's dependencies to the state specified in
the lock file. This will not re-negotiate dependencies, as 'helm dependency update'
does.

If no lock file is found, 'helm dependency build' will mirror the behavior
of 'helm dependency update'.

Options

--keyring
keyring containing public keys
--skip-refresh
do not refresh the local repository cache
--verify
verify the packages against signatures

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm dependency list

Alias: ls

Usage:

d8 delivery-kit helm dependency update|build|list list CHART [options]

list the dependencies for the given chart

List all of the dependencies declared in a chart.

This can take chart archives and chart directories as input. It will not alter
the contents of a chart.

This will produce an error if the chart cannot be loaded.

Options

--max-col-width
maximum column width for output table

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm dependency update

Alias: up

Usage:

d8 delivery-kit helm dependency update|build|list update CHART [options]

update charts/ based on the contents of Chart.yaml

Update the on-disk dependencies to mirror Chart.yaml.

This command verifies that the required charts, as expressed in 'Chart.yaml',
are present in 'charts/' and are at an acceptable version. It will pull down
the latest charts that satisfy the dependencies, and clean up old dependencies.

On successful update, this will generate a lock file that can be used to
rebuild the dependencies to an exact version.

Dependencies are not required to be represented in 'Chart.yaml'. For that
reason, an update command will not remove charts unless they are (a) present
in the Chart.yaml file, but (b) at the wrong version.

Options

--keyring
keyring containing public keys
--skip-refresh
do not refresh the local repository cache
--verify
verify the packages against signatures

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm env

Usage:

d8 delivery-kit helm env [options]

helm client environment information

Env prints out all the environment information in use by Helm.

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm get

Usage:

d8 delivery-kit helm get [options]

download extended information of a named release

This command consists of multiple subcommands which can be used to
get extended information about the release, including:

- The values used to generate the release
- The generated manifest file
- The notes provided by the chart of the release
- The hooks associated with the release
- The metadata of the release

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm get all

Usage:

d8 delivery-kit helm get all RELEASE_NAME [options]

download all information for a named release

This command prints a human readable collection of information about the
notes, hooks, supplied values, and generated manifest file of the given release.

Options

--revision
get the named release with revision
--template
go template for formatting the output, eg: {{.Release.Name}}

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm get hooks

Usage:

d8 delivery-kit helm get hooks RELEASE_NAME [options]

download all hooks for a named release

This command downloads hooks for a given release.

Hooks are formatted in YAML and separated by the YAML '---\n' separator.

Options

--revision
get the named release with revision

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm get manifest

Usage:

d8 delivery-kit helm get manifest RELEASE_NAME [options]

download the manifest for a named release

This command fetches the generated manifest for a given release.

A manifest is a YAML-encoded representation of the Kubernetes resources that
were generated from this release's chart(s). If a chart is dependent on other
charts, those resources will also be included in the manifest.

Options

--revision
get the named release with revision

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm get metadata

Usage:

d8 delivery-kit helm get metadata RELEASE_NAME [options]

This command fetches metadata for a given release

Options

--output, -o
prints the output in the specified format. Allowed values: table, json, yaml
--revision
specify release revision

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm get notes

Usage:

d8 delivery-kit helm get notes RELEASE_NAME [options]

download the notes for a named release

This command shows notes provided by the chart of a named release.

Options

--revision
get the named release with revision

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm get values

Usage:

d8 delivery-kit helm get values RELEASE_NAME [options]

download the values file for a named release

This command downloads a values file for a given release.

Options

--all, -a
dump all (computed) values
--output, -o
prints the output in the specified format. Allowed values: table, json, yaml
--revision
get the named release with revision

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm get-autogenerated-values

Usage:

d8 delivery-kit helm get-autogenerated-values [IMAGE_NAME...] [options]

Get service values yaml generated by werf for helm chart during deploy

Get service values generated by werf for Helm chart during deploy.

These values includes project name, Docker images IDs and other.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--build-report-operations
Collect low-level operations statistics: add Operations and StageCache sections to the build report and print operations summary after the build (by default $WERF_BUILD_REPORT_OPERATIONS or false). Also enabled by --log-debug
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo and to pull base images
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or true by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--introspect-before-error
Introspect failed stage in the clean state, before running all assembly instructions of the stage
--introspect-error
Introspect failed stage in the state, right after running failed assembly instruction
--introspect-stage
Introspect a specific stage. The option can be used multiple times to introspect several stages. There are the following formats to use: * specify IMAGE_NAME/STAGE_NAME to introspect stage STAGE_NAME of either image or artifact IMAGE_NAME * specify STAGE_NAME or */STAGE_NAME for the introspection of all existing stages with name STAGE_NAME IMAGE_NAME is the name of an image or artifact described in werf.yaml, the nameless image specified with ~. STAGE_NAME should be one of the following: from, beforeInstall, dependenciesBeforeInstall, gitArchive, install, dependenciesAfterInstall, beforeSetup, dependenciesBeforeSetup, setup, dependenciesAfterSetup, gitCache, gitLatestPatch, dockerInstructions, dockerfile, imageSpec
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--namespace
Use specified Kubernetes namespace (default [[ project ]]-[[ env ]] template or deploy.namespace custom template from werf.yaml or $WERF_NAMESPACE)
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--save-build-report
Save build report (by default $WERF_SAVE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--set-docker-config-json-value
Shortcut to set current docker config into the .Values.global.werf.dockerconfigjson
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--stub-tags
Use stubs instead of real tags (default $WERF_STUB_TAGS)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--use-custom-tag
Use a tag alias in helm templates instead of an image content-based tag (NOT RECOMMENDED). The alias may contain the following shortcuts: - %image%, %image_slug% or %image_safe_slug% to use the image name (necessary if there is more than one image in the werf config); - %image_content_based_tag% to use a content-based tag. For cleaning custom tags and associated content-based tag are treated as one. Also, can be defined with $WERF_USE_CUSTOM_TAG (e.g. $WERF_USE_CUSTOM_TAG="%image%-tag")
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)
--without-images
Disable building of images defined in the werf.yaml (if any) and usage of such images in the .helm/templates ($WERF_WITHOUT_IMAGES or false by default — e.g. enable all images defined in the werf.yaml by default)

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm get-namespace

Usage:

d8 delivery-kit helm get-namespace [options]

Print Kubernetes Namespace that will be used in current configuration with specified params.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority)
--env
Use specified environment (default $WERF_ENV)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm get-release

Usage:

d8 delivery-kit helm get-release [options]

Print Helm Release name that will be used in current configuration with specified params.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority)
--env
Use specified environment (default $WERF_ENV)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--namespace
Use specified Kubernetes namespace (default [[ project ]]-[[ env ]] template or deploy.namespace custom template from werf.yaml or $WERF_NAMESPACE)
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm history

Alias: hist

Usage:

d8 delivery-kit helm history RELEASE_NAME [options]

fetch release history

History prints historical revisions for a given release.

A default maximum of 256 revisions will be returned. Setting '--max'
configures the maximum length of the revision list returned.

The historical release set is printed as a formatted table, e.g:

    $ helm history angry-bird
    REVISION    UPDATED                     STATUS          CHART             APP VERSION     DESCRIPTION
    1           Mon Oct 3 10:15:13 2016     superseded      alpine-0.1.0      1.0             Initial install
    2           Mon Oct 3 10:15:13 2016     superseded      alpine-0.1.0      1.0             Upgraded successfully
    3           Mon Oct 3 10:15:13 2016     superseded      alpine-0.1.0      1.0             Rolled back to 2
    4           Mon Oct 3 10:15:13 2016     deployed        alpine-0.1.0      1.0             Upgraded successfully

Options

--max
maximum number of revision to include in history
--output, -o
prints the output in the specified format. Allowed values: table, json, yaml

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm install

Usage:

d8 delivery-kit helm install [NAME] [CHART] [options]

install a chart

This command installs a chart archive.

The install argument must be a chart reference, a path to a packaged chart,
a path to an unpacked chart directory or a URL.

To override values in a chart, use either the '--values' flag and pass in a file
or use the '--set' flag and pass configuration from the command line, to force
a string value use '--set-string'. You can use '--set-file' to set individual
values from a file when the value itself is too long for the command line
or is dynamically generated. You can also use '--set-json' to set json values
(scalars/objects/arrays) from the command line.

    $ helm install -f myvalues.yaml myredis ./redis

or

    $ helm install --set name=prod myredis ./redis

or

    $ helm install --set-string long_int=1234567890 myredis ./redis

or

    $ helm install --set-file my_script=dothings.sh myredis ./redis

or

    $ helm install --set-json 'master.sidecars=[{"name":"sidecar","image":"myImage","imagePullPolicy":"Always","ports":[{"name":"portname","containerPort":1234}]}]' myredis ./redis


You can specify the '--values'/'-f' flag multiple times. The priority will be given to the
last (right-most) file specified. For example, if both myvalues.yaml and override.yaml
contained a key called 'Test', the value set in override.yaml would take precedence:

    $ helm install -f myvalues.yaml -f override.yaml  myredis ./redis

You can specify the '--set' flag multiple times. The priority will be given to the
last (right-most) set specified. For example, if both 'bar' and 'newbar' values are
set for a key called 'foo', the 'newbar' value would take precedence:

    $ helm install --set foo=bar --set foo=newbar  myredis ./redis

Similarly, in the following example 'foo' is set to '["four"]': 

    $ helm install --set-json='foo=["one", "two", "three"]' --set-json='foo=["four"]' myredis ./redis

And in the following example, 'foo' is set to '{"key1":"value1","key2":"bar"}':

    $ helm install --set-json='foo={"key1":"value1","key2":"value2"}' --set-json='foo.key2="bar"' myredis ./redis

To check the generated manifests of a release without installing the chart,
the --debug and --dry-run flags can be combined.

The --dry-run flag will output all generated chart manifests, including Secrets
which can contain sensitive values. Please carefully consider how and when this
flag is used.

If --verify is set, the chart MUST have a provenance file, and the provenance
file MUST pass all verification steps.

There are six different ways you can express the chart you want to install:

1. By chart reference: helm install mymaria example/mariadb
2. By path to a packaged chart: helm install mynginx ./nginx-1.2.3.tgz
3. By path to an unpacked chart directory: helm install mynginx ./nginx
4. By absolute URL: helm install mynginx https://example.com/charts/nginx-1.2.3.tgz
5. By chart reference and repo url: helm install --repo https://example.com/charts/ mynginx nginx
6. By OCI registries: helm install mynginx --version 1.2.3 oci://example.com/charts/nginx

CHART REFERENCES

A chart reference is a convenient way of referencing a chart in a chart repository.

When you use a chart reference with a repo prefix ('example/mariadb'), Helm will look in the local
configuration for a chart repository named 'example', and will then look for a
chart in that repository whose name is 'mariadb'. It will install the latest stable version of that chart
until you specify '--devel' flag to also include development version (alpha, beta, and release candidate releases), or
supply a version number with the '--version' flag.

To see the list of chart repositories, use 'helm repo list'. To search for
charts in a repository, use 'helm search'.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--atomic
if set, the installation process deletes the installation on failure. The --wait flag will be set automatically if --atomic is used
--ca-file
verify certificates of HTTPS-enabled servers using this CA bundle
--cert-file
identify HTTPS client using this SSL certificate file
--cleanup-on-fail
allow deletion of new resources created in this installation when install fails
--create-namespace
create the release namespace if not present
--dependency-update
update dependencies if they are missing before installing the chart
--deploy-report-path
save deploy report in JSON to the specified path
--description
add a custom description
--devel
use development versions, too. Equivalent to version '>0.0.0-0'. If --version is set, this is ignored
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--disable-openapi-validation
if set, the installation process will not validate rendered templates against the Kubernetes OpenAPI Schema
--dry-run
simulate an install. If --dry-run is set with no option being specified or as '--dry-run=client', it will not attempt cluster connections. Setting '--dry-run=server' allows attempting cluster connections.
--enable-dns
enable DNS lookups when rendering templates
--force
force resource updates through a replacement strategy
--generate-name, -g
generate the name (and omit the NAME parameter)
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--insecure-skip-tls-verify
skip tls certificate checks for the chart download
--key-file
identify HTTPS client using this SSL key file
--keyring
location of public keys used for verification
--labels, -l
Labels that would be added to release metadata. Should be divided by comma.
--name-template
specify template used to name the release
--no-hooks
prevent hooks from running during install
--output, -o
prints the output in the specified format. Allowed values: table, json, yaml
--pass-credentials
pass credentials to all domains
--password
chart repository password where to locate the requested chart
--plain-http
use insecure HTTP connections for the chart download
--post-renderer
the path to an executable to be used for post rendering. If it exists in $PATH, the binary will be used, otherwise it will try to look for the executable at the given path
--post-renderer-args
an argument to the post-renderer (can specify multiple)
--render-subchart-notes
if set, render subchart notes along with the parent
--replace
re-use the given name, only if that name is a deleted release which remains in the history. This is unsafe in production
--repo
chart repository url where to locate the requested chart
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
set values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--set-file
set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2)
--set-json
set JSON values on the command line (can specify multiple or separate values with commas: key1=jsonval1,key2=jsonval2)
--set-literal
set a literal STRING value on the command line
--set-string
set STRING values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--skip-crds
if set, no CRDs will be installed. By default, CRDs are installed if not already present
--timeout
time to wait for any individual Kubernetes operation (like Jobs for hooks)
--username
chart repository username where to locate the requested chart
--values, -f
specify values in a YAML file or a URL (can specify multiple)
--verify
verify the package before using it
--version
specify a version constraint for the chart version to use. This constraint can be a specific tag (e.g. 1.1.1) or it may reference a valid range (e.g. ^2.0.0). If this is not specified, the latest version is used
--wait
if set, will wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet are in a ready state before marking the release as successful. It will wait for as long as --timeout
--wait-for-jobs
if set and --wait enabled, will wait until all Jobs have been completed before marking the release as successful. It will wait for as long as --timeout

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm lint

Usage:

d8 delivery-kit helm lint PATH [options]

examine a chart for possible issues

This command takes a path to a chart and runs a series of tests to verify that
the chart is well-formed.

If the linter encounters things that will cause the chart to fail installation,
it will emit [ERROR] messages. If it encounters issues that break with convention
or recommendation, it will emit [WARNING] messages.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--env
Use specified environment (default $WERF_ENV)
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--kube-version
Kubernetes version used for capabilities and deprecation checks
--quiet
print only warnings and errors
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
set values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--set-file
set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2)
--set-json
set JSON values on the command line (can specify multiple or separate values with commas: key1=jsonval1,key2=jsonval2)
--set-literal
set a literal STRING value on the command line
--set-string
set STRING values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--strict
fail on lint warnings
--values, -f
specify values in a YAML file or a URL (can specify multiple)
--with-subcharts
lint dependent charts

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm list

Alias: ls

Usage:

d8 delivery-kit helm list [options]

list releases

This command lists all of the releases for a specified namespace (uses current namespace context if namespace not specified).

By default, it lists only releases that are deployed or failed. Flags like
'--uninstalled' and '--all' will alter this behavior. Such flags can be combined:
'--uninstalled --failed'.

By default, items are sorted alphabetically. Use the '-d' flag to sort by
release date.

If the --filter flag is provided, it will be treated as a filter. Filters are
regular expressions (Perl compatible) that are applied to the list of releases.
Only items that match the filter will be returned.

    $ helm list --filter 'ara[a-z]+'
    NAME                UPDATED                                  CHART
    maudlin-arachnid    2020-06-18 14:17:46.125134977 +0000 UTC  alpine-0.1.0

If no results are found, 'helm list' will exit 0, but with no output (or in
the case of no '-q' flag, only headers).

By default, up to 256 items may be returned. To limit this, use the '--max' flag.
Setting '--max' to 0 will not return all results. Rather, it will return the
server's default, which may be much higher than 256. Pairing the '--max'
flag with the '--offset' flag allows you to page through results.

Options

--all, -a
show all releases without any filter applied
--all-namespaces, -A
list releases across all namespaces
--date, -d
sort by release date
--deployed
show deployed releases. If no other is specified, this will be automatically enabled
--failed
show failed releases
--filter, -f
a regular expression (Perl compatible). Any releases that match the expression will be included in the results
--max, -m
maximum number of releases to fetch
--no-headers
don't print headers when using the default output format
--offset
next release index in the list, used to offset from start value
--output, -o
prints the output in the specified format. Allowed values: table, json, yaml
--pending
show pending releases
--reverse, -r
reverse the sort order
--selector, -l
Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2). Works only for secret(default) and configmap storage backends.
--short, -q
output short (quiet) listing format
--superseded
show superseded releases
--time-format
format time using golang time formatter. Example: --time-format "2006-01-02 15:04:05Z0700"
--uninstalled
show uninstalled releases (if 'helm uninstall --keep-history' was used)
--uninstalling
show releases that are currently being uninstalled

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm package

Usage:

d8 delivery-kit helm package [CHART_PATH] [...] [options]

package a chart directory into a chart archive

This command packages a chart into a versioned chart archive file. If a path
is given, this will look at that path for a chart (which must contain a
Chart.yaml file) and then package that directory.

Versioned chart archives are used by Helm package repositories.

To sign a chart, use the '--sign' flag. In most cases, you should also
provide '--keyring path/to/secret/keys' and '--key keyname'.

  $ helm package --sign ./mychart --key mykey --keyring ~/.gnupg/secring.gpg

If '--keyring' is not specified, Helm usually defaults to the public keyring
unless your environment is otherwise configured.

Options

--app-version
set the appVersion on the chart to this version
--dependency-update, -u
update dependencies from "Chart.yaml" to dir "charts/" before packaging
--destination, -d
location to write the chart.
--key
name of the key to use when signing. Used if --sign is true
--keyring
location of a public keyring
--passphrase-file
location of a file which contains the passphrase for the signing key. Use "-" in order to read from stdin.
--sign
use a PGP private key to sign this package
--version
set the version on the chart to this semver version

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm plugin

Usage:

d8 delivery-kit helm plugin [options]

install, list, or uninstall Helm plugins

Manage client-side Helm plugins.

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm plugin install

Alias: add

Usage:

d8 delivery-kit helm plugin install [options] <path|url>...

install one or more Helm plugins

This command allows you to install a plugin from a url to a VCS repo or a local path.

Options

--version
specify a version constraint. If this is not specified, the latest version is installed

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm plugin list

Alias: ls

Usage:

d8 delivery-kit helm plugin list [options]

list installed Helm plugins

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm plugin uninstall

Aliases: rm, remove

Usage:

d8 delivery-kit helm plugin uninstall <plugin>... [options]

uninstall one or more Helm plugins

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm plugin update

Alias: up

Usage:

d8 delivery-kit helm plugin update <plugin>... [options]

update one or more Helm plugins

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm pull

Alias: fetch

Usage:

d8 delivery-kit helm pull [chart URL | repo/chartname] [...] [options]

download a chart from a repository and (optionally) unpack it in local directory

Retrieve a package from a package repository, and download it locally.

This is useful for fetching packages to inspect, modify, or repackage. It can
also be used to perform cryptographic verification of a chart without installing
the chart.

There are options for unpacking the chart after download. This will create a
directory for the chart and uncompress into that directory.

If the --verify flag is specified, the requested chart MUST have a provenance
file, and MUST pass the verification process. Failure in any part of this will
result in an error, and the chart will not be saved locally.

Options

--ca-file
verify certificates of HTTPS-enabled servers using this CA bundle
--cert-file
identify HTTPS client using this SSL certificate file
--destination, -d
location to write the chart. If this and untardir are specified, untardir is appended to this
--devel
use development versions, too. Equivalent to version '>0.0.0-0'. If --version is set, this is ignored.
--insecure-skip-tls-verify
skip tls certificate checks for the chart download
--key-file
identify HTTPS client using this SSL key file
--keyring
location of public keys used for verification
--pass-credentials
pass credentials to all domains
--password
chart repository password where to locate the requested chart
--plain-http
use insecure HTTP connections for the chart download
--prov
fetch the provenance file, but don't perform verification
--repo
chart repository url where to locate the requested chart
--untar
if set to true, will untar the chart after downloading it
--untardir
if untar is specified, this flag specifies the name of the directory into which the chart is expanded
--username
chart repository username where to locate the requested chart
--verify
verify the package before using it
--version
specify a version constraint for the chart version to use. This constraint can be a specific tag (e.g. 1.1.1) or it may reference a valid range (e.g. ^2.0.0). If this is not specified, the latest version is used

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm registry

Usage:

d8 delivery-kit helm registry [options]

This command consists of multiple subcommands to interact with registries.

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm registry login

Usage:

d8 delivery-kit helm registry login [host] [options]

Options

--ca-file
verify certificates of HTTPS-enabled servers using this CA bundle
--cert-file
identify registry client using this SSL certificate file
--insecure
allow connections to TLS registry without certs
--key-file
identify registry client using this SSL key file
--password, -p
registry password or identity token
--password-stdin
read password or identity token from stdin
--username, -u
registry username

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm registry logout

Usage:

d8 delivery-kit helm registry logout [host] [options]

logout from a registry

Remove credentials stored for a remote registry.

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm repo

Usage:

d8 delivery-kit helm repo add|remove|list|index|update [ARGS] [options]

add, list, remove, update, and index chart repositories

This command consists of multiple subcommands to interact with chart repositories.

It can be used to add, remove, list, and index chart repositories.

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm repo add

Usage:

d8 delivery-kit helm repo add|remove|list|index|update [ARGS] add [NAME] [URL] [options]

add a chart repository

Options

--allow-deprecated-repos
by default, this command will not allow adding official repos that have been permanently deleted. This disables that behavior
--ca-file
verify certificates of HTTPS-enabled servers using this CA bundle
--cert-file
identify HTTPS client using this SSL certificate file
--force-update
replace (overwrite) the repo if it already exists
--insecure-skip-tls-verify
skip tls certificate checks for the repository
--key-file
identify HTTPS client using this SSL key file
--no-update
Ignored. Formerly, it would disabled forced updates. It is deprecated by force-update.
--pass-credentials
pass credentials to all domains
--password
chart repository password
--password-stdin
read chart repository password from stdin
--username
chart repository username

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm repo index

Usage:

d8 delivery-kit helm repo add|remove|list|index|update [ARGS] index [DIR] [options]

generate an index file given a directory containing packaged charts

Read the current directory and generate an index file based on the charts found.

This tool is used for creating an 'index.yaml' file for a chart repository. To
set an absolute URL to the charts, use '--url' flag.

To merge the generated index with an existing index file, use the '--merge'
flag. In this case, the charts found in the current directory will be merged
into the existing index, with local charts taking priority over existing charts.

Options

--json
output in JSON format
--merge
merge the generated index into the given index
--url
url of chart repository

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm repo list

Alias: ls

Usage:

d8 delivery-kit helm repo add|remove|list|index|update [ARGS] list [options]

list chart repositories

Options

--output, -o
prints the output in the specified format. Allowed values: table, json, yaml

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm repo remove

Alias: rm

Usage:

d8 delivery-kit helm repo add|remove|list|index|update [ARGS] remove [REPO1 [REPO2 ...]] [options]

remove one or more chart repositories

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm repo update

Alias: up

Usage:

d8 delivery-kit helm repo add|remove|list|index|update [ARGS] update [REPO1 [REPO2 ...]] [options]

update information of available charts locally from chart repositories

Update gets the latest information about charts from the respective chart repositories.
Information is cached locally, where it is used by commands like 'helm search'.

You can optionally specify a list of repositories you want to update.
	$ helm repo update <repo_name> ...
To update all the repositories, use 'helm repo update'.

Options

--fail-on-repo-update-fail
update fails if any of the repository updates fail

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm rollback

Usage:

d8 delivery-kit helm rollback <RELEASE> [REVISION] [options]

roll back a release to a previous revision

This command rolls back a release to a previous revision.

The first argument of the rollback command is the name of a release, and the
second is a revision (version) number. If this argument is omitted or set to
0, it will roll back to the previous release.

To see revision numbers, run 'helm history RELEASE'.

Options

--cleanup-on-fail
allow deletion of new resources created in this rollback when rollback fails
--deploy-report-path
save deploy report in JSON to the specified path
--dry-run
simulate a rollback
--force
force resource update through delete/recreate if needed
--history-max
limit the maximum number of revisions saved per release. Use 0 for no limit
--no-hooks
prevent hooks from running during rollback
--recreate-pods
performs pods restart for the resource if applicable
--timeout
time to wait for any individual Kubernetes operation (like Jobs for hooks)
--wait
if set, will wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet are in a ready state before marking the release as successful. It will wait for as long as --timeout
--wait-for-jobs
if set and --wait enabled, will wait until all Jobs have been completed before marking the release as successful. It will wait for as long as --timeout

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm search

Usage:

d8 delivery-kit helm search [keyword] [options]

search for a keyword in charts

Search provides the ability to search for Helm charts in the various places
they can be stored including the Artifact Hub and repositories you have added.
Use search subcommands to search different locations for charts.

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm search hub

Usage:

d8 delivery-kit helm search [keyword] hub [KEYWORD] [options]

search for charts in the Artifact Hub or your own hub instance

Search for Helm charts in the Artifact Hub or your own hub instance.

Artifact Hub is a web-based application that enables finding, installing, and
publishing packages and configurations for CNCF projects, including publicly
available distributed charts Helm charts. It is a Cloud Native Computing
Foundation sandbox project. You can browse the hub at https://artifacthub.io/

The [KEYWORD] argument accepts either a keyword string, or quoted string of rich
query options. For rich query options documentation, see
https://artifacthub.github.io/hub/api/?urls.primaryName=Monocular%20compatible%20search%20API#/Monocular/get_api_chartsvc_v1_charts_search

Previous versions of Helm used an instance of Monocular as the default
'endpoint', so for backwards compatibility Artifact Hub is compatible with the
Monocular search API. Similarly, when setting the 'endpoint' flag, the specified
endpoint must also be implement a Monocular compatible search API endpoint.
Note that when specifying a Monocular instance as the 'endpoint', rich queries
are not supported. For API details, see https://github.com/helm/monocular

Options

--endpoint
Hub instance to query for charts
--fail-on-no-result
search fails if no results are found
--list-repo-url
print charts repository URL
--max-col-width
maximum column width for output table
--output, -o
prints the output in the specified format. Allowed values: table, json, yaml

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm search repo

Usage:

d8 delivery-kit helm search [keyword] repo [keyword] [options]

search repositories for a keyword in charts

Search reads through all of the repositories configured on the system, and
looks for matches. Search of these repositories uses the metadata stored on
the system.

It will display the latest stable versions of the charts found. If you
specify the --devel flag, the output will include pre-release versions.
If you want to search using a version constraint, use --version.

Examples:

    # Search for stable release versions matching the keyword "nginx"
    $ helm search repo nginx

    # Search for release versions matching the keyword "nginx", including pre-release versions
    $ helm search repo nginx --devel

    # Search for the latest stable release for nginx-ingress with a major version of 1
    $ helm search repo nginx-ingress --version ^1.0.0

Repositories are managed with 'helm repo' commands.

Options

--devel
use development versions (alpha, beta, and release candidate releases), too. Equivalent to version '>0.0.0-0'. If --version is set, this is ignored
--fail-on-no-result
search fails if no results are found
--max-col-width
maximum column width for output table
--output, -o
prints the output in the specified format. Allowed values: table, json, yaml
--regexp, -r
use regular expressions for searching repositories you have added
--version
search using semantic versioning constraints on repositories you have added
--versions, -l
show the long listing, with each version of each chart on its own line, for repositories you have added

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm secret

Usage:

d8 delivery-kit helm secret [options]

Work with secrets

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm secret decrypt

Usage:

d8 delivery-kit helm secret decrypt [options]

Decrypt data

Decrypt data from standard input.
Encryption key should be in $WERF_SECRET_KEY or .werf_secret_key file.

Options

--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--output-file-path, -o
Write to file instead of stdout
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm secret encrypt

Usage:

d8 delivery-kit helm secret encrypt [options]

Encrypt data

Encrypt data from standard input.
Encryption key should be in $WERF_SECRET_KEY or .werf_secret_key file.

Options

--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--output-file-path, -o
Write to file instead of stdout
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm secret file

Usage:

d8 delivery-kit helm secret file [options]

Work with secret files

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm secret file decrypt

Usage:

d8 delivery-kit helm secret file decrypt [FILE_PATH] [options]

Decrypt secret file data

Decrypt data from FILE_PATH or pipe.
Encryption key should be in $WERF_SECRET_KEY or .werf_secret_key file.

Options

--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--output-file-path, -o
Write to file instead of stdout
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm secret file edit

Usage:

d8 delivery-kit helm secret file edit FILE_PATH [options]

Edit or create new secret file

Edit or create new secret file.
Encryption key should be in $WERF_SECRET_KEY or .werf_secret_key file.

Options

--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm secret file encrypt

Usage:

d8 delivery-kit helm secret file encrypt [FILE_PATH] [options]

Encrypt file data

Encrypt data from FILE_PATH or pipe.
Encryption key should be in $WERF_SECRET_KEY or .werf_secret_key file.

Options

--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--output-file-path, -o
Write to file instead of stdout
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm secret generate-secret-key

Usage:

d8 delivery-kit helm secret generate-secret-key [options]

Generate hex encryption key

Generate hex encryption key.
For further usage, the encryption key should be saved in $WERF_SECRET_KEY or .werf_secret_key file.

Options

--debug
Enable debug (default $WERF_DEBUG).
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--quiet
Disable explanatory output (default $WERF_QUIET).
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm secret rotate-secret-key

Usage:

d8 delivery-kit helm secret rotate-secret-key [EXTRA_SECRET_VALUES_FILE_PATH...] [options]

Regenerate secret files with new secret key

Regenerate Secret files with new Secret key.

Old key should be specified in the $WERF_OLD_SECRET_KEY.
New key should reside either in the $WERF_SECRET_KEY or .werf_secret_key file.

Command will extract data with the old key, generate new secret data and rewrite files:
* standard raw Secret files in the .helm/secret folder;
* standard secret Values YAML file .helm/secret-values.yaml;
* additional secret Values YAML files specified with EXTRA_SECRET_VALUES_FILE_PATH params

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--env
Use specified environment (default $WERF_ENV)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm secret values

Usage:

d8 delivery-kit helm secret values [options]

Work with secret values files

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm secret values decrypt

Usage:

d8 delivery-kit helm secret values decrypt [FILE_PATH] [options]

Decrypt secret values file data

Decrypt data from FILE_PATH or pipe.
Encryption key should be in $WERF_SECRET_KEY or .werf_secret_key file.

Options

--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--output-file-path, -o
Write to file instead of stdout
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm secret values edit

Usage:

d8 delivery-kit helm secret values edit FILE_PATH [options]

Edit or create new secret values file

Edit or create new secret values file.
Encryption key should be in $WERF_SECRET_KEY or .werf_secret_key file.

Options

--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm secret values encrypt

Usage:

d8 delivery-kit helm secret values encrypt [FILE_PATH] [options]

Encrypt values file data

Encrypt data from FILE_PATH or pipe.
Encryption key should be in $WERF_SECRET_KEY or .werf_secret_key file.

Options

--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--output-file-path, -o
Write to file instead of stdout
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

Global options

--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--namespace, -n
namespace scope for this request
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds

d8 delivery-kit helm show

Alias: inspect

Usage:

d8 delivery-kit helm show [options]

show information of a chart

This command consists of multiple subcommands to display information about a chart

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm show all

Usage:

d8 delivery-kit helm show all [CHART] [options]

show all information of the chart

This command inspects a chart (directory, file, or URL) and displays all its content
(values.yaml, Chart.yaml, README)

Options

--ca-file
verify certificates of HTTPS-enabled servers using this CA bundle
--cert-file
identify HTTPS client using this SSL certificate file
--devel
use development versions, too. Equivalent to version '>0.0.0-0'. If --version is set, this is ignored
--insecure-skip-tls-verify
skip tls certificate checks for the chart download
--key-file
identify HTTPS client using this SSL key file
--keyring
location of public keys used for verification
--pass-credentials
pass credentials to all domains
--password
chart repository password where to locate the requested chart
--plain-http
use insecure HTTP connections for the chart download
--repo
chart repository url where to locate the requested chart
--username
chart repository username where to locate the requested chart
--verify
verify the package before using it
--version
specify a version constraint for the chart version to use. This constraint can be a specific tag (e.g. 1.1.1) or it may reference a valid range (e.g. ^2.0.0). If this is not specified, the latest version is used

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm show chart

Usage:

d8 delivery-kit helm show chart [CHART] [options]

show the chart's definition

This command inspects a chart (directory, file, or URL) and displays the contents
of the Chart.yaml file

Options

--ca-file
verify certificates of HTTPS-enabled servers using this CA bundle
--cert-file
identify HTTPS client using this SSL certificate file
--devel
use development versions, too. Equivalent to version '>0.0.0-0'. If --version is set, this is ignored
--insecure-skip-tls-verify
skip tls certificate checks for the chart download
--key-file
identify HTTPS client using this SSL key file
--keyring
location of public keys used for verification
--pass-credentials
pass credentials to all domains
--password
chart repository password where to locate the requested chart
--plain-http
use insecure HTTP connections for the chart download
--repo
chart repository url where to locate the requested chart
--username
chart repository username where to locate the requested chart
--verify
verify the package before using it
--version
specify a version constraint for the chart version to use. This constraint can be a specific tag (e.g. 1.1.1) or it may reference a valid range (e.g. ^2.0.0). If this is not specified, the latest version is used

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm show crds

Usage:

d8 delivery-kit helm show crds [CHART] [options]

show the chart's CRDs

This command inspects a chart (directory, file, or URL) and displays the contents
of the CustomResourceDefinition files

Options

--ca-file
verify certificates of HTTPS-enabled servers using this CA bundle
--cert-file
identify HTTPS client using this SSL certificate file
--devel
use development versions, too. Equivalent to version '>0.0.0-0'. If --version is set, this is ignored
--insecure-skip-tls-verify
skip tls certificate checks for the chart download
--key-file
identify HTTPS client using this SSL key file
--keyring
location of public keys used for verification
--pass-credentials
pass credentials to all domains
--password
chart repository password where to locate the requested chart
--plain-http
use insecure HTTP connections for the chart download
--repo
chart repository url where to locate the requested chart
--username
chart repository username where to locate the requested chart
--verify
verify the package before using it
--version
specify a version constraint for the chart version to use. This constraint can be a specific tag (e.g. 1.1.1) or it may reference a valid range (e.g. ^2.0.0). If this is not specified, the latest version is used

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm show readme

Usage:

d8 delivery-kit helm show readme [CHART] [options]

show the chart's README

This command inspects a chart (directory, file, or URL) and displays the contents
of the README file

Options

--ca-file
verify certificates of HTTPS-enabled servers using this CA bundle
--cert-file
identify HTTPS client using this SSL certificate file
--devel
use development versions, too. Equivalent to version '>0.0.0-0'. If --version is set, this is ignored
--insecure-skip-tls-verify
skip tls certificate checks for the chart download
--key-file
identify HTTPS client using this SSL key file
--keyring
location of public keys used for verification
--pass-credentials
pass credentials to all domains
--password
chart repository password where to locate the requested chart
--plain-http
use insecure HTTP connections for the chart download
--repo
chart repository url where to locate the requested chart
--username
chart repository username where to locate the requested chart
--verify
verify the package before using it
--version
specify a version constraint for the chart version to use. This constraint can be a specific tag (e.g. 1.1.1) or it may reference a valid range (e.g. ^2.0.0). If this is not specified, the latest version is used

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm show values

Usage:

d8 delivery-kit helm show values [CHART] [options]

show the chart's values

This command inspects a chart (directory, file, or URL) and displays the contents
of the values.yaml file

Options

--ca-file
verify certificates of HTTPS-enabled servers using this CA bundle
--cert-file
identify HTTPS client using this SSL certificate file
--devel
use development versions, too. Equivalent to version '>0.0.0-0'. If --version is set, this is ignored
--insecure-skip-tls-verify
skip tls certificate checks for the chart download
--jsonpath
supply a JSONPath expression to filter the output
--key-file
identify HTTPS client using this SSL key file
--keyring
location of public keys used for verification
--pass-credentials
pass credentials to all domains
--password
chart repository password where to locate the requested chart
--plain-http
use insecure HTTP connections for the chart download
--repo
chart repository url where to locate the requested chart
--username
chart repository username where to locate the requested chart
--verify
verify the package before using it
--version
specify a version constraint for the chart version to use. This constraint can be a specific tag (e.g. 1.1.1) or it may reference a valid range (e.g. ^2.0.0). If this is not specified, the latest version is used

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm status

Usage:

d8 delivery-kit helm status RELEASE_NAME [options]

display the status of the named release

This command shows the status of a named release.
The status consists of:
- last deployment time
- k8s namespace in which the release lives
- state of the release (can be: unknown, deployed, uninstalled, superseded, failed, uninstalling, pending-install, pending-upgrade or pending-rollback)
- revision of the release
- description of the release (can be completion message or error message, need to enable --show-desc)
- list of resources that this release consists of (need to enable --show-resources)
- details on last test suite run, if applicable
- additional notes provided by the chart

Options

--output, -o
prints the output in the specified format. Allowed values: table, json, yaml
--revision
if set, display the status of the named release with revision
--show-desc
if set, display the description message of the named release
--show-resources
if set, display the resources of the named release

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm template

Usage:

d8 delivery-kit helm template [NAME] [CHART] [options]

locally render templates

Render chart templates locally and display the output.

Any values that would normally be looked up or retrieved in-cluster will be
faked locally. Additionally, none of the server-side testing of chart validity
(e.g. whether an API is supported) is done.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--api-versions, -a
Kubernetes api versions used for Capabilities.APIVersions
--atomic
if set, the installation process deletes the installation on failure. The --wait flag will be set automatically if --atomic is used
--ca-file
verify certificates of HTTPS-enabled servers using this CA bundle
--cert-file
identify HTTPS client using this SSL certificate file
--cleanup-on-fail
allow deletion of new resources created in this installation when install fails
--create-namespace
create the release namespace if not present
--dependency-update
update dependencies if they are missing before installing the chart
--deploy-report-path
save deploy report in JSON to the specified path
--description
add a custom description
--devel
use development versions, too. Equivalent to version '>0.0.0-0'. If --version is set, this is ignored
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--disable-openapi-validation
if set, the installation process will not validate rendered templates against the Kubernetes OpenAPI Schema
--dry-run
simulate an install. If --dry-run is set with no option being specified or as '--dry-run=client', it will not attempt cluster connections. Setting '--dry-run=server' allows attempting cluster connections.
--enable-dns
enable DNS lookups when rendering templates
--force
force resource updates through a replacement strategy
--generate-name, -g
generate the name (and omit the NAME parameter)
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--include-crds
include CRDs in the templated output
--insecure-skip-tls-verify
skip tls certificate checks for the chart download
--is-upgrade
set .Release.IsUpgrade instead of .Release.IsInstall
--key-file
identify HTTPS client using this SSL key file
--keyring
location of public keys used for verification
--kube-version
Kubernetes version used for Capabilities.KubeVersion
--labels, -l
Labels that would be added to release metadata. Should be divided by comma.
--name-template
specify template used to name the release
--no-hooks
prevent hooks from running during install
--output-dir
writes the executed templates to files in output-dir instead of stdout
--pass-credentials
pass credentials to all domains
--password
chart repository password where to locate the requested chart
--plain-http
use insecure HTTP connections for the chart download
--post-renderer
the path to an executable to be used for post rendering. If it exists in $PATH, the binary will be used, otherwise it will try to look for the executable at the given path
--post-renderer-args
an argument to the post-renderer (can specify multiple)
--release-name
use release name in the output-dir path.
--render-subchart-notes
if set, render subchart notes along with the parent
--replace
re-use the given name, only if that name is a deleted release which remains in the history. This is unsafe in production
--repo
chart repository url where to locate the requested chart
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
set values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--set-file
set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2)
--set-json
set JSON values on the command line (can specify multiple or separate values with commas: key1=jsonval1,key2=jsonval2)
--set-literal
set a literal STRING value on the command line
--set-string
set STRING values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--show-only, -s
only show manifests rendered from the given templates
--skip-crds
if set, no CRDs will be installed. By default, CRDs are installed if not already present
--skip-tests
skip tests from templated output
--timeout
time to wait for any individual Kubernetes operation (like Jobs for hooks)
--username
chart repository username where to locate the requested chart
--validate
validate your manifests against the Kubernetes cluster you are currently pointing at. This is the same validation performed on an install
--values, -f
specify values in a YAML file or a URL (can specify multiple)
--verify
verify the package before using it
--version
specify a version constraint for the chart version to use. This constraint can be a specific tag (e.g. 1.1.1) or it may reference a valid range (e.g. ^2.0.0). If this is not specified, the latest version is used
--wait
if set, will wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet are in a ready state before marking the release as successful. It will wait for as long as --timeout
--wait-for-jobs
if set and --wait enabled, will wait until all Jobs have been completed before marking the release as successful. It will wait for as long as --timeout

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm test

Usage:

d8 delivery-kit helm test [RELEASE] [options]

run tests for a release

The test command runs the tests for a release.

The argument this command takes is the name of a deployed release.
The tests to be run are defined in the chart that was installed.

Options

--filter
specify tests by attribute (currently "name") using attribute=value syntax or '!attribute=value' to exclude a test (can specify multiple or separate values with commas: name=test1,name=test2)
--logs
dump the logs from test pods (this runs after all tests are complete, but before any cleanup)
--timeout
time to wait for any individual Kubernetes operation (like Jobs for hooks)

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm uninstall

Aliases: del, delete, un

Usage:

d8 delivery-kit helm uninstall RELEASE_NAME [...] [options]

uninstall a release

This command takes a release name and uninstalls the release.

It removes all of the resources associated with the last release of the chart
as well as the release history, freeing it up for future use.

Use the '--dry-run' flag to see which releases will be uninstalled without actually
uninstalling them.

Options

--cascade
Must be "background", "orphan", or "foreground". Selects the deletion cascading strategy for the dependents. Defaults to background.
--description
add a custom description
--dry-run
simulate a uninstall
--ignore-not-found
Treat "release not found" as a successful uninstall
--keep-history
remove all associated resources and mark the release as deleted, but retain the release history
--no-hooks
prevent hooks from running during uninstallation
--timeout
time to wait for any individual Kubernetes operation (like Jobs for hooks)
--wait
if set, will wait until all the resources are deleted before returning. It will wait for as long as --timeout

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm upgrade

Usage:

d8 delivery-kit helm upgrade [RELEASE] [CHART] [options]

upgrade a release

This command upgrades a release to a new version of a chart.

The upgrade arguments must be a release and chart. The chart
argument can be either: a chart reference('example/mariadb'), a path to a chart directory,
a packaged chart, or a fully qualified URL. For chart references, the latest
version will be specified unless the '--version' flag is set.

To override values in a chart, use either the '--values' flag and pass in a file
or use the '--set' flag and pass configuration from the command line, to force string
values, use '--set-string'. You can use '--set-file' to set individual
values from a file when the value itself is too long for the command line
or is dynamically generated. You can also use '--set-json' to set json values
(scalars/objects/arrays) from the command line.

You can specify the '--values'/'-f' flag multiple times. The priority will be given to the
last (right-most) file specified. For example, if both myvalues.yaml and override.yaml
contained a key called 'Test', the value set in override.yaml would take precedence:

    $ helm upgrade -f myvalues.yaml -f override.yaml redis ./redis

You can specify the '--set' flag multiple times. The priority will be given to the
last (right-most) set specified. For example, if both 'bar' and 'newbar' values are
set for a key called 'foo', the 'newbar' value would take precedence:

    $ helm upgrade --set foo=bar --set foo=newbar redis ./redis

You can update the values for an existing release with this command as well via the
'--reuse-values' flag. The 'RELEASE' and 'CHART' arguments should be set to the original
parameters, and existing values will be merged with any values set via '--values'/'-f'
or '--set' flags. Priority is given to new values.

    $ helm upgrade --reuse-values --set foo=bar --set foo=newbar redis ./redis

The --dry-run flag will output all generated chart manifests, including Secrets
which can contain sensitive values. Please carefully consider how and when this
flag is used.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--atomic
if set, upgrade process rolls back changes made in case of failed upgrade. The --wait flag will be set automatically if --atomic is used
--ca-file
verify certificates of HTTPS-enabled servers using this CA bundle
--cert-file
identify HTTPS client using this SSL certificate file
--cleanup-on-fail
allow deletion of new resources created in this upgrade when upgrade fails
--create-namespace
if --install is set, create the release namespace if not present
--dependency-update
update dependencies if they are missing before installing the chart
--deploy-report-path
save deploy report in JSON to the specified path
--description
add a custom description
--devel
use development versions, too. Equivalent to version '>0.0.0-0'. If --version is set, this is ignored
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--disable-openapi-validation
if set, the upgrade process will not validate rendered templates against the Kubernetes OpenAPI Schema
--dry-run
simulate an install. If --dry-run is set with no option being specified or as '--dry-run=client', it will not attempt cluster connections. Setting '--dry-run=server' allows attempting cluster connections.
--enable-dns
enable DNS lookups when rendering templates
--force
force resource updates through a replacement strategy
--history-max
limit the maximum number of revisions saved per release. Use 0 for no limit
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--insecure-skip-tls-verify
skip tls certificate checks for the chart download
--install, -i
if a release by this name doesn't already exist, run an install
--key-file
identify HTTPS client using this SSL key file
--keyring
location of public keys used for verification
--labels, -l
Labels that would be added to release metadata. Should be separated by comma. Original release labels will be merged with upgrade labels. You can unset label using null.
--no-hooks
disable pre/post upgrade hooks
--output, -o
prints the output in the specified format. Allowed values: table, json, yaml
--pass-credentials
pass credentials to all domains
--password
chart repository password where to locate the requested chart
--plain-http
use insecure HTTP connections for the chart download
--post-renderer
the path to an executable to be used for post rendering. If it exists in $PATH, the binary will be used, otherwise it will try to look for the executable at the given path
--post-renderer-args
an argument to the post-renderer (can specify multiple)
--recreate-pods
performs pods restart for the resource if applicable
--render-subchart-notes
if set, render subchart notes along with the parent
--repo
chart repository url where to locate the requested chart
--reset-then-reuse-values
when upgrading, reset the values to the ones built into the chart, apply the last release's values and merge in any overrides from the command line via --set and -f. If '--reset-values' or '--reuse-values' is specified, this is ignored
--reset-values
when upgrading, reset the values to the ones built into the chart
--reuse-values
when upgrading, reuse the last release's values and merge in any overrides from the command line via --set and -f. If '--reset-values' is specified, this is ignored
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
set values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--set-file
set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2)
--set-json
set JSON values on the command line (can specify multiple or separate values with commas: key1=jsonval1,key2=jsonval2)
--set-literal
set a literal STRING value on the command line
--set-string
set STRING values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
--skip-crds
if set, no CRDs will be installed when an upgrade is performed with install flag enabled. By default, CRDs are installed if not already present, when an upgrade is performed with install flag enabled
--timeout
time to wait for any individual Kubernetes operation (like Jobs for hooks)
--username
chart repository username where to locate the requested chart
--values, -f
specify values in a YAML file or a URL (can specify multiple)
--verify
verify the package before using it
--version
specify a version constraint for the chart version to use. This constraint can be a specific tag (e.g. 1.1.1) or it may reference a valid range (e.g. ^2.0.0). If this is not specified, the latest version is used
--wait
if set, will wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet are in a ready state before marking the release as successful. It will wait for as long as --timeout
--wait-for-jobs
if set and --wait enabled, will wait until all Jobs have been completed before marking the release as successful. It will wait for as long as --timeout

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm verify

Usage:

d8 delivery-kit helm verify PATH [options]

verify that a chart at the given path has been signed and is valid

Verify that the given chart has a valid provenance file.

Provenance files provide cryptographic verification that a chart has not been
tampered with, and was packaged by a trusted provider.

This command can be used to verify a local chart. Several other commands provide
'--verify' flags that run the same validation. To generate a signed package, use
the 'helm package --sign' command.

Options

--keyring
keyring containing public keys

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit helm version

Usage:

d8 delivery-kit helm version [options]

print the client version information

Show the version for Helm.

This will print a representation the version of Helm.
The output will look something like this:

version.BuildInfo{Version:"v3.2.1", GitCommit:"fe51cd1e31e6a202cba7dead9552a6d418ded79a", GitTreeState:"clean", GoVersion:"go1.13.10"}

- Version is the semantic version of the release.
- GitCommit is the SHA for the commit that this version was built from.
- GitTreeState is "clean" if there are no local code changes when this binary was
  built, and "dirty" if the binary was built from locally modified code.
- GoVersion is the version of Go that was used to compile Helm.

When using the --template flag the following properties are available to use in
the template:

- .Version contains the semantic version of Helm
- .GitCommit is the git commit
- .GitTreeState is the state of the git tree when Helm was built
- .GoVersion contains the version of Go that Helm was compiled with

For example, --template='Version: {{.Version}}' outputs 'Version: v3.2.1'.

Options

--client, -c
display client version information
--short
print the version number
--template
template for version string format

Global options

--debug
Enable debug (default $WERF_DEBUG).
--hooks-status-progress-period
No-op
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--namespace, -n
namespace scope for this request
--quiet
Disable explanatory output (default $WERF_QUIET).
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit host

Usage:

d8 delivery-kit host [options]

Work with werf cache and data of all projects on the host machine

d8 delivery-kit host cleanup

Usage:

d8 delivery-kit host cleanup [options]

Cleanup old unused werf cache and data of all projects on host machine.

Cleanup old unused werf cache and data of all projects on host machine.

The data include:
* Lost Docker containers and images from interrupted builds.
* Old service tmp dirs, which werf creates during every build, converge and other commands.
* Local cache:
  * remote Git clones cache;
  * Git worktree cache.

It is safe to run this command periodically by automated cleanup job in parallel with other werf    
commands such as build, converge and cleanup.

Options

--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority)
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--dry-run
Indicate what the command would do without actually doing that (default $WERF_DRY_RUN)
--force
Force deletion of images which are being used by some containers (default $WERF_FORCE)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--quiet
Disable explanatory output (default $WERF_QUIET).
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit host purge

Usage:

d8 delivery-kit host purge [options]

Purge werf images, cache and other data for all projects on host machine

Purge werf images, cache and other data for all projects on host machine.

The data include:
* Old service tmp dirs, which werf creates during every build, converge and other commands.
* Local cache:
  * remote Git clones cache;
  * Git worktree cache.
* Shared context:
  * Mounts which persists between several builds (mounts from build_dir).

WARNING: Do not run this command during any other werf command is working on the host machine. This 
command is supposed to be run manually.

Options

--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority)
--dry-run
Indicate what the command would do without actually doing that (default $WERF_DRY_RUN)
--force
First remove containers that use werf docker images which are going to be deleted
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--quiet
Disable explanatory output (default $WERF_QUIET).
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit includes

Usage:

d8 delivery-kit includes [options]

Work with werf includes

d8 delivery-kit includes get-file

Usage:

d8 delivery-kit includes get-file [FILE_NAME] [options]

Display file content that will be used by werf according to the includes overlay rules.

Display file content that will be used by werf according to the includes overlay rules.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--env
Use specified environment (default $WERF_ENV)
--follow
Enable follow mode (default $WERF_FOLLOW). The mode allows restarting the command on a new commit. In development mode (--dev), werf restarts the command on any changes (including untracked files) in the git repository worktree
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit includes ls-files

Usage:

d8 delivery-kit includes ls-files [GLOB...] [options]

List files in the project according to the includes overlay rules.

List files in the project according to the includes overlay rules.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--env
Use specified environment (default $WERF_ENV)
--filter
Filter by source, e.g. --filter=source=local,remoteRepo (default $WERF_INCLUDES_LIST_FILTER or all sources).
--follow
Enable follow mode (default $WERF_FOLLOW). The mode allows restarting the command on a new commit. In development mode (--dev), werf restarts the command on any changes (including untracked files) in the git repository worktree
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit includes update

Usage:

d8 delivery-kit includes update [options]

Create or update includes lock file (default: werf-includes.lock).

Create or update includes lock file by resolving git references in the includes config to their latest commits (default: werf-includes.lock).

Options

--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--env
Use specified environment (default $WERF_ENV)
--follow
Enable follow mode (default $WERF_FOLLOW). The mode allows restarting the command on a new commit. In development mode (--dev), werf restarts the command on any changes (including untracked files) in the git repository worktree
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit kube-run

Usage:

d8 delivery-kit kube-run [options] [IMAGE_NAME] [-- COMMAND ARG...]

Run container for project image in Kubernetes

Run container in Kubernetes for specified project image from werf.yaml (build if needed).

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--auto-pull-secret
Automatically create docker config secret in the namespace and plug it via pod's imagePullSecrets for private registry access (default $WERF_AUTO_PULL_SECRET or true if not specified)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--copy-from
Copy file/dir from container to local machine after user command execution. Example: "/from/file:to". Can be specified multiple times. Can also be defined with "$WERF_COPY_FROM_*", e.g. "WERF_COPY_FROM_1=from:to".
--copy-to
Copy file/dir from local machine to container before user command execution. Example: "from:/to/file". Can be specified multiple times. Can also be defined with "$WERF_COPY_TO_*", e.g. "WERF_COPY_TO_1=from:to".
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read and pull images from the specified repo
--dry-run
Indicate what the command would do without actually doing that (default $WERF_DRY_RUN)
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--extra-options
Pass extra options to "kubectl run" command, which will create a Pod (default $WERF_EXTRA_OPTIONS)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--follow
Enable follow mode (default $WERF_FOLLOW). The mode allows restarting the command on a new commit. In development mode (--dev), werf restarts the command on any changes (including untracked files) in the git repository worktree
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--interactive, -i
Enable interactive mode (default $WERF_INTERACTIVE or false if not specified)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--namespace
Use specified Kubernetes namespace (default [[ project ]]-[[ env ]] template or deploy.namespace custom template from werf.yaml or $WERF_NAMESPACE)
--overrides
Inline JSON to override/extend any fields in created Pod, e.g. to add imagePullSecrets field (default $WERF_OVERRIDES). %pod_name%, %container_name%, and %container_image% will be replaced with the names of the created pod, container, and container image, respectively.
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--pod
Set created pod name (default $WERF_POD or autogenerated if not specified)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--rm
Remove pod and other created resources after command completion (default $WERF_RM or true if not specified)
--rm-with-namespace
Remove also a namespace after command completion (default $WERF_RM_WITH_NAMESPACE or false if not specified)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--tty, -t
Allocate a TTY (default $WERF_TTY or false if not specified)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)

d8 delivery-kit lint

Usage:

d8 delivery-kit lint [IMAGE_NAME...] [options]

Lint Helm chart

Lint Helm chart. This command will calculate digests and build (if needed) all images defined in    
the werf.yaml.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--build-report-operations
Collect low-level operations statistics: add Operations and StageCache sections to the build report and print operations summary after the build (by default $WERF_BUILD_REPORT_OPERATIONS or false). Also enabled by --log-debug
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--delete-propagation
Set default delete propagation strategy (default $WERF_DELETE_PROPAGATION or Foreground).
--deno-binary-path
Path to the Deno binary to use instead of auto-downloading (default $WERF_DENO_BINARY_PATH)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--disable-default-values
Do not use values from the default .helm/values.yaml file (default $WERF_DISABLE_DEFAULT_VALUES or false)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo and to pull base images
--env
Use specified environment (default $WERF_ENV)
--extra-apiversions
Extra Kubernetes API versions passed to $.Capabilities.APIVersions. Can be also set with $WERF_EXTRA_APIVERSIONS_* environment variables, values can be comma-separated
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or true by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--force-adoption
Always adopt resources, even if they belong to a different Helm release (default $WERF_FORCE_ADOPTION or false)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--ignore-bundle-js
Do not use the existing bundle.js file. Requires TypeScript source files and Deno to rebuild (default $WERF_IGNORE_BUNDLE_JS)
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--insecure-helm-dependencies
Allow insecure oci registries to be used in the Chart.yaml dependencies configuration (default $WERF_INSECURE_HELM_DEPENDENCIES)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--introspect-before-error
Introspect failed stage in the clean state, before running all assembly instructions of the stage
--introspect-error
Introspect failed stage in the state, right after running failed assembly instruction
--introspect-stage
Introspect a specific stage. The option can be used multiple times to introspect several stages. There are the following formats to use: * specify IMAGE_NAME/STAGE_NAME to introspect stage STAGE_NAME of either image or artifact IMAGE_NAME * specify STAGE_NAME or */STAGE_NAME for the introspection of all existing stages with name STAGE_NAME IMAGE_NAME is the name of an image or artifact described in werf.yaml, the nameless image specified with ~. STAGE_NAME should be one of the following: from, beforeInstall, dependenciesBeforeInstall, gitArchive, install, dependenciesAfterInstall, beforeSetup, dependenciesBeforeSetup, setup, dependenciesAfterSetup, gitCache, gitLatestPatch, dockerInstructions, dockerfile, imageSpec
--kube-api-server
Kubernetes API server address (default $WERF_KUBE_API_SERVER)
--kube-auth-password
Basic auth password for Kubernetes API (default $WERF_KUBE_AUTH_PASSWORD)
--kube-auth-provider
Auth provider name for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER)
--kube-auth-provider-config
Auth provider config for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER_CONFIG)
--kube-auth-username
Basic auth username for Kubernetes API (default $WERF_KUBE_AUTH_USERNAME)
--kube-burst-limit
Kubernetes client burst limit (default $WERF_KUBE_BURST_LIMIT or 100)
--kube-ca-data
Pass Kubernetes API server TLS CA data (default $WERF_KUBE_CA_DATA)
--kube-ca-path
Kubernetes API server CA path (default $WERF_KUBE_CA_PATH)
--kube-cert
Path to PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT
--kube-cert-data
Pass PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT_DATA)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--kube-context-cluster
Use cluster from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_CLUSTER)
--kube-context-user
Use user from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_USER)
--kube-impersonate-group
Sets Impersonate-Group headers when authenticating in Kubernetes. Can be also set with $WERF_KUBE_IMPERSONATE_GROUP_* environment variables
--kube-impersonate-uid
Sets Impersonate-Uid header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_UID)
--kube-impersonate-user
Sets Impersonate-User header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_USER)
--kube-key
Path to PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY)
--kube-key-data
Pass PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY_DATA)
--kube-proxy-url
Proxy URL to use for proxying all requests to Kubernetes API (default $WERF_KUBE_PROXY_URL)
--kube-qps-limit
Kubernetes client QPS limit (default $WERF_KUBE_QPS_LIMIT or 30)
--kube-request-timeout
Timeout for all requests to Kubernetes API (default $WERF_KUBE_REQUEST_TIMEOUT)
--kube-tls-server
Server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used (default $WERF_KUBE_TLS_SERVER)
--kube-token
Kubernetes bearer token used for authentication (default $WERF_KUBE_TOKEN)
--kube-token-path
Path to file with bearer token for authentication in Kubernetes (default $WERF_KUBE_TOKEN_PATH)
--kube-version
Set specific Capabilities.KubeVersion (default $WERF_KUBE_VERSION)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--lookup-resources
Manifest files used as a cluster stub for the lookup template function in non-remote mode. Multi-document and kind:List supported. Namespaced resources must set metadata.namespace, otherwise namespace-scoped lookups ignore the requested namespace. Can be also set with $WERF_LOOKUP_RESOURCES_* environment variables (can specify multiple)
--loose-giterminism
Loose werf giterminism mode restrictions
--namespace
Use specified Kubernetes namespace (default [[ project ]]-[[ env ]] template or deploy.namespace custom template from werf.yaml or $WERF_NAMESPACE)
--network-parallelism
Parallelize some network operations (default $WERF_NETWORK_PARALLELISM or 30)
--no-final-tracking
By default disable tracking operations that have no create/update/delete resource operations after them, which are most tracking operations, to speed up the release (default $WERF_NO_FINAL_TRACKING)
--no-remove-manual-changes
Don't remove fields added manually to the resource in the cluster if fields aren't present in the manifest (default $WERF_NO_REMOVE_MANUAL_CHANGES)
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--provenance-keyring
Path to keyring containing public keys to verify chart provenance (default $WERF_PROVENANCE_KEYRING)
--provenance-strategy
Strategy for provenance verifying (default $WERF_PROVENANCE_STRATEGY).
--quiet
Disable explanatory output (default $WERF_QUIET).
--release
Use specified Helm release name (default [[ project ]]-[[ env ]] template or deploy.helmRelease custom template from werf.yaml or $WERF_RELEASE)
--release-storage
How releases should be stored (default $WERF_RELEASE_STORAGE)
--release-storage-sql-connection
SQL Connection String for Helm SQL Storage (default $WERF_RELEASE_STORAGE_SQL_CONNECTION)
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--runtime-annotations
Add annotations which will not trigger resource updates to all resources (default $WERF_RUNTIME_ANNOTATIONS)
--runtime-labels
Add labels which will not trigger resource updates to all resources (default $WERF_RUNTIME_LABELS)
--save-build-report
Save build report (by default $WERF_SAVE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
Set helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_* (e.g. $WERF_SET_1=key1=val1, $WERF_SET_2=key2=val2)
--set-docker-config-json-value
Shortcut to set current docker config into the .Values.global.werf.dockerconfigjson
--set-file
Set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2). Also, can be defined with $WERF_SET_FILE_* (e.g. $WERF_SET_FILE_1=key1=path1, $WERF_SET_FILE_2=key2=val2)
--set-json
Set new values, where the key is the value path and the value is JSON (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_JSON_* (e.g. $WERF_SET_JSON_1=key1=val1, $WERF_SET_JSON_2=key2=val2)
--set-literal
Set new values, where the key is the value path and the value is the value. The value will always become a literal string (can specify multiple or separate values with commas: key1=val1,key2=val2).) Also, can be defined with $WERF_SET_LITERAL_* (e.g. $WERF_SET_LITERAL_1=key1=val1, $WERF_SET_LITERAL_2=key2=val2)
--set-root-json
Set new keys in arbitrary things in the global root context ("$"), where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you REALLY know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_ROOT_JSON_* (e.g. $WERF_SET_ROOT_JSON_1=key1=val1, $WERF_SET_ROOT_JSON_2=key2=val2)
--set-runtime-json
Set new keys in $.Runtime, where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_RUNTIME_JSON_* (e.g. $WERF_SET_RUNTIME_JSON_1=key1=val1, $WERF_SET_RUNTIME_JSON_2=key2=val2)
--set-string
Set STRING helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_STRING_* (e.g. $WERF_SET_STRING_1=key1=val1, $WERF_SET_STRING_2=key2=val2)
--skip-dependencies-repo-refresh, -L
Do not refresh helm chart repositories locally cached index
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-helm-dependencies
Skip TLS certificate validation when accessing a Helm charts repository (default $WERF_SKIP_TLS_VERIFY_HELM_DEPENDENCIES)
--skip-tls-verify-kube
Skip TLS certificate validation when accessing a Kubernetes cluster (default $WERF_SKIP_TLS_VERIFY_KUBE)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--stub-tags
Use stubs instead of real tags (default $WERF_STUB_TAGS)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--templates-allow-dns
Allow performing DNS requests in templating (default $WERF_TEMPLATES_ALLOW_DNS)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--use-custom-tag
Use a tag alias in helm templates instead of an image content-based tag (NOT RECOMMENDED). The alias may contain the following shortcuts: - %image%, %image_slug% or %image_safe_slug% to use the image name (necessary if there is more than one image in the werf config); - %image_content_based_tag% to use a content-based tag. For cleaning custom tags and associated content-based tag are treated as one. Also, can be defined with $WERF_USE_CUSTOM_TAG (e.g. $WERF_USE_CUSTOM_TAG="%image%-tag")
--validate
Validate your manifests against the Kubernetes cluster you are currently pointing at (default $WERF_VALIDATE)
--values
Specify helm values in a YAML file or a URL (can specify multiple). Also, can be defined with $WERF_VALUES_* (e.g. $WERF_VALUES_1=.helm/values_1.yaml, $WERF_VALUES_2=.helm/values_2.yaml)
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)
--without-images
Disable building of images defined in the werf.yaml (if any) and usage of such images in the .helm/templates ($WERF_WITHOUT_IMAGES or false by default — e.g. enable all images defined in the werf.yaml by default)

d8 delivery-kit managed-images

Usage:

d8 delivery-kit managed-images [options]

Work with managed images which will be preserved during cleanup procedure

d8 delivery-kit managed-images add

Usage:

d8 delivery-kit managed-images add [options]

Add image record to the list of managed images which will be preserved during cleanup procedure.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read and write images to the specified repo
--env
Use specified environment (default $WERF_ENV)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit managed-images ls

Usage:

d8 delivery-kit managed-images ls [options]

List managed images which will be preserved during cleanup procedure.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read images from the specified repo
--env
Use specified environment (default $WERF_ENV)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit managed-images rm

Usage:

d8 delivery-kit managed-images rm [options]

Remove image record from the list of managed images which will be preserved during cleanup procedure.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read and write images to the specified repo
--env
Use specified environment (default $WERF_ENV)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit plan

Usage:

d8 delivery-kit plan [options]

Prepare deploy plan and show how resources in a Kubernetes cluster would change on next deploy

Prepare deploy plan and show how resources in a Kubernetes cluster would change on next deploy.

Environment is a required param by default, because it is needed to construct Helm Release name and 
Kubernetes Namespace. Either --env or $WERF_ENV should be specified for command.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-custom-tag
Set tag alias for the content-based tag. The alias may contain the following shortcuts: - %image%, %image_slug% or %image_safe_slug% to use the image name (necessary if there is more than one image in the werf config); - %image_content_based_tag% to use a content-based tag. For cleaning custom tags and associated content-based tag are treated as one. Also can be defined with $WERF_ADD_CUSTOM_TAG_* (e.g. $WERF_ADD_CUSTOM_TAG_1="%image%-tag1", $WERF_ADD_CUSTOM_TAG_2="%image%-tag2")
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-operations
Collect low-level operations statistics: add Operations and StageCache sections to the build report and print operations summary after the build (by default $WERF_BUILD_REPORT_OPERATIONS or false). Also enabled by --log-debug
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--delete-propagation
Set default delete propagation strategy (default $WERF_DELETE_PROPAGATION or Foreground).
--deno-binary-path
Path to the Deno binary to use instead of auto-downloading (default $WERF_DENO_BINARY_PATH)
--deploy-graph-path
Save deploy graph path to the specified file (by default $WERF_DEPLOY_GRAPH_PATH). Extension must be .dot or not specified. If extension not specified, then .dot is used
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--diff-context-lines
Show N lines of context around diffs ($WERF_DIFF_CONTEXT_LINES by default)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--disable-default-values
Do not use values from the default .helm/values.yaml file (default $WERF_DISABLE_DEFAULT_VALUES or false)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo, to pull base images
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--exit-code
Return exit code 0 if no changes, 1 if error, 2 if any changes planned (default $WERF_EXIT_CODE or false)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or true by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--follow
Enable follow mode (default $WERF_FOLLOW). The mode allows restarting the command on a new commit. In development mode (--dev), werf restarts the command on any changes (including untracked files) in the git repository worktree
--force-adoption
Always adopt resources, even if they belong to a different Helm release (default $WERF_FORCE_ADOPTION or false)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--hooks-status-progress-period
No-op
--ignore-bundle-js
Do not use the existing bundle.js file. Requires TypeScript source files and Deno to rebuild (default $WERF_IGNORE_BUNDLE_JS)
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--insecure-helm-dependencies
Allow insecure oci registries to be used in the Chart.yaml dependencies configuration (default $WERF_INSECURE_HELM_DEPENDENCIES)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--introspect-before-error
Introspect failed stage in the clean state, before running all assembly instructions of the stage
--introspect-error
Introspect failed stage in the state, right after running failed assembly instruction
--introspect-stage
Introspect a specific stage. The option can be used multiple times to introspect several stages. There are the following formats to use: * specify IMAGE_NAME/STAGE_NAME to introspect stage STAGE_NAME of either image or artifact IMAGE_NAME * specify STAGE_NAME or */STAGE_NAME for the introspection of all existing stages with name STAGE_NAME IMAGE_NAME is the name of an image or artifact described in werf.yaml, the nameless image specified with ~. STAGE_NAME should be one of the following: from, beforeInstall, dependenciesBeforeInstall, gitArchive, install, dependenciesAfterInstall, beforeSetup, dependenciesBeforeSetup, setup, dependenciesAfterSetup, gitCache, gitLatestPatch, dockerInstructions, dockerfile, imageSpec
--kube-api-server
Kubernetes API server address (default $WERF_KUBE_API_SERVER)
--kube-auth-password
Basic auth password for Kubernetes API (default $WERF_KUBE_AUTH_PASSWORD)
--kube-auth-provider
Auth provider name for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER)
--kube-auth-provider-config
Auth provider config for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER_CONFIG)
--kube-auth-username
Basic auth username for Kubernetes API (default $WERF_KUBE_AUTH_USERNAME)
--kube-burst-limit
Kubernetes client burst limit (default $WERF_KUBE_BURST_LIMIT or 100)
--kube-ca-data
Pass Kubernetes API server TLS CA data (default $WERF_KUBE_CA_DATA)
--kube-ca-path
Kubernetes API server CA path (default $WERF_KUBE_CA_PATH)
--kube-cert
Path to PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT
--kube-cert-data
Pass PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT_DATA)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--kube-context-cluster
Use cluster from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_CLUSTER)
--kube-context-user
Use user from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_USER)
--kube-impersonate-group
Sets Impersonate-Group headers when authenticating in Kubernetes. Can be also set with $WERF_KUBE_IMPERSONATE_GROUP_* environment variables
--kube-impersonate-uid
Sets Impersonate-Uid header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_UID)
--kube-impersonate-user
Sets Impersonate-User header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_USER)
--kube-key
Path to PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY)
--kube-key-data
Pass PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY_DATA)
--kube-proxy-url
Proxy URL to use for proxying all requests to Kubernetes API (default $WERF_KUBE_PROXY_URL)
--kube-qps-limit
Kubernetes client QPS limit (default $WERF_KUBE_QPS_LIMIT or 30)
--kube-request-timeout
Timeout for all requests to Kubernetes API (default $WERF_KUBE_REQUEST_TIMEOUT)
--kube-tls-server
Server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used (default $WERF_KUBE_TLS_SERVER)
--kube-token
Kubernetes bearer token used for authentication (default $WERF_KUBE_TOKEN)
--kube-token-path
Path to file with bearer token for authentication in Kubernetes (default $WERF_KUBE_TOKEN_PATH)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--namespace
Use specified Kubernetes namespace (default [[ project ]]-[[ env ]] template or deploy.namespace custom template from werf.yaml or $WERF_NAMESPACE)
--network-parallelism
Parallelize some network operations (default $WERF_NETWORK_PARALLELISM or 30)
--no-final-tracking
By default disable tracking operations that have no create/update/delete resource operations after them, which are most tracking operations, to speed up the release (default $WERF_NO_FINAL_TRACKING)
--no-install-crds
Do not install CRDs from "crds/" directories of installed charts (default $WERF_NO_INSTALL_CRDS)
--no-remove-manual-changes
Don't remove fields added manually to the resource in the cluster if fields aren't present in the manifest (default $WERF_NO_REMOVE_MANUAL_CHANGES)
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--provenance-keyring
Path to keyring containing public keys to verify chart provenance (default $WERF_PROVENANCE_KEYRING)
--provenance-strategy
Strategy for provenance verifying (default $WERF_PROVENANCE_STRATEGY).
--quiet
Disable explanatory output (default $WERF_QUIET).
--release
Use specified Helm release name (default [[ project ]]-[[ env ]] template or deploy.helmRelease custom template from werf.yaml or $WERF_RELEASE)
--release-info-annotations
Add annotations to release metadata (default $WERF_RELEASE_INFO_ANNOTATIONS)
--release-label
Add Helm release labels (can specify multiple). Kind of labels depends or release storage driver. Format: labelName=labelValue. Also, can be specified with $WERF_RELEASE_LABEL_* (e.g. $WERF_RELEASE_LABEL_1=labelName1=labelValue1, $WERF_RELEASE_LABEL_2=labelName2=labelValue2)
--release-storage
How releases should be stored (default $WERF_RELEASE_STORAGE)
--release-storage-sql-connection
SQL Connection String for Helm SQL Storage (default $WERF_RELEASE_STORAGE_SQL_CONNECTION)
--releases-history-max
Max releases to keep in release storage ($WERF_RELEASES_HISTORY_MAX or 5 by default)
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--runtime-annotations
Add annotations which will not trigger resource updates to all resources (default $WERF_RUNTIME_ANNOTATIONS)
--runtime-labels
Add labels which will not trigger resource updates to all resources (default $WERF_RUNTIME_LABELS)
--save-build-report
Save build report (by default $WERF_SAVE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--save-plan
Save the gzip-compressed JSON install plan to the specified file
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
Set helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_* (e.g. $WERF_SET_1=key1=val1, $WERF_SET_2=key2=val2)
--set-docker-config-json-value
Shortcut to set current docker config into the .Values.global.werf.dockerconfigjson
--set-file
Set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2). Also, can be defined with $WERF_SET_FILE_* (e.g. $WERF_SET_FILE_1=key1=path1, $WERF_SET_FILE_2=key2=val2)
--set-json
Set new values, where the key is the value path and the value is JSON (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_JSON_* (e.g. $WERF_SET_JSON_1=key1=val1, $WERF_SET_JSON_2=key2=val2)
--set-literal
Set new values, where the key is the value path and the value is the value. The value will always become a literal string (can specify multiple or separate values with commas: key1=val1,key2=val2).) Also, can be defined with $WERF_SET_LITERAL_* (e.g. $WERF_SET_LITERAL_1=key1=val1, $WERF_SET_LITERAL_2=key2=val2)
--set-root-json
Set new keys in arbitrary things in the global root context ("$"), where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you REALLY know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_ROOT_JSON_* (e.g. $WERF_SET_ROOT_JSON_1=key1=val1, $WERF_SET_ROOT_JSON_2=key2=val2)
--set-runtime-json
Set new keys in $.Runtime, where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_RUNTIME_JSON_* (e.g. $WERF_SET_RUNTIME_JSON_1=key1=val1, $WERF_SET_RUNTIME_JSON_2=key2=val2)
--set-string
Set STRING helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_STRING_* (e.g. $WERF_SET_STRING_1=key1=val1, $WERF_SET_STRING_2=key2=val2)
--show-insignificant-diffs
Show insignificant diff lines ($WERF_SHOW_INSIGNIFICANT_DIFFS by default)
--show-plan
Show plan artifact planned changes
--show-sensitive-diffs
Show sensitive diff lines ($WERF_SHOW_SENSITIVE_DIFFS by default)
--show-verbose-crd-diffs
Show verbose CRD diff lines ($WERF_SHOW_VERBOSE_CRD_DIFFS by default)
--show-verbose-diffs
Show verbose diff lines ($WERF_SHOW_VERBOSE_DIFFS by default)
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-dependencies-repo-refresh, -L
Do not refresh helm chart repositories locally cached index
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-helm-dependencies
Skip TLS certificate validation when accessing a Helm charts repository (default $WERF_SKIP_TLS_VERIFY_HELM_DEPENDENCIES)
--skip-tls-verify-kube
Skip TLS certificate validation when accessing a Kubernetes cluster (default $WERF_SKIP_TLS_VERIFY_KUBE)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--status-progress-period
No-op
--stub-tags
Use stubs instead of real tags (default $WERF_STUB_TAGS)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--templates-allow-dns
Allow performing DNS requests in templating (default $WERF_TEMPLATES_ALLOW_DNS)
--timeout, -t
No-op
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--use-custom-tag
Use a tag alias in helm templates instead of an image content-based tag (NOT RECOMMENDED). The alias may contain the following shortcuts: - %image%, %image_slug% or %image_safe_slug% to use the image name (necessary if there is more than one image in the werf config); - %image_content_based_tag% to use a content-based tag. For cleaning custom tags and associated content-based tag are treated as one. Also, can be defined with $WERF_USE_CUSTOM_TAG (e.g. $WERF_USE_CUSTOM_TAG="%image%-tag")
--values
Specify helm values in a YAML file or a URL (can specify multiple). Also, can be defined with $WERF_VALUES_* (e.g. $WERF_VALUES_1=.helm/values_1.yaml, $WERF_VALUES_2=.helm/values_2.yaml)
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)
--without-images
Disable building of images defined in the werf.yaml (if any) and usage of such images in the .helm/templates ($WERF_WITHOUT_IMAGES or false by default — e.g. enable all images defined in the werf.yaml by default)

d8 delivery-kit purge

Usage:

d8 delivery-kit purge [options]

Purge all project images in the container registry

Purge all project images in the container registry.

WARNING: Images that are being used in the Kubernetes cluster will also be deleted.

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--cleanup-report-path
Change cleanup report path (by default $WERF_CLEANUP_REPORT_PATH or ".werf-cleanup-report.json" if not set). Extension must be .json for JSON format. If extension not specified, then .json is used
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to delete images from the specified repo
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--dry-run
Indicate what the command would do without actually doing that (default $WERF_DRY_RUN)
--env
Use specified environment (default $WERF_ENV)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--save-cleanup-report
Save cleanup report (by default $WERF_SAVE_CLEANUP_REPORT or false). Its path configured with --cleanup-report-path
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit render

Usage:

d8 delivery-kit render [IMAGE_NAME...] [options]

Render Kubernetes templates

Render Kubernetes templates. This command will calculate digests and build (if needed) all images   
defined in the werf.yaml.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-operations
Collect low-level operations statistics: add Operations and StageCache sections to the build report and print operations summary after the build (by default $WERF_BUILD_REPORT_OPERATIONS or false). Also enabled by --log-debug
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--deno-binary-path
Path to the Deno binary to use instead of auto-downloading (default $WERF_DENO_BINARY_PATH)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-default-secret-values
Do not use secret values from the default .helm/secret-values.yaml file (default $WERF_DISABLE_DEFAULT_SECRET_VALUES or false)
--disable-default-values
Do not use values from the default .helm/values.yaml file (default $WERF_DISABLE_DEFAULT_VALUES or false)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo and to pull base images
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--extra-apiversions
Extra Kubernetes API versions passed to $.Capabilities.APIVersions. Can be also set with $WERF_EXTRA_APIVERSIONS_* environment variables, values can be comma-separated
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or true by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--force-adoption
Always adopt resources, even if they belong to a different Helm release (default $WERF_FORCE_ADOPTION or false)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--hooks-status-progress-period
No-op
--ignore-bundle-js
Do not use the existing bundle.js file. Requires TypeScript source files and Deno to rebuild (default $WERF_IGNORE_BUNDLE_JS)
--ignore-secret-key
Disable secrets decryption (default $WERF_IGNORE_SECRET_KEY)
--include-crds
Include CRDs in the templated output (default $WERF_INCLUDE_CRDS)
--insecure-helm-dependencies
Allow insecure oci registries to be used in the Chart.yaml dependencies configuration (default $WERF_INSECURE_HELM_DEPENDENCIES)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--introspect-before-error
Introspect failed stage in the clean state, before running all assembly instructions of the stage
--introspect-error
Introspect failed stage in the state, right after running failed assembly instruction
--introspect-stage
Introspect a specific stage. The option can be used multiple times to introspect several stages. There are the following formats to use: * specify IMAGE_NAME/STAGE_NAME to introspect stage STAGE_NAME of either image or artifact IMAGE_NAME * specify STAGE_NAME or */STAGE_NAME for the introspection of all existing stages with name STAGE_NAME IMAGE_NAME is the name of an image or artifact described in werf.yaml, the nameless image specified with ~. STAGE_NAME should be one of the following: from, beforeInstall, dependenciesBeforeInstall, gitArchive, install, dependenciesAfterInstall, beforeSetup, dependenciesBeforeSetup, setup, dependenciesAfterSetup, gitCache, gitLatestPatch, dockerInstructions, dockerfile, imageSpec
--kube-api-server
Kubernetes API server address (default $WERF_KUBE_API_SERVER)
--kube-auth-password
Basic auth password for Kubernetes API (default $WERF_KUBE_AUTH_PASSWORD)
--kube-auth-provider
Auth provider name for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER)
--kube-auth-provider-config
Auth provider config for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER_CONFIG)
--kube-auth-username
Basic auth username for Kubernetes API (default $WERF_KUBE_AUTH_USERNAME)
--kube-burst-limit
Kubernetes client burst limit (default $WERF_KUBE_BURST_LIMIT or 100)
--kube-ca-data
Pass Kubernetes API server TLS CA data (default $WERF_KUBE_CA_DATA)
--kube-ca-path
Kubernetes API server CA path (default $WERF_KUBE_CA_PATH)
--kube-cert
Path to PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT
--kube-cert-data
Pass PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT_DATA)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--kube-context-cluster
Use cluster from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_CLUSTER)
--kube-context-user
Use user from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_USER)
--kube-impersonate-group
Sets Impersonate-Group headers when authenticating in Kubernetes. Can be also set with $WERF_KUBE_IMPERSONATE_GROUP_* environment variables
--kube-impersonate-uid
Sets Impersonate-Uid header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_UID)
--kube-impersonate-user
Sets Impersonate-User header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_USER)
--kube-key
Path to PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY)
--kube-key-data
Pass PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY_DATA)
--kube-proxy-url
Proxy URL to use for proxying all requests to Kubernetes API (default $WERF_KUBE_PROXY_URL)
--kube-qps-limit
Kubernetes client QPS limit (default $WERF_KUBE_QPS_LIMIT or 30)
--kube-request-timeout
Timeout for all requests to Kubernetes API (default $WERF_KUBE_REQUEST_TIMEOUT)
--kube-tls-server
Server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used (default $WERF_KUBE_TLS_SERVER)
--kube-token
Kubernetes bearer token used for authentication (default $WERF_KUBE_TOKEN)
--kube-token-path
Path to file with bearer token for authentication in Kubernetes (default $WERF_KUBE_TOKEN_PATH)
--kube-version
Set specific Capabilities.KubeVersion (default $WERF_KUBE_VERSION)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--lookup-resources
Manifest files used as a cluster stub for the lookup template function in non-remote mode. Multi-document and kind:List supported. Namespaced resources must set metadata.namespace, otherwise namespace-scoped lookups ignore the requested namespace. Can be also set with $WERF_LOOKUP_RESOURCES_* environment variables (can specify multiple)
--loose-giterminism
Loose werf giterminism mode restrictions
--namespace
Use specified Kubernetes namespace (default [[ project ]]-[[ env ]] template or deploy.namespace custom template from werf.yaml or $WERF_NAMESPACE)
--network-parallelism
Parallelize some network operations (default $WERF_NETWORK_PARALLELISM or 30)
--output
Write render output to the specified file instead of stdout ($WERF_RENDER_OUTPUT by default)
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--provenance-keyring
Path to keyring containing public keys to verify chart provenance (default $WERF_PROVENANCE_KEYRING)
--provenance-strategy
Strategy for provenance verifying (default $WERF_PROVENANCE_STRATEGY).
--quiet
Disable explanatory output (default $WERF_QUIET).
--release
Use specified Helm release name (default [[ project ]]-[[ env ]] template or deploy.helmRelease custom template from werf.yaml or $WERF_RELEASE)
--release-storage
How releases should be stored (default $WERF_RELEASE_STORAGE)
--release-storage-sql-connection
SQL Connection String for Helm SQL Storage (default $WERF_RELEASE_STORAGE_SQL_CONNECTION)
--releases-history-max
Max releases to keep in release storage ($WERF_RELEASES_HISTORY_MAX or 5 by default)
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--save-build-report
Save build report (by default $WERF_SAVE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--secret-key
Secret key (default $WERF_SECRET_KEY)
--secret-values
Specify helm secret values in a YAML file (can specify multiple). Also, can be defined with $WERF_SECRET_VALUES_* (e.g. $WERF_SECRET_VALUES_ENV=.helm/secret_values_test.yaml, $WERF_SECRET_VALUES_DB=.helm/secret_values_db.yaml)
--set
Set helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_* (e.g. $WERF_SET_1=key1=val1, $WERF_SET_2=key2=val2)
--set-docker-config-json-value
Shortcut to set current docker config into the .Values.global.werf.dockerconfigjson
--set-file
Set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2). Also, can be defined with $WERF_SET_FILE_* (e.g. $WERF_SET_FILE_1=key1=path1, $WERF_SET_FILE_2=key2=val2)
--set-json
Set new values, where the key is the value path and the value is JSON (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_JSON_* (e.g. $WERF_SET_JSON_1=key1=val1, $WERF_SET_JSON_2=key2=val2)
--set-literal
Set new values, where the key is the value path and the value is the value. The value will always become a literal string (can specify multiple or separate values with commas: key1=val1,key2=val2).) Also, can be defined with $WERF_SET_LITERAL_* (e.g. $WERF_SET_LITERAL_1=key1=val1, $WERF_SET_LITERAL_2=key2=val2)
--set-root-json
Set new keys in arbitrary things in the global root context ("$"), where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you REALLY know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_ROOT_JSON_* (e.g. $WERF_SET_ROOT_JSON_1=key1=val1, $WERF_SET_ROOT_JSON_2=key2=val2)
--set-runtime-json
Set new keys in $.Runtime, where the key is the value path and the value is JSON. This is meant to be generated inside the program, so use --set-json instead, unless you know what you are doing. Can specify multiple or separate values with commas: key1=val1,key2=val2. Also, can be defined with $WERF_SET_RUNTIME_JSON_* (e.g. $WERF_SET_RUNTIME_JSON_1=key1=val1, $WERF_SET_RUNTIME_JSON_2=key2=val2)
--set-string
Set STRING helm values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2). Also, can be defined with $WERF_SET_STRING_* (e.g. $WERF_SET_STRING_1=key1=val1, $WERF_SET_STRING_2=key2=val2)
--show-only, -s
only show manifests rendered from the given templates
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-dependencies-repo-refresh, -L
Do not refresh helm chart repositories locally cached index
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-helm-dependencies
Skip TLS certificate validation when accessing a Helm charts repository (default $WERF_SKIP_TLS_VERIFY_HELM_DEPENDENCIES)
--skip-tls-verify-kube
Skip TLS certificate validation when accessing a Kubernetes cluster (default $WERF_SKIP_TLS_VERIFY_KUBE)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--status-progress-period
No-op
--stub-tags
Use stubs instead of real tags (default $WERF_STUB_TAGS)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--templates-allow-dns
Allow performing DNS requests in templating (default $WERF_TEMPLATES_ALLOW_DNS)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--use-custom-tag
Use a tag alias in helm templates instead of an image content-based tag (NOT RECOMMENDED). The alias may contain the following shortcuts: - %image%, %image_slug% or %image_safe_slug% to use the image name (necessary if there is more than one image in the werf config); - %image_content_based_tag% to use a content-based tag. For cleaning custom tags and associated content-based tag are treated as one. Also, can be defined with $WERF_USE_CUSTOM_TAG (e.g. $WERF_USE_CUSTOM_TAG="%image%-tag")
--validate
Validate your manifests against the Kubernetes cluster you are currently pointing at (default $WERF_VALIDATE)
--values
Specify helm values in a YAML file or a URL (can specify multiple). Also, can be defined with $WERF_VALUES_* (e.g. $WERF_VALUES_1=.helm/values_1.yaml, $WERF_VALUES_2=.helm/values_2.yaml)
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)
--without-images
Disable building of images defined in the werf.yaml (if any) and usage of such images in the .helm/templates ($WERF_WITHOUT_IMAGES or false by default — e.g. enable all images defined in the werf.yaml by default)

d8 delivery-kit rollback

Usage:

d8 delivery-kit rollback [options]

Rollback the Helm release

Rollback the Helm release.

Rollback to the previous revision by default. Use --revision to specify the revision to rollback    
to. Should be run inside of a werf project directory, otherwise --namespace and --release must be   
specified.

The result of rollback command is an application deployed into Kubernetes. Command will create the  
new release based on the one we rollback to and wait until all resources of the release will become 
ready.

Options

--add-annotation
Add annotation to deploying resources (can specify multiple). Format: annoName=annoValue. Also, can be specified with $WERF_ADD_ANNOTATION_* (e.g. $WERF_ADD_ANNOTATION_1=annoName1=annoValue1, $WERF_ADD_ANNOTATION_2=annoName2=annoValue2)
--add-label
Add label to deploying resources (can specify multiple). Format: labelName=labelValue. Also, can be specified with $WERF_ADD_LABEL_* (e.g. $WERF_ADD_LABEL_1=labelName1=labelValue1, $WERF_ADD_LABEL_2=labelName2=labelValue2)
--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--debug
Enable debug (default $WERF_DEBUG).
--delete-propagation
Set default delete propagation strategy (default $WERF_DELETE_PROPAGATION or Foreground).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--env
Use specified environment (default $WERF_ENV)
--force-adoption
Always adopt resources, even if they belong to a different Helm release (default $WERF_FORCE_ADOPTION or false)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--hooks-status-progress-period
No-op
--kube-api-server
Kubernetes API server address (default $WERF_KUBE_API_SERVER)
--kube-auth-password
Basic auth password for Kubernetes API (default $WERF_KUBE_AUTH_PASSWORD)
--kube-auth-provider
Auth provider name for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER)
--kube-auth-provider-config
Auth provider config for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER_CONFIG)
--kube-auth-username
Basic auth username for Kubernetes API (default $WERF_KUBE_AUTH_USERNAME)
--kube-burst-limit
Kubernetes client burst limit (default $WERF_KUBE_BURST_LIMIT or 100)
--kube-ca-data
Pass Kubernetes API server TLS CA data (default $WERF_KUBE_CA_DATA)
--kube-ca-path
Kubernetes API server CA path (default $WERF_KUBE_CA_PATH)
--kube-cert
Path to PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT
--kube-cert-data
Pass PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT_DATA)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--kube-context-cluster
Use cluster from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_CLUSTER)
--kube-context-user
Use user from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_USER)
--kube-impersonate-group
Sets Impersonate-Group headers when authenticating in Kubernetes. Can be also set with $WERF_KUBE_IMPERSONATE_GROUP_* environment variables
--kube-impersonate-uid
Sets Impersonate-Uid header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_UID)
--kube-impersonate-user
Sets Impersonate-User header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_USER)
--kube-key
Path to PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY)
--kube-key-data
Pass PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY_DATA)
--kube-proxy-url
Proxy URL to use for proxying all requests to Kubernetes API (default $WERF_KUBE_PROXY_URL)
--kube-qps-limit
Kubernetes client QPS limit (default $WERF_KUBE_QPS_LIMIT or 30)
--kube-request-timeout
Timeout for all requests to Kubernetes API (default $WERF_KUBE_REQUEST_TIMEOUT)
--kube-tls-server
Server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used (default $WERF_KUBE_TLS_SERVER)
--kube-token
Kubernetes bearer token used for authentication (default $WERF_KUBE_TOKEN)
--kube-token-path
Path to file with bearer token for authentication in Kubernetes (default $WERF_KUBE_TOKEN_PATH)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--namespace
Use specified Kubernetes namespace (default [[ project ]]-[[ env ]] template or deploy.namespace custom template from werf.yaml or $WERF_NAMESPACE)
--network-parallelism
Parallelize some network operations (default $WERF_NETWORK_PARALLELISM or 30)
--no-final-tracking
By default disable tracking operations that have no create/update/delete resource operations after them, which are most tracking operations, to speed up the release (default $WERF_NO_FINAL_TRACKING)
--no-notes
Don't show release notes at the end of the release (default $WERF_NO_NOTES)
--no-pod-logs
Disable Pod logs collection and printing (default $WERF_NO_POD_LOGS or false)
--no-remove-manual-changes
Don't remove fields added manually to the resource in the cluster if fields aren't present in the manifest (default $WERF_NO_REMOVE_MANUAL_CHANGES)
--quiet
Disable explanatory output (default $WERF_QUIET).
--release
Use specified Helm release name (default [[ project ]]-[[ env ]] template or deploy.helmRelease custom template from werf.yaml or $WERF_RELEASE)
--release-info-annotations
Add annotations to release metadata (default $WERF_RELEASE_INFO_ANNOTATIONS)
--release-label
Add Helm release labels (can specify multiple). Kind of labels depends or release storage driver. Format: labelName=labelValue. Also, can be specified with $WERF_RELEASE_LABEL_* (e.g. $WERF_RELEASE_LABEL_1=labelName1=labelValue1, $WERF_RELEASE_LABEL_2=labelName2=labelValue2)
--release-storage
How releases should be stored (default $WERF_RELEASE_STORAGE)
--release-storage-sql-connection
SQL Connection String for Helm SQL Storage (default $WERF_RELEASE_STORAGE_SQL_CONNECTION)
--releases-history-max
Max releases to keep in release storage ($WERF_RELEASES_HISTORY_MAX or 5 by default)
--revision
Revision number to rollback to (if not specified, rolls back to previous revision)
--rollback-graph-path
Save rollback graph path to the specified file (by default $WERF_ROLLBACK_GRAPH_PATH). Extension must be .dot or not specified. If extension not specified, then .dot is used
--rollback-report-path
Change rollback report path and format (by default $WERF_ROLLBACK_REPORT_PATH or ".werf-rollback-report.json" if not set). Extension must be .json for JSON format. If extension not specified, then .json is used
--runtime-annotations
Add annotations which will not trigger resource updates to all resources (default $WERF_RUNTIME_ANNOTATIONS)
--runtime-labels
Add labels which will not trigger resource updates to all resources (default $WERF_RUNTIME_LABELS)
--save-rollback-report
Save rollback report (by default $WERF_SAVE_ROLLBACK_REPORT or false). Its path and format configured with --rollback-report-path
--skip-tls-verify-kube
Skip TLS certificate validation when accessing a Kubernetes cluster (default $WERF_SKIP_TLS_VERIFY_KUBE)
--status-progress-period
Status progress period in seconds. Set -1 to stop showing status progress. Defaults to $WERF_STATUS_PROGRESS_PERIOD_SECONDS or 5 seconds
--timeout, -t
Resources tracking timeout in seconds ($WERF_TIMEOUT by default)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit run

Usage:

d8 delivery-kit run [options] [IMAGE_NAME] [-- COMMAND ARG...]

Run container for project image

Run container for specified project image from werf.yaml (build if needed).

Options

--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--annotate-layers-with-dm-verity-root-hash
Enable annotation of image layers with dm-verity root hash (default $WERF_ANNOTATE_LAYERS_WITH_DM_VERITY_ROOT_HASH)
--backend-network
Network mode for the build containers ($WERF_BACKEND_NETWORK or nothing by default)
--bash
Use predefined docker options and command for debug
--bsign-elf-files
Enable ELF files signing with bsign (default $WERF_BSIGN_ELF_FILES). When enabled, the private elf key must be specified with --elf-pgp-private-key-base64 or --elf-pgp-private-key-fingerprint option
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read and pull images from the specified repo
--docker-options
Define docker run options (default $WERF_DOCKER_OPTIONS)
--dry-run
Indicate what the command would do without actually doing that (default $WERF_DRY_RUN)
--elf-pgp-private-key-base64
Base64-encoded PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_BASE64)
--elf-pgp-private-key-fingerprint
PGP private key fingerprint (default $WERF_ELF_PGP_PRIVATE_KEY_FINGERPRINT)
--elf-pgp-private-key-passphrase
Passphrase for the PGP private key (default $WERF_ELF_PGP_PRIVATE_KEY_PASSPHRASE)
--env
Use specified environment (default $WERF_ENV)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--follow
Enable follow mode (default $WERF_FOLLOW). The mode allows restarting the command on a new commit. In development mode (--dev), werf restarts the command on any changes (including untracked files) in the git repository worktree
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-helm-dependencies
No-op
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--require-built-images, -Z
Requires all used images to be previously built and exist in repo. Exits with error if needed images are not cached and so require to run build instructions (default $WERF_REQUIRE_BUILT_IMAGES)
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--shell
Use predefined docker options and command for debug
--sign-cert
The leaf certificate as path to PEM file or base64-encoded PEM (default $WERF_SIGN_CERT)
--sign-elf-files
Enable ELF files signing (default $WERF_SIGN_ELF_FILES). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--sign-intermediates
The intermediate certificates as path to PEM file or base64-encoded PEM (default $WERF_SIGN_INTERMEDIATES)
--sign-key
The private signing key as path to PEM file, base64-encoded PEM or hashivault://[KEY] (default $WERF_SIGN_KEY)
--sign-manifest
Enable image manifest signing (default $WERF_SIGN_MANIFEST). When enabled, the private signing key must be specified with --sign-key option and the certificate must be specified with --sign-cert option
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)

d8 delivery-kit sbom

Usage:

d8 delivery-kit sbom [options]

Work with SBOM artifacts

d8 delivery-kit sbom get

Usage:

d8 delivery-kit sbom get [IMAGE_NAME] [options]

Get SBOM of an image

Get SBOM of an image that is described in werf.yaml and prints the result to stdout.

SBOM is stored as an OCI artifact attached to the container image in the container registry, so     
--repo is required.
If SBOM is not found, the command triggers werf build to generate one.

A specific version of the image may be selected with --tag or --digest; these flags are mutually    
exclusive.

Options

--allowed-backend-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE)
--allowed-backend-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_BACKEND_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-docker-storage-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of backend (Docker or Buildah) storage volume usage which will cause cleanup of least recently used local backend images (default 70% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE)
--allowed-docker-storage-volume-usage-margin
During cleanup of least recently used local backend (Docker or Buildah) images werf would delete images until volume usage becomes below "allowed-backend-storage-volume-usage - allowed-backend-storage-volume-usage-margin" level (default 5% or $WERF_ALLOWED_DOCKER_STORAGE_VOLUME_USAGE_MARGIN)
--allowed-local-cache-volume-usage
Set allowed percentage or absolute value (e.g. 10GB) of local cache (~/.werf/local_cache by default) volume usage which will cause cleanup of least recently used data from the local cache (default 70% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE)
--allowed-local-cache-volume-usage-margin
During cleanup of local cache werf would delete local cache data until volume usage becomes below "allowed-local-cache-volume-usage - allowed-local-cache-volume-usage-margin" level (default 5% or $WERF_ALLOWED_LOCAL_CACHE_VOLUME_USAGE_MARGIN)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--build-report-operations
Collect low-level operations statistics: add Operations and StageCache sections to the build report and print operations summary after the build (by default $WERF_BUILD_REPORT_OPERATIONS or false). Also enabled by --log-debug
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--digest
Digest of the image to get SBOM for (mutually exclusive with --tag)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--disable-auto-host-cleanup
Disable auto host cleanup procedure in main werf commands like werf-build, werf-converge and other (default disabled or WERF_DISABLE_AUTO_HOST_CLEANUP)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo and to pull base images
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--env
Use specified environment (default $WERF_ENV)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--introspect-before-error
Introspect failed stage in the clean state, before running all assembly instructions of the stage
--introspect-error
Introspect failed stage in the state, right after running failed assembly instruction
--introspect-stage
Introspect a specific stage. The option can be used multiple times to introspect several stages. There are the following formats to use: * specify IMAGE_NAME/STAGE_NAME to introspect stage STAGE_NAME of either image or artifact IMAGE_NAME * specify STAGE_NAME or */STAGE_NAME for the introspection of all existing stages with name STAGE_NAME IMAGE_NAME is the name of an image or artifact described in werf.yaml, the nameless image specified with ~. STAGE_NAME should be one of the following: from, beforeInstall, dependenciesBeforeInstall, gitArchive, install, dependenciesAfterInstall, beforeSetup, dependenciesBeforeSetup, setup, dependenciesAfterSetup, gitCache, gitLatestPatch, dockerInstructions, dockerfile, imageSpec
--kube-api-server
Kubernetes API server address (default $WERF_KUBE_API_SERVER)
--kube-auth-password
Basic auth password for Kubernetes API (default $WERF_KUBE_AUTH_PASSWORD)
--kube-auth-provider
Auth provider name for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER)
--kube-auth-provider-config
Auth provider config for authentication in Kubernetes API (default $WERF_KUBE_AUTH_PROVIDER_CONFIG)
--kube-auth-username
Basic auth username for Kubernetes API (default $WERF_KUBE_AUTH_USERNAME)
--kube-burst-limit
Kubernetes client burst limit (default $WERF_KUBE_BURST_LIMIT or 100)
--kube-ca-data
Pass Kubernetes API server TLS CA data (default $WERF_KUBE_CA_DATA)
--kube-ca-path
Kubernetes API server CA path (default $WERF_KUBE_CA_PATH)
--kube-cert
Path to PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT
--kube-cert-data
Pass PEM-encoded TLS client cert for connecting to Kubernetes API (default $WERF_KUBE_CERT_DATA)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--kube-context-cluster
Use cluster from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_CLUSTER)
--kube-context-user
Use user from Kubeconfig for current context (default $WERF_KUBE_CONTEXT_USER)
--kube-impersonate-group
Sets Impersonate-Group headers when authenticating in Kubernetes. Can be also set with $WERF_KUBE_IMPERSONATE_GROUP_* environment variables
--kube-impersonate-uid
Sets Impersonate-Uid header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_UID)
--kube-impersonate-user
Sets Impersonate-User header when authenticating in Kubernetes (default $WERF_KUBE_IMPERSONATE_USER)
--kube-key
Path to PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY)
--kube-key-data
Pass PEM-encoded TLS client key for connecting to Kubernetes API (default $WERF_KUBE_KEY_DATA)
--kube-proxy-url
Proxy URL to use for proxying all requests to Kubernetes API (default $WERF_KUBE_PROXY_URL)
--kube-qps-limit
Kubernetes client QPS limit (default $WERF_KUBE_QPS_LIMIT or 30)
--kube-request-timeout
Timeout for all requests to Kubernetes API (default $WERF_KUBE_REQUEST_TIMEOUT)
--kube-tls-server
Server name to use for Kubernetes API server certificate validation. If it is not provided, the hostname used to contact the server is used (default $WERF_KUBE_TLS_SERVER)
--kube-token
Kubernetes bearer token used for authentication (default $WERF_KUBE_TOKEN)
--kube-token-path
Path to file with bearer token for authentication in Kubernetes (default $WERF_KUBE_TOKEN_PATH)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--save-build-report
Save build report (by default $WERF_SAVE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-kube
Skip TLS certificate validation when accessing a Kubernetes cluster (default $WERF_SKIP_TLS_VERIFY_KUBE)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--ssh-key
Use only specific ssh key(s). Can be specified with $WERF_SSH_KEY_* (e.g. $WERF_SSH_KEY_REPO=~/.ssh/repo_rsa, $WERF_SSH_KEY_NODEJS=~/.ssh/nodejs_rsa). Defaults to $WERF_SSH_KEY_*, system ssh-agent or ~/.ssh/{id_rsa|id_dsa}
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tag
Content-based tag of the image to get SBOM for (mutually exclusive with --digest)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).
--virtual-merge
Enable virtual/ephemeral merge commit mode when building current application state ($WERF_VIRTUAL_MERGE by default)

d8 delivery-kit sbom merge

Usage:

d8 delivery-kit sbom merge [options]

Merge per-image SBOMs into a product-level SBOM

Merge per-image CycloneDX 1.6 SBOMs into a single product/module-level SBOM.

Takes a JSON mapping file (image name -> sha256 digest) as input, pulls per-image SBOMs from the    
container registry, and produces an aggregated SBOM with preserved dependency graphs.

Two ISPRAS-defined output formats are supported:
- "container": hierarchical — each image becomes a top-level container component with nested        
packages.
- "oss": flat — all packages from all images are merged into a deduplicated flat list.

GOST properties (attack_surface, security_function) are aggregated bottom-up using the "yes >       
indirect > no" precedence rule.

The flags --input, --ispras-format, --app-name, --app-version and --manufacturer are required. The  
merged SBOM is written to stdout unless --output is given.

Options

--app-name
Application/product name for the merged SBOM metadata
--app-version
Application/product version for the merged SBOM metadata
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to pull SBOM artifacts from the specified repo
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--input
Path to JSON mapping file (image name -> sha256:digest)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--ispras-format
ISPRAS SBOM format: "oss" or "container"
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--manufacturer
Manufacturer name for the merged SBOM metadata
--output, -o
Output file path (defaults to stdout)
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit sbom validate

Usage:

d8 delivery-kit sbom validate [options]

Validate SBOM file against ISPRAS schemas

Validate CycloneDX JSON SBOM files against ISPRAS schemas using sbom-checker.

The command runs sbom-checker inside a Docker container and reports validation results. Supports    
both OSS and container SBOM types.

The flags --path and --ispras-format are required. Repeat --path to validate several files in one   
run. Pass --check-vcs to additionally validate VCS URLs.

Options

--check-vcs
Enable VCS URL validation
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to pull the ISPRAS SBOM checker image
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--ispras-format
ISPRAS SBOM format: oss or container
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--path
Path to CycloneDX JSON SBOM file (repeatable)
--quiet
Disable explanatory output (default $WERF_QUIET).
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit slugify

Usage:

d8 delivery-kit slugify STRING [options]

Print slugged string by specified format.

Options

--debug
Enable debug (default $WERF_DEBUG).
--format, -f
r|helm-release: suitable for Helm Release ns|kubernetes-namespace: suitable for Kubernetes Namespace tag|docker-tag: suitable for Docker Tag
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--quiet
Disable explanatory output (default $WERF_QUIET).
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit stages

Usage:

d8 delivery-kit stages [options]

Work with werf stages

d8 delivery-kit stages copy

Usage:

d8 delivery-kit stages copy [options]

Copy stages between container registry and archive

Copy project stages between storages.

Supported copy scenarios:
	• Container registry to container registry
	• Container registry to archive
	• Archive to container registry

By default copies all project stages. Use --all=false to copy only stages relevant for the current  
git commit. This requires a working directory with git repository and performs build to identify    
current stages.

Note: this flag is ignored when copying from archive to container registry.

Options

--all
Copy all project stages (default: true). Use --all=false to copy stages for current build only. Note: this flag is ignored when copying from archive to container registry.
--allow-includes-update
Allow use includes latest versions (default $WERF_ALLOW_INCLUDES_UPDATE or false)
--backend-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_BACKEND_STORAGE_PATH)
--build-report-operations
Collect low-level operations statistics: add Operations and StageCache sections to the build report and print operations summary after the build (by default $WERF_BUILD_REPORT_OPERATIONS or false). Also enabled by --log-debug
--build-report-path
Change build report path and format (by default $WERF_BUILD_REPORT_PATH or ".werf-build-report.json" if not set). Extension must be either .json for JSON format or .env for env-file format. If extension not specified, then .json is used
--cache-repo
Specify one or multiple cache repos with images that will be used as a cache. Cache will be populated when pushing newly built images into the primary repo and when pulling existing images from the primary repo. Cache repo will be used to pull images and to get manifests before making requests to the primary repo. Also, can be specified with $WERF_CACHE_REPO_* (e.g. $WERF_CACHE_REPO_1=..., $WERF_CACHE_REPO_2=...)
--config
Use custom configuration file (default $WERF_CONFIG or werf.yaml in the project directory)
--config-render-path
Custom path for storing rendered configuration file
--config-templates-dir
Custom configuration templates directory (default $WERF_CONFIG_TEMPLATES_DIR or .werf in working directory)
--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--debug-templates
Enable debug mode for Go templates (default $WERF_DEBUG_TEMPLATES or false)
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--dir
Use specified project directory where project’s werf.yaml and other configuration files should reside (default $WERF_DIR or current working directory)
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repos
--docker-server-storage-path
Use specified path to the local backend (Docker or Buildah) storage to check backend storage volume usage while performing garbage collection of local backend images (detect local backend storage path by default or use $WERF_DOCKER_SERVER_STORAGE_PATH)
--env
Use specified environment (default $WERF_ENV)
--final-images-only
Process final images only ($WERF_FINAL_IMAGES_ONLY or false by default)
--final-repo
Container registry storage address (default $WERF_FINAL_REPO)
--final-repo-container-registry
Choose final-repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_FINAL_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--final-repo-docker-hub-password
final-repo Docker Hub password (default $WERF_FINAL_REPO_DOCKER_HUB_PASSWORD)
--final-repo-docker-hub-token
final-repo Docker Hub token (default $WERF_FINAL_REPO_DOCKER_HUB_TOKEN)
--final-repo-docker-hub-username
final-repo Docker Hub username (default $WERF_FINAL_REPO_DOCKER_HUB_USERNAME)
--final-repo-github-token
final-repo GitHub token (default $WERF_FINAL_REPO_GITHUB_TOKEN)
--final-repo-harbor-password
final-repo Harbor password (default $WERF_FINAL_REPO_HARBOR_PASSWORD)
--final-repo-harbor-username
final-repo Harbor username (default $WERF_FINAL_REPO_HARBOR_USERNAME)
--final-repo-quay-token
final-repo quay.io token (default $WERF_FINAL_REPO_QUAY_TOKEN)
--from
Source address to copy stages from. Use archive:PATH for stage archive or [docker://]REPO for container registry.
--git-work-tree
Use specified git work tree dir (default $WERF_WORK_TREE or lookup for directory that contains .git in the current or parent directories)
--giterminism-config
Custom path to the giterminism configuration file relative to working directory (default $WERF_GITERMINISM_CONFIG or werf-giterminism.yaml in working directory)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--introspect-before-error
Introspect failed stage in the clean state, before running all assembly instructions of the stage
--introspect-error
Introspect failed stage in the state, right after running failed assembly instruction
--introspect-stage
Introspect a specific stage. The option can be used multiple times to introspect several stages. There are the following formats to use: * specify IMAGE_NAME/STAGE_NAME to introspect stage STAGE_NAME of either image or artifact IMAGE_NAME * specify STAGE_NAME or */STAGE_NAME for the introspection of all existing stages with name STAGE_NAME IMAGE_NAME is the name of an image or artifact described in werf.yaml, the nameless image specified with ~. STAGE_NAME should be one of the following: from, beforeInstall, dependenciesBeforeInstall, gitArchive, install, dependenciesAfterInstall, beforeSetup, dependenciesBeforeSetup, setup, dependenciesAfterSetup, gitCache, gitLatestPatch, dockerInstructions, dockerfile, imageSpec
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--platform
Enable platform emulation when building images with werf, format: OS/ARCH[/VARIANT] ($WERF_PLATFORM or $DOCKER_DEFAULT_PLATFORM by default)
--project-name, -N
Set a specific project name (default $WERF_PROJECT_NAME)
--quiet
Disable explanatory output (default $WERF_QUIET).
--repo
Container registry storage address (default $WERF_REPO)
--repo-container-registry
Choose repo container registry implementation. The following container registries are supported: ecr, acr, default, dockerhub, gcr, github, gitlab, harbor, quay. Default $WERF_REPO_CONTAINER_REGISTRY or auto mode (detect container registry by repo address).
--repo-docker-hub-password
repo Docker Hub password (default $WERF_REPO_DOCKER_HUB_PASSWORD)
--repo-docker-hub-token
repo Docker Hub token (default $WERF_REPO_DOCKER_HUB_TOKEN)
--repo-docker-hub-username
repo Docker Hub username (default $WERF_REPO_DOCKER_HUB_USERNAME)
--repo-github-token
repo GitHub token (default $WERF_REPO_GITHUB_TOKEN)
--repo-harbor-password
repo Harbor password (default $WERF_REPO_HARBOR_PASSWORD)
--repo-harbor-username
repo Harbor username (default $WERF_REPO_HARBOR_USERNAME)
--repo-quay-token
repo quay.io token (default $WERF_REPO_QUAY_TOKEN)
--save-build-report
Save build report (by default $WERF_SAVE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--secondary-repo
Specify one or multiple secondary read-only repos with images that will be used as a cache. Also, can be specified with $WERF_SECONDARY_REPO_* (e.g. $WERF_SECONDARY_REPO_1=..., $WERF_SECONDARY_REPO_2=...)
--skip-image-spec-stage
Force skipping "imageSpec" build stage (default $WERF_SKIP_IMAGE_SPEC_STAGE or false)
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--synchronization, -S
Address of synchronizer for multiple werf processes to work with a single repo. Default: - $WERF_SYNCHRONIZATION, or - :local if --repo is not specified, or - https://delivery-sync.deckhouse.ru if --repo has been specified. The same address should be specified for all werf processes that work with a single repo. :local address allows execution of werf processes from a single host only
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--to
Destination address to copy stages to. Use archive:PATH for stage archive or [docker://]REPO for container registry.
--use-build-report
Use build report, previously saved with --save-build-report (by default $WERF_USE_BUILD_REPORT or false). Its path and format configured with --build-report-path
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit synchronization

Usage:

d8 delivery-kit synchronization [options]

Run synchronization server

Run synchronization server

Options

--debug
Enable debug (default $WERF_DEBUG).
--dev
Enable development mode (default $WERF_DEV). The mode allows working with project files without doing redundant commits during debugging and development
--dev-branch
Set dev git branch name (default $WERF_DEV_BRANCH or "_werf-dev")
--dev-ignore
Add rules to ignore tracked and untracked changes in development mode (can specify multiple). Also, can be specified with $WERF_DEV_IGNORE_* (e.g. $WERF_DEV_IGNORE_TESTS=*_test.go, $WERF_DEV_IGNORE_DOCS=path/to/docs)
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--host
Bind synchronization server to the specified host (default localhost or $WERF_HOST)
--kube-config
Kubernetes config file path (default $WERF_KUBE_CONFIG, or $WERF_KUBECONFIG, or $KUBECONFIG)
--kube-config-base64
Kubernetes config data as base64 string (default $WERF_KUBE_CONFIG_BASE64 or $WERF_KUBECONFIG_BASE64 or $KUBECONFIG_BASE64)
--kube-context
Kubernetes config context (default $WERF_KUBE_CONTEXT)
--kubernetes
Use kubernetes lock-manager stages-storage-cache (default $WERF_KUBERNETES)
--kubernetes-namespace-prefix
Use specified prefix for namespaces created for lock-manager and stages-storage-cache (defaults to 'werf-synchronization-' when --kubernetes option is used or $WERF_KUBERNETES_NAMESPACE_PREFIX)
--local
Use file lock-manager and file stages-storage-cache (true by default or $WERF_LOCAL)
--local-lock-manager-base-dir
Use specified directory as base for file lock-manager (~/.werf/synchronization_server/lock_manager by default or $WERF_LOCAL_LOCK_MANAGER_BASE_DIR)
--local-stages-storage-cache-base-dir
Use specified directory as base for file stages-storage-cache (~/.werf/synchronization_server/stages_storage_cache by default or $WERF_LOCAL_STAGES_STORAGE_CACHE_BASE_DIR)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--loose-giterminism
Loose werf giterminism mode restrictions
--port
Bind synchronization server to the specified port (default 55581 or $WERF_PORT)
--quiet
Disable explanatory output (default $WERF_QUIET).
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--ttl
Time to live for lock-manager locks and stages-storage-cache records (default $WERF_TTL)
--verbose
Enable verbose output (default $WERF_VERBOSE).

d8 delivery-kit verify

Usage:

d8 delivery-kit verify --image-ref <image-ref> [--image-ref <image-ref>...] --verify-roots=<root-ca.pem> [--verify-manifest] [--verify-elf-files] [options]

Verify images

Verify the integrity of built images by checking signatures of manifests and ELF files using        
specific image references.

The command outputs detailed logs about the verification process.

Options

--container-registry-mirror
(Buildah-only) Use specified mirrors for docker.io
--debug
Enable debug (default $WERF_DEBUG).
--docker-config
Specify docker config directory path. Default $WERF_DOCKER_CONFIG or $DOCKER_CONFIG or ~/.docker (in the order of priority) Command needs granted permissions to read, pull and push images into the specified repo, to pull base images
--home-dir
Use specified dir to store werf cache files and dirs (default $WERF_HOME or ~/.werf)
--image-ref
Verify only passed references (default $WERF_IMAGE_REF separated by comma)
--insecure-registry
Use plain HTTP requests when accessing a registry (default $WERF_INSECURE_REGISTRY)
--log-color-mode
Set log color mode. Supported on, off and auto (based on the stdout’s file descriptor referring to a terminal) modes. Default $WERF_LOG_COLOR_MODE or auto mode.
--log-debug
Enable debug (default $WERF_LOG_DEBUG).
--log-pretty
Enable emojis, auto line wrapping and log process border (default $WERF_LOG_PRETTY or true).
--log-project-dir
Print current project directory path (default $WERF_LOG_PROJECT_DIR)
--log-quiet
Disable explanatory output (default $WERF_LOG_QUIET).
--log-terminal-width
Set log terminal width. Defaults to: * $WERF_LOG_TERMINAL_WIDTH * interactive terminal width or 140
--log-time
Add time to log entries for precise event time tracking (default $WERF_LOG_TIME or false).
--log-time-format
Specify custom log time format (default $WERF_LOG_TIME_FORMAT or RFC3339 format).
--log-verbose
Enable verbose output (default $WERF_LOG_VERBOSE).
--parallel, -p
Run in parallel (default $WERF_PARALLEL or true)
--parallel-tasks-limit
Parallel tasks limit, set -1 to remove the limitation (default $WERF_PARALLEL_TASKS_LIMIT or 5)
--quiet
Disable explanatory output (default $WERF_QUIET).
--skip-tls-verify-registry
Skip TLS certificate validation when accessing a registry (default $WERF_SKIP_TLS_VERIFY_REGISTRY)
--tmp-dir
Use specified dir to store tmp files and dirs (default $WERF_TMP_DIR or system tmp dir)
--verbose
Enable verbose output (default $WERF_VERBOSE).
--verify-bsign-elf-files
Enable ELF files verification for bsign signed files (default $WERF_VERIFY_BSIGN_ELF_FILES).
--verify-elf-files
Enable ELF files verification (default $WERF_VERIFY_ELF_FILES). When enabled, the root certificates must be specified with --verify-roots option
--verify-manifest
Enable image manifest verification (default $WERF_VERIFY_MANIFEST). When enabled, the root certificates must be specified with --verify-roots option
--verify-roots
The root certificates as path to PEM file or base64-encoded PEM (default $WERF_VERIFY_ROOTS separated by comma)

d8 delivery-kit version

Usage:

d8 delivery-kit version [options]

Print version

d8 dist

Manage the d8 distribution: the deckhouse-cli binary and its plugins

Manage the d8 distribution - the deckhouse-cli binary and its plugins.

See the state of the distribution with 'd8 dist status': the d8 version, installed
plugins, and what is outdated.

Versions are served by the in-cluster registry-packages-proxy, authenticated by the
current kubeconfig identity.

Update the binary with 'd8 dist update'; manage plugins under 'd8 dist plugins'.

Environment variables:
  D8_RPP_ENDPOINT  registry-packages-proxy base URL (otherwise discovered from the cluster)
  D8_RPP_CA_FILE   PEM CA bundle to verify the proxy TLS certificate
  KUBECONFIG       path to the kubeconfig file

Options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.

d8 dist check

Usage:

d8 dist check [options]

Report whether a newer deckhouse-cli version is available

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.

d8 dist plugins

Usage:

d8 dist plugins [options]

Manage Deckhouse CLI plugins

Manage Deckhouse CLI plugins.

Plugins are pulled from the in-cluster registry-packages-proxy, authenticated by the
current kubeconfig identity.

Installing a plugin that is already present updates it: 'd8 dist plugins install <name>',
or 'd8 dist plugins install --all' for every installed plugin at once.

Environment variables:
  D8_PLUGINS_SKIP_CLUSTER_CHECKS=1  skip cluster-side plugin requirement checks
  DECKHOUSE_CLI_PATH                plugins directory (same as --plugins-dir)
  D8_RPP_ENDPOINT                   registry-packages-proxy base URL
  D8_RPP_CA_FILE                    PEM CA bundle for proxy TLS verification
  KUBECONFIG                        path to the kubeconfig file

Options

--insecure
Interact with the source registry over HTTP.
--license
Deckhouse license key. Shortcut for --source-login=license-token --source-password=. Defaults to $D8_MIRROR_LICENSE_TOKEN.
--plugins-dir
Path to the d8 plugins directory. Defaults to $DECKHOUSE_CLI_PATH.
--skip-cluster-checks
Skip enforcement of cluster-side plugin requirements (Kubernetes/Deckhouse/module versions) when the cluster is unreachable. Defaults to $D8_PLUGINS_SKIP_CLUSTER_CHECKS.
--source
Pull plugins directly from this registry repo instead of the registry-packages-proxy (bypasses the cluster).
--source-login
Source registry login. Defaults to $D8_MIRROR_SOURCE_LOGIN.
--source-password
Source registry password. Defaults to $D8_MIRROR_SOURCE_PASSWORD.
--tls-skip-verify
Disable TLS certificate validation for the source registry.

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.

d8 dist plugins contract

Usage:

d8 dist plugins contract <plugin-name> [options]

Show a plugin's contract

Show the latest published contract of a plugin: version, description and requirements.

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure
Interact with the source registry over HTTP.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--license
Deckhouse license key. Shortcut for --source-login=license-token --source-password=. Defaults to $D8_MIRROR_LICENSE_TOKEN.
--plugins-dir
Path to the d8 plugins directory. Defaults to $DECKHOUSE_CLI_PATH.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.
--skip-cluster-checks
Skip enforcement of cluster-side plugin requirements (Kubernetes/Deckhouse/module versions) when the cluster is unreachable. Defaults to $D8_PLUGINS_SKIP_CLUSTER_CHECKS.
--source
Pull plugins directly from this registry repo instead of the registry-packages-proxy (bypasses the cluster).
--source-login
Source registry login. Defaults to $D8_MIRROR_SOURCE_LOGIN.
--source-password
Source registry password. Defaults to $D8_MIRROR_SOURCE_PASSWORD.
--tls-skip-verify
Disable TLS certificate validation for the source registry.

d8 dist plugins install

Usage:

d8 dist plugins install <plugin-name> | --all [options]

Install or update Deckhouse CLI plugins

Install a plugin: the newest version compatible with this cluster by default,
an exact one with --version.

Installing a plugin that is already present updates it, so this is also how a
plugin is brought up to date; --all does that for every installed plugin at once,
each within its own current major.

Plugins this one depends on are installed/upgraded automatically. With --use-major
dependencies may also cross their own major to satisfy a constraint.

A version already on disk is activated by repointing the 'current' symlink -
no download. Plugin requirements are always checked before the switch.

Options

--all
Update every installed plugin instead of naming one, each within its own current major.
--force
Reinstall even if the selected version is already installed (re-pull + re-verify).
--use-major
Pin to a specific major version. By default an install stays within the installed plugin's major; pass this to cross majors (dependencies may cross theirs too).
--version
Exact version to install. Skips compatibility selection and may install a pre-release.

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure
Interact with the source registry over HTTP.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--license
Deckhouse license key. Shortcut for --source-login=license-token --source-password=. Defaults to $D8_MIRROR_LICENSE_TOKEN.
--plugins-dir
Path to the d8 plugins directory. Defaults to $DECKHOUSE_CLI_PATH.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.
--skip-cluster-checks
Skip enforcement of cluster-side plugin requirements (Kubernetes/Deckhouse/module versions) when the cluster is unreachable. Defaults to $D8_PLUGINS_SKIP_CLUSTER_CHECKS.
--source
Pull plugins directly from this registry repo instead of the registry-packages-proxy (bypasses the cluster).
--source-login
Source registry login. Defaults to $D8_MIRROR_SOURCE_LOGIN.
--source-password
Source registry password. Defaults to $D8_MIRROR_SOURCE_PASSWORD.
--tls-skip-verify
Disable TLS certificate validation for the source registry.

d8 dist plugins list

Usage:

d8 dist plugins list [options]

List Deckhouse CLI plugins

Show the plugins installed locally and, when the transport can enumerate
them, the plugins published in the registry and ready to install.

The published set is read from the tags of the plugins repository, where each
plugin has an image tagged with its name. Only direct registry access (--source)
reaches that repository: the registry-packages-proxy addresses plugins by exact
name and does not serve the plugins path, so over the proxy this half is
reported as unsupported rather than attempted.

Whatever cannot be resolved is reported in place rather than dropped: a plugin
whose versions cannot be read is still listed by name, and an unreachable
registry leaves the installed list intact.

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure
Interact with the source registry over HTTP.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--license
Deckhouse license key. Shortcut for --source-login=license-token --source-password=. Defaults to $D8_MIRROR_LICENSE_TOKEN.
--plugins-dir
Path to the d8 plugins directory. Defaults to $DECKHOUSE_CLI_PATH.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.
--skip-cluster-checks
Skip enforcement of cluster-side plugin requirements (Kubernetes/Deckhouse/module versions) when the cluster is unreachable. Defaults to $D8_PLUGINS_SKIP_CLUSTER_CHECKS.
--source
Pull plugins directly from this registry repo instead of the registry-packages-proxy (bypasses the cluster).
--source-login
Source registry login. Defaults to $D8_MIRROR_SOURCE_LOGIN.
--source-password
Source registry password. Defaults to $D8_MIRROR_SOURCE_PASSWORD.
--tls-skip-verify
Disable TLS certificate validation for the source registry.

d8 dist plugins remove

Aliases: uninstall, delete

Usage:

d8 dist plugins remove <plugin-name> [options]

Remove an installed plugin

Remove an installed plugin from disk.

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure
Interact with the source registry over HTTP.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--license
Deckhouse license key. Shortcut for --source-login=license-token --source-password=. Defaults to $D8_MIRROR_LICENSE_TOKEN.
--plugins-dir
Path to the d8 plugins directory. Defaults to $DECKHOUSE_CLI_PATH.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.
--skip-cluster-checks
Skip enforcement of cluster-side plugin requirements (Kubernetes/Deckhouse/module versions) when the cluster is unreachable. Defaults to $D8_PLUGINS_SKIP_CLUSTER_CHECKS.
--source
Pull plugins directly from this registry repo instead of the registry-packages-proxy (bypasses the cluster).
--source-login
Source registry login. Defaults to $D8_MIRROR_SOURCE_LOGIN.
--source-password
Source registry password. Defaults to $D8_MIRROR_SOURCE_PASSWORD.
--tls-skip-verify
Disable TLS certificate validation for the source registry.

d8 dist plugins remove all

Usage:

d8 dist plugins remove <plugin-name> all [options]

Remove all installed plugins

Remove all plugins from the Deckhouse CLI at once

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure
Interact with the source registry over HTTP.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--license
Deckhouse license key. Shortcut for --source-login=license-token --source-password=. Defaults to $D8_MIRROR_LICENSE_TOKEN.
--plugins-dir
Path to the d8 plugins directory. Defaults to $DECKHOUSE_CLI_PATH.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.
--skip-cluster-checks
Skip enforcement of cluster-side plugin requirements (Kubernetes/Deckhouse/module versions) when the cluster is unreachable. Defaults to $D8_PLUGINS_SKIP_CLUSTER_CHECKS.
--source
Pull plugins directly from this registry repo instead of the registry-packages-proxy (bypasses the cluster).
--source-login
Source registry login. Defaults to $D8_MIRROR_SOURCE_LOGIN.
--source-password
Source registry password. Defaults to $D8_MIRROR_SOURCE_PASSWORD.
--tls-skip-verify
Disable TLS certificate validation for the source registry.

d8 dist plugins versions

Usage:

d8 dist plugins versions <plugin-name> [options]

List all versions of a plugin

List all published versions of a plugin, newest first. The installed version is
marked, versions newer than it are highlighted.

A plugin is published one image per platform, so a release reaches the registry as
several tags. They are collapsed into one line per version, listing the platforms
that version was built for.

Versions are fetched by the plugin's name through the registry-packages-proxy, so no
catalog access is needed. Install a specific version with
'd8 dist plugins install <name> --version X' - a version already on disk is switched to
instantly, without a download.

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure
Interact with the source registry over HTTP.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--license
Deckhouse license key. Shortcut for --source-login=license-token --source-password=. Defaults to $D8_MIRROR_LICENSE_TOKEN.
--plugins-dir
Path to the d8 plugins directory. Defaults to $DECKHOUSE_CLI_PATH.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.
--skip-cluster-checks
Skip enforcement of cluster-side plugin requirements (Kubernetes/Deckhouse/module versions) when the cluster is unreachable. Defaults to $D8_PLUGINS_SKIP_CLUSTER_CHECKS.
--source
Pull plugins directly from this registry repo instead of the registry-packages-proxy (bypasses the cluster).
--source-login
Source registry login. Defaults to $D8_MIRROR_SOURCE_LOGIN.
--source-password
Source registry password. Defaults to $D8_MIRROR_SOURCE_PASSWORD.
--tls-skip-verify
Disable TLS certificate validation for the source registry.

d8 dist status

Usage:

d8 dist status [options]

Show the distribution status: the d8 version, plugins, what is outdated

Show the state of the d8 distribution: the running deckhouse-cli version and the
installed plugins, with update status from the registry-packages-proxy.

When the cluster is unreachable, prints the local data and a warning instead of failing.

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.

d8 dist update

Usage:

d8 dist update [options]

Update deckhouse-cli to the latest version

Options

--version
Exact version to install; downgrades are allowed (default: the latest).

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.

d8 dist use

Usage:

d8 dist use <version> [options]

Switch to a specific deckhouse-cli version (no download when it is installed locally)

Switch the d8 binary to the given version.

Versions live in the local store (~/.deckhouse-cli/cli/versions) and the active one is
selected by the store's 'current' symlink - the same layout plugins use. Switching to an
installed version repoints that symlink: instant, offline, no elevated privileges.
A version missing from the store is downloaded through the registry-packages-proxy first
(kubeconfig required) and stays installed afterwards.

The first switch migrates a plain-file install to the symlink layout; the original binary
is kept with a ".old" suffix.

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.

d8 dist versions

Alias: list

Usage:

d8 dist versions [options]

List deckhouse-cli versions available in the cluster registry

Global options

--context
Kubeconfig context to use. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements.
--insecure-skip-tls-verify
Skip TLS verification of both the Kubernetes API server and registry-packages-proxy certificates. For debugging only.
--kubeconfig, -k
Path to the kubeconfig file. Used to reach registry-packages-proxy and to enforce cluster-side plugin requirements. Defaults to $KUBECONFIG.
--rpp-ca-file
Path to a PEM CA bundle used to verify the registry-packages-proxy TLS certificate. Defaults to $D8_RPP_CA_FILE.
--rpp-endpoint
registry-packages-proxy base URL (e.g. https://master:4219). Discovered from the cluster when empty. Defaults to $D8_RPP_ENDPOINT.

d8 help

Help about any command

Help provides help for any command in the application.
Simply type d8 help [path to command] for full details.

d8 iam

Manage Deckhouse users, groups, and access grants

Manage Deckhouse identity and access: users, groups, and access grants.

 Subcommands: user    — local users (user-authn Dex): create/delete/reset-password/ reset2fa/lock/unlock. group   — local groups: create/delete and add-member/remove-member. access  — grant and revoke (current authz model). get     — show one user/group/rule with effective access and warnings. list    — list users/groups/rules with effective access.

 All subcommands accept the standard --kubeconfig / --context flags.

 © Flant JSC 2026

d8 iam access

Usage:

d8 iam access [options]

Grant or revoke access (current authz model)

Grant and revoke access in Deckhouse (current authz model).

 For inspecting existing rules and effective access (warnings, group cycles, manual rules), use the top-level "d8 iam get" / "d8 iam list".

 © Flant JSC 2026

Options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam access grant

Usage:

d8 iam access grant (user|group) NAME --access-level LEVEL [scope] [options]

Grant access to a user or group (current authz model)

Grant access to a user or group using the current authorization model.

 For users, the subject is resolved by reading User.spec.email from the cluster, because the current authz model requires email as the subject name when user-authn is used.

 Specify the scope via -n/--namespace OR --scope (mutually exclusive):

 -n/--namespace NS        AuthorizationRule per namespace. Repeat to target several namespaces. User, PrivilegedUser, Editor, Admin levels only. --scope cluster          ClusterAuthorizationRule, every namespace EXCEPT system ones (d8-*, kube-system). --scope all-namespaces   ClusterAuthorizationRule with matchAny: true. Covers ALL namespaces, including system ones. --scope labels=K=V[,...] ClusterAuthorizationRule with namespaceSelector.labelSelector.matchLabels.

 --allow-scale and --port-forwarding add capabilities to any scope.

 © Flant JSC 2026

Options

--access-level
Access level: User, PrivilegedUser, Editor, Admin, ClusterEditor, ClusterAdmin, SuperAdmin
--allow-scale
Allow scaling workloads
--dry-run
Print the resource(s) that would be created without applying
--namespace, -n
Target namespace(s) for namespaced grants (repeatable). Mutually exclusive with --scope
--output, -o
Output format: name|yaml|json
--port-forwarding
Allow port-forwarding
--scope
Cluster-wide scope: cluster | all-namespaces | labels=K=V[,K2=V2,...]. Mutually exclusive with -n/--namespace

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam access revoke

Usage:

d8 iam access revoke (user|group) NAME --access-level LEVEL [scope] [options]

Revoke a d8-managed access grant

Revoke access previously granted with "d8 iam access grant".

 The flags must match the original grant's scope/level — the d8-managed object name is derived from the canonical spec, so a mismatch yields a "not found" error rather than removing an unrelated rule.

 Only d8-managed objects (label app.kubernetes.io/managed-by=d8-cli) are affected. Manually maintained AuthorizationRules and ClusterAuthorizationRules are never touched; edit them with kubectl.

 © Flant JSC 2026

Options

--access-level
Access level to revoke
--allow-scale
Match grants with allow-scale enabled
--dry-run
Resolve and print the object(s) that would be deleted without touching the cluster
--namespace, -n
Target namespace(s). Mutually exclusive with --scope
--output, -o
Output format: name|yaml|json
--port-forwarding
Match grants with port-forwarding enabled
--scope
Cluster-wide scope: cluster | all-namespaces | labels=K=V[,K2=V2,...]. Mutually exclusive with -n/--namespace

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam get

Usage:

d8 iam get (user|group|rule) NAME [options]

Show a single Deckhouse IAM object

Show a single Deckhouse IAM object with its effective context.

 Subcommands: user<name> show effective access for a user (groups, grants, summary) group<name> show effective access for a group (members, grants, summary) rule REF      show one ClusterAuthorizationRule or AuthorizationRule

 Aliases users / groups / rules are accepted for symmetry with "d8 iam list".

 © Flant JSC 2026

Options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam get group

Alias: groups

Usage:

d8 iam get (user|group|rule) NAME group <name> [options]

Show detailed access for a specific group

Options

--output, -o
Output format: table|json|yaml

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam get rule

Alias: rules

Usage:

d8 iam get (user|group|rule) NAME rule REF [options]

Show a single CAR or AR with subjects, scope and reverse CR lookup

Options

--output, -o
Output format: text|json|yaml

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam get user

Alias: users

Usage:

d8 iam get (user|group|rule) NAME user <name> [options]

Show detailed access for a specific user

Options

--output, -o
Output format: table|json|yaml

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam group

Alias: groups

Usage:

d8 iam group [options]

Manage Deckhouse local groups (user-authn)

Manage Deckhouse local groups (user-authn).

 This command provides lifecycle operations for local Group CRs: Create, Delete, and membership management via add-member / remove-member.

 For viewing groups (single or list with effective access), use the top-level commands:

        d8 iam get group <name>
        d8 iam list groups
        
 © Flant JSC 2026

Options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam group add-member

Usage:

d8 iam group add-member GROUP [user|group] MEMBER [options]

Add a member (user or group) to a local group

Options

--create-group
Create the target group if it does not exist

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam group create

Usage:

d8 iam group create <name> [options]

Create a local group in Deckhouse

Options

--dry-run
Print the resource that would be created without applying
--output, -o
Output format: name|yaml|json

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam group delete

Usage:

d8 iam group delete <name> [options]

Delete a local group

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam group remove-member

Usage:

d8 iam group remove-member GROUP [user|group] MEMBER [options]

Remove a member (user or group) from a local group

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam list

Usage:

d8 iam list (users|groups|rules) [options]

List Deckhouse IAM objects

List Deckhouse IAM objects with their effective context.

 Subcommands: users   list every user with effective-access summary (groups, grants count, level) groups  list every group with effective-access summary (members, grants count, level) rules   list every ClusterAuthorizationRule and AuthorizationRule

 Aliases user / group / rule are accepted so both forms work as muscle memory.

 © Flant JSC 2026

Options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam list groups

Alias: group

Usage:

d8 iam list (users|groups|rules) groups [options]

List all groups with their effective access

Options

--output, -o
Output format: table|json

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam list rules

Alias: rule

Usage:

d8 iam list (users|groups|rules) rules [options]

List ClusterAuthorizationRules and AuthorizationRules

Options

--cluster
Only ClusterAuthorizationRules
--managed-only
Only rules managed by d8-cli (label app.kubernetes.io/managed-by=d8-cli)
--manual-only
Only rules NOT managed by d8-cli
--namespace, -n
Restrict to AuthorizationRules in these namespaces (repeatable). Implicitly disables CARs unless --cluster is also set.
--output, -o
Output format: table|json|yaml

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam list users

Alias: user

Usage:

d8 iam list (users|groups|rules) users [options]

List all users with their effective access

Options

--output, -o
Output format: table|json

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam user

Alias: userop

Usage:

d8 iam user [options]

Manage Deckhouse users (user-authn)

Manage Deckhouse local static users (user-authn).

 This command provides lifecycle operations for Dex local users: Create, Delete, ResetPassword, Reset2FA, Lock, Unlock.

 For viewing users (single or list with effective access), use the top-level commands:

        d8 iam get user <name>
        d8 iam list users
        
 © Flant JSC 2026

Options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam user create

Usage:

d8 iam user create <name> --email <email> [flags] [options]

Create a local static user in Deckhouse

Create a local static user in Deckhouse (User CR).

 The password can be provided interactively (--password-prompt), piped from stdin (--password-stdin), auto-generated (--generate-password), or supplied as a pre-computed bcrypt hash (--password-hash). If no password flag is given and stdin is a terminal, the command prompts interactively.

 When --generate-password is used, the password is shown exactly once on stderr.

 If the cluster has a password policy enabled, the user may be required to change the password on first login. If staticUsers2FA is enabled, the user will also need to enroll TOTP on first login.

 © Flant JSC 2026

Options

--create-groups
Create groups specified by --member-of if they do not exist
--dry-run
Print the resource that would be created without applying
--email
User email address (required, must be lowercase)
--generate-password
Auto-generate a strong password (shown once on stderr)
--member-of
Add user to these groups (repeatable)
--output, -o
Output format: name|yaml|json
--password-hash
Use a pre-computed bcrypt hash directly (must start with $2 and be a valid bcrypt cost)
--password-prompt
Read password interactively with hidden input
--password-stdin
Read password from stdin (for CI/pipelines)
--ttl
User time-to-live (e.g. 24h, 30m). Can only be set once; expireAt will not update on change.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam user delete

Usage:

d8 iam user delete <name> [options]

Delete a local static user

Delete a local static user from Deckhouse.

 The User CR is removed and, by default, the user is also removed from every local Group CR that lists them under spec.members. Pass --keep-memberships to leave the membership references in place (e.g. for audit retention or to re-create the user with the same memberships later).

 © Flant JSC 2026

Options

--keep-memberships
Do not remove the user from local Group spec.members; only delete the User CR

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam user lock

Usage:

d8 iam user lock <username> <lockDuration> [options]

Lock local user in Dex for a period of time

Lock local user in Dex for a period of time.

The lockDuration argument must be a duration string (e.g. 30s, 10m, 1h).

Options

--timeout
How long to wait for completion when --wait is enabled.
--wait
Wait for UserOperation completion and print result.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam user reset-password

Alias: resetpass

Usage:

d8 iam user reset-password <username> [options]

Reset local user's password in Dex

Reset a local static user's password in Dex.

 The new password is read from one of:

 --password-prompt          (default if stdin is a terminal) --password-stdin           (echo "newpw" | d8 iam user reset-password ...) --generate-password        (auto-generate, shown once on stderr) --password-hash STRING     (pre-computed bcrypt hash, must start with $2)

 This is the same flag layout as 'd8 iam user create', so muscle memory and shell autocompletion transfer between the two commands.

 Internally a UserOperation of type ResetPassword is created with the raw bcrypt hash in spec.resetPassword.newPasswordHash. The user-authn hook validates the prefix and bcrypt.Cost, base64-encodes the hash, and applies it to the Dex Password CR. We never write the plaintext to the API.

 © Flant JSC 2026

Options

--generate-password
Auto-generate a strong password (shown once on stderr)
--password-hash
Use a pre-computed bcrypt hash directly (must start with $2 and be a valid bcrypt cost)
--password-prompt
Read password interactively with hidden input
--password-stdin
Read password from stdin (for CI/pipelines)
--timeout
How long to wait for completion when --wait is enabled.
--wait
Wait for UserOperation completion and print result.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam user reset2fa

Usage:

d8 iam user reset2fa <username> [options]

Reset local user's 2FA (TOTP) in Dex

Reset local user's 2FA (TOTP) in Dex.

This requests a UserOperation of type Reset2FA and waits for completion by default.

Options

--timeout
How long to wait for completion when --wait is enabled.
--wait
Wait for UserOperation completion and print result.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 iam user unlock

Usage:

d8 iam user unlock <username> [options]

Unlock local user in Dex

Unlock local user in Dex.

This requests a UserOperation of type Unlock and waits for completion by default.

Options

--timeout
How long to wait for completion when --wait is enabled.
--wait
Wait for UserOperation completion and print result.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 k

Alias: kubectl

kubectl controls the Kubernetes cluster manager

kubectl controls the Kubernetes cluster manager.

 Find more information at: https://kubernetes.io/docs/reference/kubectl/

Options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k alpha

Usage:

d8 k alpha [options]

Commands for features in alpha

These commands correspond to alpha features that are not enabled in Kubernetes clusters by default.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k annotate

Usage:

d8 k annotate [--overwrite] (-f FILENAME | TYPE NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--resource-version=version] [options]

Update the annotations on a resource

Update the annotations on one or more resources.

 All Kubernetes objects support the ability to store additional data with the object as annotations. Annotations are key/value pairs that can be larger than labels and include arbitrary string values such as structured JSON. Tools and system extensions may use annotations to store their own data.

 Attempting to set an annotation that already exists will fail unless --overwrite is set. If --resource-version is specified and does not match the current resource version on the server the command will fail.

Use "kubectl api-resources" for a complete list of supported resources.

Options

--all
Select all resources, in the namespace of the specified resource types.
--all-namespaces, -A
If true, check the specified action in all namespaces.
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--field-selector
Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.
--filename, -f
Filename, directory, or URL to files identifying the resource to update the annotation
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--list
If true, display the annotations for a given resource.
--local
If true, annotation will NOT contact api-server but run locally.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--overwrite
If true, allow annotations to be overwritten, otherwise reject annotation updates that overwrite existing annotations.
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--resource-version
If non-empty, the annotation update will only succeed if this is the current resource-version for the object. Only valid when specifying a single resource.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k api-resources

Usage:

d8 k api-resources [options]

Print the supported API resources on the server

Print the supported API resources on the server.

Options

--api-group
Limit to resources in the specified API group.
--cached
Use the cached list of resources if available.
--categories
Limit to resources that belong to the specified categories.
--namespaced
If false, non-namespaced resources will be returned, otherwise returning namespaced resources by default.
--no-headers
When using the default or custom-column output format, don't print headers (default print headers).
--output, -o
Output format. One of: (json, yaml, name, wide).
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--sort-by
If non-empty, sort list of resources using specified field. The field can be either 'name' or 'kind'.
--verbs
Limit to resources that support the specified verbs.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k api-versions

Usage:

d8 k api-versions [options]

Print the supported API versions on the server, in the form of "group/version"

Print the supported API versions on the server, in the form of "group/version".

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k apply

Usage:

d8 k apply (-f FILENAME | -k DIRECTORY) [options]

Apply a configuration to a resource by file name or stdin

Apply a configuration to a resource by file name or stdin. The resource name must be specified. This resource will be created if it doesn't exist yet. To use 'apply', always create the resource initially with either 'apply' or 'create --save-config'.

 JSON and YAML formats are accepted.

 Alpha Disclaimer: the --prune functionality is not yet complete. Do not use unless you are aware of what the current state is. See https://issues.k8s.io/34274.

Options

--all
Select all resources in the namespace of the specified resource types.
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--cascade
Must be "background", "orphan", or "foreground". Selects the deletion cascading strategy for the dependents (e.g. Pods created by a ReplicationController). Defaults to background.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
The files that contain the configurations to apply.
--force
If true, immediately remove resources from API and bypass graceful deletion. Note that immediate deletion of some resources may result in inconsistency or data loss and requires confirmation.
--force-conflicts
If true, server-side apply will force the changes against conflicts.
--grace-period
Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. Set to 1 for immediate shutdown. Can only be set to 0 when --force is true (force deletion).
--kustomize, -k
Process a kustomization directory. This flag can't be used together with -f or -R.
--openapi-patch
If true, use openapi to calculate diff when the openapi presents and the resource can be found in the openapi spec. Otherwise, fall back to use baked-in types.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--overwrite
Automatically resolve conflicts between the modified and live configuration by using values from the modified configuration
--prune
Automatically delete resource objects, that do not appear in the configs and are created by either apply or create --save-config. Should be used with either -l or --all.
--prune-allowlist
Overwrite the default allowlist with for --prune
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--server-side
If true, apply runs in the server instead of the client.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--subresource
If specified, apply will operate on the subresource of the requested object. Only allowed when using --server-side.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--timeout
The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.
--wait
If true, wait for resources to be gone before returning. This waits for finalizers.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k apply edit-last-applied

Usage:

d8 k apply (-f FILENAME | -k DIRECTORY) edit-last-applied (RESOURCE/NAME | -f FILENAME) [options]

Edit latest last-applied-configuration annotations of a resource/object

Edit the latest last-applied-configuration annotations of resources from the default editor.

 The edit-last-applied command allows you to directly edit any API resource you can retrieve via the command-line tools. It will open the editor defined by your KUBE_EDITOR, or EDITOR environment variables, or fall back to 'vi' for Linux or 'notepad' for Windows. You can edit multiple objects, although changes are applied one at a time. The command accepts file names as well as command-line arguments, although the files you point to must be previously saved versions of resources.

 The default format is YAML. To edit in JSON, specify "-o json".

 The flag --windows-line-endings can be used to force Windows line endings, otherwise the default for your operating system will be used.

 In the event an error occurs while updating, a temporary file will be created on disk that contains your unapplied changes. The most common error when updating a resource is another editor changing the resource on the server. When this occurs, you will have to apply your changes to the newer version of the resource, or update your temporary saved copy to include the latest resource version.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files to use to edit the resource
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.
--windows-line-endings
Defaults to the line ending native to your platform.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k apply set-last-applied

Usage:

d8 k apply (-f FILENAME | -k DIRECTORY) set-last-applied -f FILENAME [options]

Set the last-applied-configuration annotation on a live object to match the contents of a file

Set the latest last-applied-configuration annotations by setting it to match the contents of a file. This results in the last-applied-configuration being updated as though 'kubectl apply -f<file> ' was run, without updating any other parts of the object.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--create-annotation
Will create 'last-applied-configuration' annotations if current objects doesn't have one
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--filename, -f
Filename, directory, or URL to files that contains the last-applied-configuration annotations
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k apply view-last-applied

Usage:

d8 k apply (-f FILENAME | -k DIRECTORY) view-last-applied (TYPE [NAME | -l label] | TYPE/NAME | -f FILENAME) [options]

View the latest last-applied-configuration annotations of a resource/object

View the latest last-applied-configuration annotations by type/name or file.

 The default output will be printed to stdout in YAML format. You can use the -o option to change the output format.

Options

--all
Select all resources in the namespace of the specified resource types
--filename, -f
Filename, directory, or URL to files that contains the last-applied-configuration annotations
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. Must be one of (yaml, json)
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k attach

Usage:

d8 k attach (POD | TYPE/NAME) -c CONTAINER [options]

Attach to a running container

Attach to a process that is already running inside an existing container.

Options

--container, -c
Container name. If omitted, use the kubectl.kubernetes.io/default-container annotation for selecting the container to be attached or the first container in the pod will be chosen
--pod-running-timeout
The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running
--quiet, -q
Only print output from the remote session
--stdin, -i
Pass stdin to the container
--tty, -t
Stdin is a TTY

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k auth

Usage:

d8 k auth [options]

Inspect authorization

Inspect authorization.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k auth can-i

Usage:

d8 k auth can-i VERB [TYPE | TYPE/NAME | NONRESOURCEURL] [options]

Check whether an action is allowed

Check whether an action is allowed.

 VERB is a logical Kubernetes API verb like 'get', 'list', 'watch', 'delete', etc. TYPE is a Kubernetes resource. Shortcuts and groups will be resolved. NONRESOURCEURL is a partial URL that starts with "/". NAME is the name of a particular Kubernetes resource. This command pairs nicely with impersonation. See --as global flag.

Options

--all-namespaces, -A
If true, check the specified action in all namespaces.
--list
If true, prints all allowed actions.
--no-headers
If true, prints allowed actions without headers
--quiet, -q
If true, suppress output and just return the exit code.
--subresource
SubResource such as pod/log or deployment/scale

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k auth reconcile

Usage:

d8 k auth reconcile -f FILENAME [options]

Reconciles rules for RBAC role, role binding, cluster role, and cluster role binding objects

Reconciles rules for RBAC role, role binding, cluster role, and cluster role binding objects.

 Missing objects are created, and the containing namespace is created for namespaced objects, if required.

 Existing roles are updated to include the permissions in the input objects, and remove extra permissions if --remove-extra-permissions is specified.

 Existing bindings are updated to include the subjects in the input objects, and remove extra subjects if --remove-extra-subjects is specified.

 This is preferred to 'apply' for RBAC resources so that semantically-aware merging of rules and subjects is done.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--filename, -f
Filename, directory, or URL to files identifying the resource to reconcile.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--remove-extra-permissions
If true, removes extra permissions added to roles
--remove-extra-subjects
If true, removes extra subjects added to rolebindings
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k auth whoami

Usage:

d8 k auth whoami [options]

Experimental: Check self subject attributes

Experimental: Check who you are and your attributes (groups, extra).

        This command is helpful to get yourself aware of the current user attributes,
        especially when dynamic authentication, e.g., token webhook, auth proxy, or OIDC provider,
        is enabled in the Kubernetes cluster.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k autoscale

Usage:

d8 k autoscale (-f FILENAME | TYPE NAME | TYPE/NAME) [--min=MINPODS] --max=MAXPODS [--cpu=CPU] [--memory=MEMORY] [options]

Auto-scale a deployment, replica set, stateful set, or replication controller

Creates an autoscaler that automatically chooses and sets the number of pods that run in a Kubernetes cluster. The command will attempt to use the autoscaling/v2 API first, in case of an error, it will fall back to autoscaling/v1 API.

 Looks up a deployment, replica set, stateful set, or replication controller by name and creates an autoscaler that uses the given resource as a reference. An autoscaler can automatically increase or decrease number of pods deployed within the system as needed.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--cpu
Target CPU utilization over all the pods. When specified as a percentage (e.g."70%" for 70% of requested CPU) it will target average utilization. When specified as quantity (e.g."500m" for 500 milliCPU) it will target average value. Value without units is treated as a quantity with miliCPU being the unit (e.g."500" is "500m").
--cpu-percent
The target average CPU utilization (represented as a percent of requested CPU) over all the pods. If it's not specified or negative, a default autoscaling policy will be used.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files identifying the resource to autoscale.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--max
The upper limit for the number of pods that can be set by the autoscaler. Required.
--memory
Target memory utilization over all the pods. When specified as a percentage (e.g."60%" for 60% of requested memory) it will target average utilization. When specified as quantity (e.g."200Mi" for 200 MiB, "1Gi" for 1 GiB) it will target average value. Value without units is treated as a quantity with mebibytes being the unit (e.g."200" is "200Mi").
--min
The lower limit for the number of pods that can be set by the autoscaler. If it's not specified or negative, the server will apply a default value.
--name
The name for the newly created object. If not specified, the name of the input resource will be used.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k certificate

Usage:

d8 k certificate SUBCOMMAND [options]

Modify certificate resources

Modify certificate resources.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k certificate approve

Usage:

d8 k certificate SUBCOMMAND approve (-f FILENAME | NAME) [options]

Approve a certificate signing request

Approve a certificate signing request.

 kubectl certificate approve allows a cluster admin to approve a certificate signing request (CSR). This action tells a certificate signing controller to issue a certificate to the requester with the attributes requested in the CSR.

 SECURITY NOTICE: Depending on the requested attributes, the issued certificate can potentially grant a requester access to cluster resources or to authenticate as a requested identity. Before approving a CSR, ensure you understand what the signed certificate can do.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--filename, -f
Filename, directory, or URL to files identifying the resource to update
--force
Update the CSR even if it is already approved.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k certificate deny

Usage:

d8 k certificate SUBCOMMAND deny (-f FILENAME | NAME) [options]

Deny a certificate signing request

Deny a certificate signing request.

 kubectl certificate deny allows a cluster admin to deny a certificate signing request (CSR). This action tells a certificate signing controller to not to issue a certificate to the requester.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--filename, -f
Filename, directory, or URL to files identifying the resource to update
--force
Update the CSR even if it is already denied.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k cluster-info

Usage:

d8 k cluster-info [options]

Display cluster information

Display addresses of the control plane and services with label kubernetes.io/cluster-service=true. To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k cluster-info dump

Usage:

d8 k cluster-info dump [options]

Dump relevant information for debugging and diagnosis

Dump cluster information out suitable for debugging and diagnosing cluster problems.  By default, dumps everything to stdout. You can optionally specify a directory with --output-directory.  If you specify a directory, Kubernetes will build a set of files in that directory.  By default, only dumps things in the current namespace and 'kube-system' namespace, but you can switch to a different namespace with the --namespaces flag, or specify --all-namespaces to dump all namespaces.

 The command also dumps the logs of all of the pods in the cluster; these logs are dumped into different directories based on namespace and pod name.

Options

--all-namespaces, -A
If true, dump all namespaces. If true, --namespaces is ignored.
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--namespaces
A comma separated list of namespaces to dump.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--output-directory
Where to output the files. If empty or '-' uses stdout, otherwise creates a directory hierarchy in that directory
--pod-running-timeout
The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k completion

Usage:

d8 k completion SHELL [options]

Output shell completion code for the specified shell (bash, zsh, fish, or powershell)

Output shell completion code for the specified shell (bash, zsh, fish, or powershell). The shell code must be evaluated to provide interactive completion of kubectl commands.  This can be done by sourcing it from the .bash_profile.

 Detailed instructions on how to do this are available here:

        for macOS:
        https://kubernetes.io/docs/tasks/tools/install-kubectl-macos/#enable-shell-autocompletion
        
        for linux:
        https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/#enable-shell-autocompletion
        
        for windows:
        https://kubernetes.io/docs/tasks/tools/install-kubectl-windows/#enable-shell-autocompletion
        
 Note for zsh users: [1] zsh completions are only supported in versions of zsh >= 5.2.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config

Usage:

d8 k config SUBCOMMAND [options]

Modify kubeconfig files

Modify kubeconfig files using subcommands like "kubectl config set current-context my-context".

 The loading order follows these rules:

  1.  If the --kubeconfig flag is set, then only that file is loaded. The flag may only be set once and no merging takes place.
  2.  If $KUBECONFIG environment variable is set, then it is used as a list of paths (normal path delimiting rules for your system). These paths are merged. When a value is modified, it is modified in the file that defines the stanza. When a value is created, it is created in the first file that exists. If no files in the chain exist, then it creates the last file in the list.
  3.  Otherwise, ${HOME}/.kube/config is used and no merging takes place.

Options

--kubeconfig
use a particular kubeconfig file

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config current-context

Usage:

d8 k config SUBCOMMAND current-context [options]

Display the current-context

Display the current-context.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config delete-cluster

Usage:

d8 k config SUBCOMMAND delete-cluster NAME [options]

Delete the specified cluster from the kubeconfig

Delete the specified cluster from the kubeconfig.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config delete-context

Usage:

d8 k config SUBCOMMAND delete-context NAME [options]

Delete the specified context from the kubeconfig

Delete the specified context from the kubeconfig.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config delete-user

Usage:

d8 k config SUBCOMMAND delete-user NAME [options]

Delete the specified user from the kubeconfig

Delete the specified user from the kubeconfig.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config get-clusters

Usage:

d8 k config SUBCOMMAND get-clusters [options]

Display clusters defined in the kubeconfig

Display clusters defined in the kubeconfig.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config get-contexts

Usage:

d8 k config SUBCOMMAND get-contexts [(-o|--output=)name)] [options]

Describe one or many contexts

Display one or many contexts from the kubeconfig file.

Options

--no-headers
When using the default or custom-column output format, don't print headers (default print headers).
--output, -o
Output format. One of: (name).

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config get-users

Usage:

d8 k config SUBCOMMAND get-users [options]

Display users defined in the kubeconfig

Display users defined in the kubeconfig.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config rename-context

Usage:

d8 k config SUBCOMMAND rename-context CONTEXT_NAME NEW_NAME [options]

Rename a context from the kubeconfig file

Renames a context from the kubeconfig file.

 CONTEXT_NAME is the context name that you want to change.

 NEW_NAME is the new name you want to set.

 Note: If the context being renamed is the 'current-context', this field will also be updated.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config set

Usage:

d8 k config SUBCOMMAND set PROPERTY_NAME PROPERTY_VALUE [options]

Set an individual value in a kubeconfig file

Set an individual value in a kubeconfig file.

 PROPERTY_NAME is a dot delimited name where each token represents either an attribute name or a map key.  Map keys may not contain dots.

 PROPERTY_VALUE is the new value you want to set. Binary fields such as 'certificate-authority-data' expect a base64 encoded string unless the --set-raw-bytes flag is used.

 Specifying an attribute name that already exists will merge new fields on top of existing values.

Options

--set-raw-bytes
When writing a []byte PROPERTY_VALUE, write the given string directly without base64 decoding.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config set-cluster

Usage:

d8 k config SUBCOMMAND set-cluster NAME [--server=server] [--certificate-authority=path/to/certificate/authority] [--insecure-skip-tls-verify=true] [--tls-server-name=example.com] [options]

Set a cluster entry in kubeconfig

Set a cluster entry in kubeconfig.

 Specifying a name that already exists will merge new fields on top of existing values for those fields.

Options

--certificate-authority
Path to certificate-authority file for the cluster entry in kubeconfig
--embed-certs
embed-certs for the cluster entry in kubeconfig
--insecure-skip-tls-verify
insecure-skip-tls-verify for the cluster entry in kubeconfig
--proxy-url
proxy-url for the cluster entry in kubeconfig
--server
server for the cluster entry in kubeconfig
--tls-server-name
tls-server-name for the cluster entry in kubeconfig

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config set-context

Usage:

d8 k config SUBCOMMAND set-context [NAME | --current] [--cluster=cluster_nickname] [--user=user_nickname] [--namespace=namespace] [options]

Set a context entry in kubeconfig

Set a context entry in kubeconfig.

 Specifying a name that already exists will merge new fields on top of existing values for those fields.

Options

--cluster
cluster for the context entry in kubeconfig
--current
Modify the current context
--namespace
namespace for the context entry in kubeconfig
--user
user for the context entry in kubeconfig

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config set-credentials

Usage:

d8 k config SUBCOMMAND set-credentials NAME [--client-certificate=path/to/certfile] [--client-key=path/to/keyfile] [--token=bearer_token] [--username=basic_user] [--password=basic_password] [--auth-provider=provider_name] [--auth-provider-arg=key=value] [--exec-command=exec_command] [--exec-api-version=exec_api_version] [--exec-arg=arg] [--exec-env=key=value] [options]

Set a user entry in kubeconfig

Set a user entry in kubeconfig.

 Specifying a name that already exists will merge new fields on top of existing values.

        Client-certificate flags:
        --client-certificate=certfile --client-key=keyfile
        
        Bearer token flags:
        --token=bearer_token
        
        Basic auth flags:
        --username=basic_user --password=basic_password
        
 Bearer token and basic auth are mutually exclusive.

Options

--auth-provider
Auth provider for the user entry in kubeconfig
--auth-provider-arg
'key=value' arguments for the auth provider
--client-certificate
Path to client-certificate file for the user entry in kubeconfig
--client-key
Path to client-key file for the user entry in kubeconfig
--embed-certs
Embed client cert/key for the user entry in kubeconfig
--exec-api-version
API version of the exec credential plugin for the user entry in kubeconfig
--exec-arg
New arguments for the exec credential plugin command for the user entry in kubeconfig
--exec-command
Command for the exec credential plugin for the user entry in kubeconfig
--exec-env
'key=value' environment values for the exec credential plugin
--exec-interactive-mode
InteractiveMode of the exec credentials plugin for the user entry in kubeconfig
--exec-provide-cluster-info
ProvideClusterInfo of the exec credentials plugin for the user entry in kubeconfig
--password
password for the user entry in kubeconfig
--token
token for the user entry in kubeconfig
--username
username for the user entry in kubeconfig

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--user
The name of the kubeconfig user to use
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config unset

Usage:

d8 k config SUBCOMMAND unset PROPERTY_NAME [options]

Unset an individual value in a kubeconfig file

Unset an individual value in a kubeconfig file.

 PROPERTY_NAME is a dot delimited name where each token represents either an attribute name or a map key.  Map keys may not contain dots.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config use-context

Alias: use

Usage:

d8 k config SUBCOMMAND use-context CONTEXT_NAME [options]

Set the current-context in a kubeconfig file

Set the current-context in a kubeconfig file.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k config view

Usage:

d8 k config SUBCOMMAND view [options]

Display merged kubeconfig settings or a specified kubeconfig file

Display merged kubeconfig settings or a specified kubeconfig file.

 You can use --output jsonpath={...} to extract specific values using a jsonpath expression.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--flatten
Flatten the resulting kubeconfig file into self-contained output (useful for creating portable kubeconfig files)
--merge
Merge the full hierarchy of kubeconfig files
--minify
Remove all information not used by current-context from the output
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--raw
Display raw byte data and sensitive data
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
use a particular kubeconfig file
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k cordon

Usage:

d8 k cordon NODE [options]

Mark node as unschedulable

Mark node as unschedulable.

Options

--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k cp

Usage:

d8 k cp <file-spec-src> <file-spec-dest> [options]

Copy files and directories to and from containers

Copy files and directories to and from containers.

Options

--container, -c
Container name. If omitted, use the kubectl.kubernetes.io/default-container annotation for selecting the container to be attached or the first container in the pod will be chosen
--no-preserve
The copied file/directory's ownership and permissions will not be preserved in the container
--retries
Set number of retries to complete a copy operation from a container. Specify 0 to disable or any negative value for infinite retrying. The default is 0 (no retry).

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create

Usage:

d8 k create -f FILENAME [options]

Create a resource from a file or from stdin

Create a resource from a file or from stdin.

 JSON and YAML formats are accepted.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--edit
Edit the API resource before creating
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files to use to create the resource
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--raw
Raw URI to POST to the server. Uses the transport specified by the kubeconfig file.
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.
--windows-line-endings
Only relevant if --edit=true. Defaults to the line ending native to your platform.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create clusterrole

Usage:

d8 k create -f FILENAME clusterrole NAME --verb=verb --resource=resource.group [--resource-name=resourcename] [--dry-run=server|client|none] [options]

Create a cluster role

Create a cluster role.

Options

--aggregation-rule
An aggregation label selector for combining ClusterRoles.
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--non-resource-url
A partial url that user should have access to.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--resource
Resource that the rule applies to
--resource-name
Resource in the white list that the rule applies to, repeat this flag for multiple items
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.
--verb
Verb that applies to the resources contained in the rule

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create clusterrolebinding

Usage:

d8 k create -f FILENAME clusterrolebinding NAME --clusterrole=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none] [options]

Create a cluster role binding for a particular cluster role

Create a cluster role binding for a particular cluster role.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--clusterrole
ClusterRole this ClusterRoleBinding should reference
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--group
Groups to bind to the clusterrole. The flag can be repeated to add multiple groups.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--serviceaccount
Service accounts to bind to the clusterrole, in the format :. The flag can be repeated to add multiple service accounts.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--user
Usernames to bind to the clusterrole. The flag can be repeated to add multiple users.
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create configmap

Alias: cm

Usage:

d8 k create -f FILENAME configmap NAME [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none] [options]

Create a config map from a local file, directory or literal value

Create a config map based on a file, directory, or specified literal value.

 A single config map may package one or more key/value pairs.

 When creating a config map based on a file, the key will default to the basename of the file, and the value will default to the file content.  If the basename is an invalid key, you may specify an alternate key.

 When creating a config map based on a directory, each file whose basename is a valid key in the directory will be packaged into the config map.  Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--append-hash
Append a hash of the configmap to its name.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--from-env-file
Specify the path to a file to read lines of key=val pairs to create a configmap.
--from-file
Key file can be specified using its file path, in which case file basename will be used as configmap key, or optionally with a key and file path, in which case the given key will be used. Specifying a directory will iterate each named file in the directory whose basename is a valid configmap key.
--from-literal
Specify a key and literal value to insert in configmap (i.e. mykey=somevalue)
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create cronjob

Alias: cj

Usage:

d8 k create -f FILENAME cronjob NAME --image=image --schedule='0/5 * * * ?' -- [COMMAND] [args...] [options]

Create a cron job with the specified name

Create a cron job with the specified name.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--image
Image name to run.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--restart
job's restart policy. supported values: OnFailure, Never
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--schedule
A schedule in the Cron format the job should be run with.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create deployment

Alias: deploy

Usage:

d8 k create -f FILENAME deployment NAME --image=image -- [COMMAND] [args...] [options]

Create a deployment with the specified name

Create a deployment with the specified name.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--image
Image names to run. A deployment can have multiple images set for multi-container pod.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--port
The containerPort that this deployment exposes.
--replicas, -r
Number of replicas to create. Default is 1.
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create ingress

Alias: ing

Usage:

d8 k create -f FILENAME ingress NAME --rule=host/path=service:port[,tls[=secret]]  [options]

Create an ingress with the specified name

Create an ingress with the specified name.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--annotation
Annotation to insert in the ingress object, in the format annotation=value
--class
Ingress Class to be used
--default-backend
Default service for backend, in format of svcname:port
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--rule
Rule in format host/path=service:port[,tls=secretname]. Paths containing the leading character '*' are considered pathType=Prefix. tls argument is optional.
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create job

Usage:

d8 k create -f FILENAME job NAME --image=image [--from=cronjob/name] -- [COMMAND] [args...] [options]

Create a job with the specified name

Create a job with the specified name.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--from
The name of the resource to create a Job from (only cronjob is supported).
--image
Image name to run.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create namespace

Alias: ns

Usage:

d8 k create -f FILENAME namespace NAME [--dry-run=server|client|none] [options]

Create a namespace with the specified name

Create a namespace with the specified name.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create poddisruptionbudget

Alias: pdb

Usage:

d8 k create -f FILENAME poddisruptionbudget NAME --selector=SELECTOR --min-available=N [--dry-run=server|client|none] [options]

Create a pod disruption budget with the specified name

Create a pod disruption budget with the specified name, selector, and desired minimum available pods.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--max-unavailable
The maximum number or percentage of unavailable pods this budget requires.
--min-available
The minimum number or percentage of available pods this budget requires.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--selector
A label selector to use for this budget. Only equality-based selector requirements are supported.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create priorityclass

Alias: pc

Usage:

d8 k create -f FILENAME priorityclass NAME --value=VALUE --global-default=BOOL [--dry-run=server|client|none] [options]

Create a priority class with the specified name

Create a priority class with the specified name, value, globalDefault and description.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--description
description is an arbitrary string that usually provides guidelines on when this priority class should be used.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--global-default
global-default specifies whether this PriorityClass should be considered as the default priority.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--preemption-policy
preemption-policy is the policy for preempting pods with lower priority.
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.
--value
the value of this priority class.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create quota

Alias: resourcequota

Usage:

d8 k create -f FILENAME quota NAME [--hard=key1=value1,key2=value2] [--scopes=Scope1,Scope2] [--dry-run=server|client|none] [options]

Create a quota with the specified name

Create a resource quota with the specified name, hard limits, and optional scopes.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--hard
A comma-delimited set of resource=quantity pairs that define a hard limit.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--scopes
A comma-delimited set of quota scopes that must all match each object tracked by the quota.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create role

Usage:

d8 k create -f FILENAME role NAME --verb=verb --resource=resource.group/subresource [--resource-name=resourcename] [--dry-run=server|client|none] [options]

Create a role with single rule

Create a role with single rule.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--resource
Resource that the rule applies to
--resource-name
Resource in the white list that the rule applies to, repeat this flag for multiple items
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.
--verb
Verb that applies to the resources contained in the rule

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create rolebinding

Usage:

d8 k create -f FILENAME rolebinding NAME --clusterrole=NAME|--role=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none] [options]

Create a role binding for a particular role or cluster role

Create a role binding for a particular role or cluster role.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--clusterrole
ClusterRole this RoleBinding should reference
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--group
Groups to bind to the role. The flag can be repeated to add multiple groups.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--role
Role this RoleBinding should reference
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--serviceaccount
Service accounts to bind to the role, in the format :. The flag can be repeated to add multiple service accounts.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--user
Usernames to bind to the role. The flag can be repeated to add multiple users.
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create secret

Usage:

d8 k create -f FILENAME secret (docker-registry | generic | tls) [options]

Create a secret using a specified subcommand

Create a secret with specified type.

 A docker-registry type secret is for accessing a container registry.

 A generic type secret indicate an Opaque secret type.

 A tls type secret holds TLS certificate and its associated key.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create secret docker-registry

Usage:

d8 k create -f FILENAME secret (docker-registry | generic | tls) docker-registry NAME --docker-username=user --docker-password=password --docker-email=email [--docker-server=string] [--from-file=[key=]source] [--dry-run=server|client|none] [options]

Create a secret for use with a Docker registry

Create a new secret for use with Docker registries.
        
        Dockercfg secrets are used to authenticate against Docker registries.
        
        When using the Docker command line to push images, you can authenticate to a given registry by running:
        '$ docker login DOCKER_REGISTRY_SERVER --username=DOCKER_USER --password=DOCKER_PASSWORD --email=DOCKER_EMAIL'.
        
 That produces a ~/.dockercfg file that is used by subsequent 'docker push' and 'docker pull' commands to authenticate to the registry. The email address is optional.

        When creating applications, you may have a Docker registry that requires authentication.  In order for the
        nodes to pull images on your behalf, they must have the credentials.  You can provide this information
        by creating a dockercfg secret and attaching it to your service account.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--append-hash
Append a hash of the secret to its name.
--docker-email
Email for Docker registry
--docker-password
Password for Docker registry authentication
--docker-server
Server location for Docker registry
--docker-username
Username for Docker registry authentication
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--from-file
Key files can be specified using their file path, in which case a default name of .dockerconfigjson will be given to them, or optionally with a name and file path, in which case the given name will be used. Specifying a directory will iterate each named file in the directory that is a valid secret key. For this command, the key should always be .dockerconfigjson.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create secret generic

Usage:

d8 k create -f FILENAME secret (docker-registry | generic | tls) generic NAME [--type=string] [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none] [options]

Create a secret from a local file, directory, or literal value

Create a secret based on a file, directory, or specified literal value.

 A single secret may package one or more key/value pairs.

 When creating a secret based on a file, the key will default to the basename of the file, and the value will default to the file content. If the basename is an invalid key or you wish to chose your own, you may specify an alternate key.

 When creating a secret based on a directory, each file whose basename is a valid key in the directory will be packaged into the secret. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--append-hash
Append a hash of the secret to its name.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--from-env-file
Specify the path to a file to read lines of key=val pairs to create a secret.
--from-file
Key files can be specified using their file path, in which case a default name will be given to them, or optionally with a name and file path, in which case the given name will be used. Specifying a directory will iterate each named file in the directory that is a valid secret key.
--from-literal
Specify a key and literal value to insert in secret (i.e. mykey=somevalue)
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--type
The type of secret to create
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create secret tls

Usage:

d8 k create -f FILENAME secret (docker-registry | generic | tls) tls NAME --cert=path/to/cert/file --key=path/to/key/file [--dry-run=server|client|none] [options]

Create a TLS secret

Create a TLS secret from the given public/private key pair.

 The public/private key pair must exist beforehand. The public key certificate must be .PEM encoded and match the given private key.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--append-hash
Append a hash of the secret to its name.
--cert
Path to PEM encoded public key certificate.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--key
Path to private key associated with given certificate.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create service

Alias: svc

Usage:

d8 k create -f FILENAME service [options]

Create a service using a specified subcommand

Create a service using a specified subcommand.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create service clusterip

Usage:

d8 k create -f FILENAME service clusterip NAME [--tcp=<port>:<targetPort>] [--dry-run=server|client|none] [options]

Create a ClusterIP service

Create a ClusterIP service with the specified name.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--clusterip
Assign your own ClusterIP or set to 'None' for a 'headless' service (no loadbalancing).
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--tcp
Port pairs can be specified as ':'.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create service externalname

Usage:

d8 k create -f FILENAME service externalname NAME --external-name external.name [--dry-run=server|client|none] [options]

Create an ExternalName service

Create an ExternalName service with the specified name.

 ExternalName service references to an external DNS address instead of only pods, which will allow application authors to reference services that exist off platform, on other clusters, or locally.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--external-name
External name of service
--field-manager
Name of the manager used to track field ownership.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--tcp
Port pairs can be specified as ':'.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create service loadbalancer

Usage:

d8 k create -f FILENAME service loadbalancer NAME [--tcp=port:targetPort] [--dry-run=server|client|none] [options]

Create a LoadBalancer service

Create a LoadBalancer service with the specified name.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--tcp
Port pairs can be specified as ':'.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create service nodeport

Usage:

d8 k create -f FILENAME service nodeport NAME [--tcp=port:targetPort] [--dry-run=server|client|none] [options]

Create a NodePort service

Create a NodePort service with the specified name.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--node-port
Port used to expose the service on each node in a cluster.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--tcp
Port pairs can be specified as ':'.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create serviceaccount

Alias: sa

Usage:

d8 k create -f FILENAME serviceaccount NAME [--dry-run=server|client|none] [options]

Create a service account with the specified name

Create a service account with the specified name.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k create token

Usage:

d8 k create -f FILENAME token SERVICE_ACCOUNT_NAME [options]

Request a service account token

Request a service account token.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--audience
Audience of the requested token. If unset, defaults to requesting a token for use with the Kubernetes API server. May be repeated to request a token valid for multiple audiences.
--bound-object-kind
Kind of an object to bind the token to. Supported kinds are Node, Pod, Secret. If set, --bound-object-name must be provided.
--bound-object-name
Name of an object to bind the token to. The token will expire when the object is deleted. Requires --bound-object-kind.
--bound-object-uid
UID of an object to bind the token to. Requires --bound-object-kind and --bound-object-name. If unset, the UID of the existing object is used.
--duration
Requested lifetime of the issued token. If not set or if set to 0, the lifetime will be determined by the server automatically. The server may return a token with a longer or shorter lifetime.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k debug

Usage:

d8 k debug (POD | TYPE[[.VERSION].GROUP]/NAME) [ -- COMMAND [args...] ] [options]

Create debugging sessions for troubleshooting workloads and nodes

Debug cluster resources using interactive debugging containers.

 'debug' provides automation for common debugging tasks for cluster objects identified by resource and name. Pods will be used by default if no resource is specified.

 The action taken by 'debug' varies depending on what resource is specified. Supported actions include:

  *  Workload: Create a copy of an existing pod with certain attributes changed, for example changing the image tag to a new version.
  *  Workload: Add an ephemeral container to an already running pod, for example to add debugging utilities without restarting the pod.
  *  Node: Create a new pod that runs in the node's host namespaces and can access the node's filesystem.

 Note: When a non-root user is configured for the entire target Pod, some capabilities granted by debug profile may not work.

Options

--arguments-only
If specified, everything after -- will be passed to the new container as Args instead of Command.
--attach
If true, wait for the container to start running, and then attach as if 'kubectl attach ...' were called. Default false, unless '-i/--stdin' is set, in which case the default is true.
--container, -c
Container name to use for debug container.
--copy-to
Create a copy of the target Pod with this name.
--custom
Path to a JSON or YAML file containing a partial container spec to customize built-in debug profiles.
--env
Environment variables to set in the container.
--filename, -f
identifying the resource to debug
--image
Container image to use for debug container. If not specified, the platform's recommended image will be used.
--image-pull-policy
The image pull policy for the container. If left empty, this value will not be specified by the client and defaulted by the server.
--keep-annotations
If true, keep the original pod annotations.(This flag only works when used with '--copy-to')
--keep-init-containers
Run the init containers for the pod. Defaults to true.(This flag only works when used with '--copy-to')
--keep-labels
If true, keep the original pod labels.(This flag only works when used with '--copy-to')
--keep-liveness
If true, keep the original pod liveness probes.(This flag only works when used with '--copy-to')
--keep-readiness
If true, keep the original pod readiness probes.(This flag only works when used with '--copy-to')
--keep-startup
If true, keep the original startup probes.(This flag only works when used with '--copy-to')
--profile
Options are "legacy", "general", "baseline", "netadmin", "restricted" or "sysadmin".
--quiet, -q
If true, suppress informational messages.
--replace
When used with '--copy-to', delete the original Pod.
--same-node
When used with '--copy-to', schedule the copy of target Pod on the same node.
--set-image
When used with '--copy-to', a list of name=image pairs for changing container images, similar to how 'kubectl set image' works.
--share-processes
When used with '--copy-to', enable process namespace sharing in the copy.
--stdin, -i
Keep stdin open on the container(s) in the pod, even if nothing is attached.
--target
When using an ephemeral container, target processes in this container name.
--tty, -t
Allocate a TTY for the debugging container.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k delete

Usage:

d8 k delete ([-f FILENAME] | [-k DIRECTORY] | TYPE [(NAME | -l label | --all)]) [options]

Delete resources by file names, stdin, resources and names, or by resources and label selector

Delete resources by file names, stdin, resources and names, or by resources and label selector.

 JSON and YAML formats are accepted. Only one type of argument may be specified: file names, resources and names, or resources and label selector.

 Some resources, such as pods, support graceful deletion. These resources define a default period before they are forcibly terminated (the grace period) but you may override that value with the --grace-period flag, or pass --now to set a grace-period of 1. Because these resources often represent entities in the cluster, deletion may not be acknowledged immediately. If the node hosting a pod is down or cannot reach the API server, termination may take significantly longer than the grace period. To force delete a resource, you must specify the --force flag. Note: only a subset of resources support graceful deletion. In absence of the support, the --grace-period flag is ignored.

 IMPORTANT: Force deleting pods does not wait for confirmation that the pod's processes have been terminated, which can leave those processes running until the node detects the deletion and completes graceful deletion. If your processes use shared storage or talk to a remote API and depend on the name of the pod to identify themselves, force deleting those pods may result in multiple processes running on different machines using the same identification which may lead to data corruption or inconsistency. Only force delete pods when you are sure the pod is terminated, or if your application can tolerate multiple copies of the same pod running at once. Also, if you force delete pods, the scheduler may place new pods on those nodes before the node has released those resources and causing those pods to be evicted immediately.

 Note that the delete command does NOT do resource version checks, so if someone submits an update to a resource right when you submit a delete, their update will be lost along with the rest of the resource.

 After a CustomResourceDefinition is deleted, invalidation of discovery cache may take up to 6 hours. If you don't want to wait, you might want to run "kubectl api-resources" to refresh the discovery cache.

Options

--all
Delete all resources, in the namespace of the specified resource types.
--all-namespaces, -A
If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.
--cascade
Must be "background", "orphan", or "foreground". Selects the deletion cascading strategy for the dependents (e.g. Pods created by a ReplicationController). Defaults to background.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-selector
Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.
--filename, -f
containing the resource to delete.
--force
If true, immediately remove resources from API and bypass graceful deletion. Note that immediate deletion of some resources may result in inconsistency or data loss and requires confirmation.
--grace-period
Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. Set to 1 for immediate shutdown. Can only be set to 0 when --force is true (force deletion).
--ignore-not-found
Treat "resource not found" as a successful delete. Defaults to "true" when --all is specified.
--interactive, -i
If true, delete resource only when user confirms.
--kustomize, -k
Process a kustomization directory. This flag can't be used together with -f or -R.
--now
If true, resources are signaled for immediate shutdown (same as --grace-period=1).
--output, -o
Output mode. Use "-o name" for shorter output (resource/name).
--raw
Raw URI to DELETE to the server. Uses the transport specified by the kubeconfig file.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--timeout
The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object
--wait
If true, wait for resources to be gone before returning. This waits for finalizers.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k describe

Usage:

d8 k describe (-f FILENAME | TYPE [NAME_PREFIX | -l label] | TYPE/NAME) [options]

Show details of a specific resource or group of resources

Show details of a specific resource or group of resources.

 Print a detailed description of the selected resources, including related resources such as events or controllers. You may select a single object by name, all objects of that type, provide a name prefix, or label selector. For example:

        $ kubectl describe TYPE NAME_PREFIX
        
 will first check for an exact match on TYPE and NAME_PREFIX. If no such resource exists, it will output details for every resource that has a name prefixed with NAME_PREFIX.

Use "kubectl api-resources" for a complete list of supported resources.

Options

--all-namespaces, -A
If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.
--chunk-size
Return large lists in chunks rather than all at once. Pass 0 to disable. This flag is beta and may change in the future.
--filename, -f
Filename, directory, or URL to files containing the resource to describe
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-events
If true, display events related to the described object.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k diff

Usage:

d8 k diff -f FILENAME [options]

Diff the live version against a would-be applied version

Diff configurations specified by file name or stdin between the current online configuration, and the configuration as it would be if applied.

 The output is always YAML.

 KUBECTL_EXTERNAL_DIFF environment variable can be used to select your own diff command. Users can use external commands with params too, example: KUBECTL_EXTERNAL_DIFF="colordiff -N -u"

 By default, the "diff" command available in your path will be run with the "-u" (unified diff) and "-N" (treat absent files as empty) options.

 Exit status: 0 No differences were found. 1 Differences were found. >1 Kubectl or diff failed with an error.

 Note: KUBECTL_EXTERNAL_DIFF, if used, is expected to follow that convention.

Options

--concurrency
Number of objects to process in parallel when diffing against the live version. Larger number = faster, but more memory, I/O and CPU over that shorter period of time.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files contains the configuration to diff
--force-conflicts
If true, server-side apply will force the changes against conflicts.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--prune
Include resources that would be deleted by pruning. Can be used with -l and default shows all resources would be pruned
--prune-allowlist
Overwrite the default allowlist with for --prune
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--server-side
If true, apply runs in the server instead of the client.
--show-managed-fields
If true, include managed fields in the diff.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k drain

Usage:

d8 k drain NODE [options]

Drain node in preparation for maintenance

Drain node in preparation for maintenance.

 The given node will be marked unschedulable to prevent new pods from arriving. 'drain' evicts the pods if the API server supports https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ eviction https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ . Otherwise, it will use normal DELETE to delete the pods. The 'drain' evicts or deletes all pods except mirror pods (which cannot be deleted through the API server).  If there are daemon set-managed pods, drain will not proceed without --ignore-daemonsets, and regardless it will not delete any daemon set-managed pods, because those pods would be immediately replaced by the daemon set controller, which ignores unschedulable markings.  If there are any pods that are neither mirror pods nor managed by a replication controller, replica set, daemon set, stateful set, or job, then drain will not delete any pods unless you use --force.  --force will also allow deletion to proceed if the managing resource of one or more pods is missing.

 'drain' waits for graceful termination. You should not operate on the machine until the command completes.

 When you are ready to put the node back into service, use kubectl uncordon, which will make the node schedulable again.

https://kubernetes.io/images/docs/kubectl_drain.svg Workflowhttps://kubernetes.io/images/docs/kubectl_drain.svg

Options

--chunk-size
Return large lists in chunks rather than all at once. Pass 0 to disable. This flag is beta and may change in the future.
--delete-emptydir-data
Continue even if there are pods using emptyDir (local data that will be deleted when the node is drained).
--disable-eviction
Force drain to use delete, even if eviction is supported. This will bypass checking PodDisruptionBudgets, use with caution.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--force
Continue even if there are pods that do not declare a controller.
--grace-period
Period of time in seconds given to each pod to terminate gracefully. If negative, the default value specified in the pod will be used.
--ignore-daemonsets
Ignore DaemonSet-managed pods.
--pod-selector
Label selector to filter pods on the node
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--skip-wait-for-delete-timeout
If pod DeletionTimestamp older than N seconds, skip waiting for the pod. Seconds must be greater than 0 to skip.
--timeout
The length of time to wait before giving up, zero means infinite

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k edit

Usage:

d8 k edit (RESOURCE/NAME | -f FILENAME) [options]

Edit a resource on the server

Edit a resource from the default editor.

 The edit command allows you to directly edit any API resource you can retrieve via the command-line tools. It will open the editor defined by your KUBE_EDITOR, or EDITOR environment variables, or fall back to 'vi' for Linux or 'notepad' for Windows. When attempting to open the editor, it will first attempt to use the shell that has been defined in the 'SHELL' environment variable. If this is not defined, the default shell will be used, which is '/bin/bash' for Linux or 'cmd' for Windows.

 You can edit multiple objects, although changes are applied one at a time. The command accepts file names as well as command-line arguments, although the files you point to must be previously saved versions of resources.

 Editing is done with the API version used to fetch the resource. To edit using a specific API version, fully-qualify the resource, version, and group.

 The default format is YAML. To edit in JSON, specify "-o json".

 The flag --windows-line-endings can be used to force Windows line endings, otherwise the default for your operating system will be used.

 In the event an error occurs while updating, a temporary file will be created on disk that contains your unapplied changes. The most common error when updating a resource is another editor changing the resource on the server. When this occurs, you will have to apply your changes to the newer version of the resource, or update your temporary saved copy to include the latest resource version.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files to use to edit the resource
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--output-patch
Output the patch if the resource is edited.
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--subresource
If specified, edit will operate on the subresource of the requested object.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.
--windows-line-endings
Defaults to the line ending native to your platform.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k events

Usage:

d8 k events [(-o|--output=)json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file] [--for TYPE/NAME] [--watch] [--types=Normal,Warning] [options]

List events

Display events.

 Prints a table of the most important information about events. You can request events for a namespace, for all namespace, or filtered to only those pertaining to a specified resource.

Options

--all-namespaces, -A
If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--chunk-size
Return large lists in chunks rather than all at once. Pass 0 to disable. This flag is beta and may change in the future.
--for
Filter events to only those pertaining to the specified resource.
--no-headers
When using the default output format, don't print headers.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--types
Output only events of given types.
--watch, -w
After listing the requested events, watch for more events.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k exec

Usage:

d8 k exec (POD | TYPE/NAME) [-c CONTAINER] [flags] -- COMMAND [args...] [options]

Execute a command in a container

Execute a command in a container.

Options

--container, -c
Container name. If omitted, use the kubectl.kubernetes.io/default-container annotation for selecting the container to be attached or the first container in the pod will be chosen
--filename, -f
to use to exec into the resource
--pod-running-timeout
The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running
--quiet, -q
Only print output from the remote session
--stdin, -i
Pass stdin to the container
--tty, -t
Stdin is a TTY

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k explain

Usage:

d8 k explain TYPE [--recursive=FALSE|TRUE] [--api-version=api-version-group] [-o|--output=plaintext|plaintext-openapiv2] [options]

Get documentation for a resource

Describe fields and structure of various resources.

 This command describes the fields associated with each supported API resource. Fields are identified via a simple JSONPath identifier:

        <type>.<fieldName>[.<fieldName>]
        
 Information about each field is retrieved from the server in OpenAPI format.

Use "kubectl api-resources" for a complete list of supported resources.

Options

--api-version
Get different explanations for particular API version (API group/version)
--output, -o
Format in which to render the schema (plaintext, plaintext-openapiv2)
--recursive
Print the fields of fields (Currently only 1 level deep)

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k expose

Usage:

d8 k expose (-f FILENAME | TYPE NAME) [--port=port] [--protocol=TCP|UDP|SCTP] [--target-port=number-or-name] [--name=name] [--external-ip=external-ip-of-service] [--type=type] [options]

Take a replication controller, service, deployment or pod and expose it as a new Kubernetes service

Expose a resource as a new Kubernetes service.

 Looks up a deployment, service, replica set, replication controller or pod by name and uses the selector for that resource as the selector for a new service on the specified port. A deployment or replica set will be exposed as a service only if its selector is convertible to a selector that service supports, i.e. when the selector contains only the matchLabels component. Note that if no port is specified via --port and the exposed resource has multiple ports, all will be re-used by the new service. Also if no labels are specified, the new service will re-use the labels from the resource it exposes.

 Possible resources include (case insensitive):

 pod (po), service (svc), replicationcontroller (rc), deployment (deploy), replicaset (rs)

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--cluster-ip
ClusterIP to be assigned to the service. Leave empty to auto-allocate, or set to 'None' to create a headless service.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--external-ip
Additional external IP address (not managed by Kubernetes) to accept for the service. If this IP is routed to a node, the service can be accessed by this IP in addition to its generated service IP.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files identifying the resource to expose a service
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--labels, -l
Labels to apply to the service created by this call.
--load-balancer-ip
IP to assign to the LoadBalancer. If empty, an ephemeral IP will be created and used (cloud-provider specific).
--name
The name for the newly created object.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--override-type
The method used to override the generated object: json, merge, or strategic.
--overrides
An inline JSON override for the generated object. If this is non-empty, it is used to override the generated object. Requires that the object supply a valid apiVersion field.
--port
The port that the service should serve on. Copied from the resource being exposed, if unspecified
--protocol
The network protocol for the service to be created. Default is 'TCP'.
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--selector
A label selector to use for this service. Only equality-based selector requirements are supported. If empty (the default) infer the selector from the replication controller or replica set.)
--session-affinity
If non-empty, set the session affinity for the service to this; legal values: 'None', 'ClientIP'
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--target-port
Name or number for the port on the container that the service should direct traffic to. Optional.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--type
Type for this service: ClusterIP, NodePort, LoadBalancer, or ExternalName. Default is 'ClusterIP'.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k get

Usage:

d8 k get [(-o|--output=)json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file|custom-columns|custom-columns-file|wide] (TYPE[.VERSION][.GROUP] [NAME | -l label] | TYPE[.VERSION][.GROUP]/NAME ...) [flags] [options]

Display one or many resources

Display one or many resources.

 Prints a table of the most important information about the specified resources. You can filter the list using a label selector and the --selector flag. If the desired resource type is namespaced you will only see results in the current namespace if you don't specify any namespace.

 By specifying the output as 'template' and providing a Go template as the value of the --template flag, you can filter the attributes of the fetched resources.

Use "kubectl api-resources" for a complete list of supported resources.

Options

--all-namespaces, -A
If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--chunk-size
Return large lists in chunks rather than all at once. Pass 0 to disable. This flag is beta and may change in the future.
--field-selector
Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.
--filename, -f
Filename, directory, or URL to files identifying the resource to get from a server.
--ignore-not-found
If set to true, suppresses NotFound error for specific objects that do not exist. Using this flag with commands that query for collections of resources has no effect when no resources are found.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--label-columns, -L
Accepts a comma separated list of labels that are going to be presented as columns. Names are case-sensitive. You can also use multiple flag options like -L label1 -L label2...
--no-headers
When using the default or custom-column output format, don't print headers (default print headers).
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file, custom-columns, custom-columns-file, wide). See custom columns [https://kubernetes.io/docs/reference/kubectl/#custom-columns], golang template [http://golang.org/pkg/text/template/#pkg-overview] and jsonpath template [https://kubernetes.io/docs/reference/kubectl/jsonpath/].
--output-watch-events
Output watch event objects when --watch or --watch-only is used. Existing objects are output as initial ADDED events.
--raw
Raw URI to request from the server. Uses the transport specified by the kubeconfig file.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--scope
Cross-namespace listing scope for users without cluster-wide list/watch RBAC: accessible (everything RBAC grants you), projects, system, or project:. Requires -A/--all-namespaces and Deckhouse platform support on the server side.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--server-print
If true, have the server return the appropriate table output. Supports extension APIs and CRDs.
--show-kind
If present, list the resource type for the requested object(s).
--show-labels
When printing, show all labels as the last column (default hide labels column)
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--sort-by
If non-empty, sort list types using this field specification. The field specification is expressed as a JSONPath expression (e.g. '{.metadata.name}'). The field in the API resource specified by this JSONPath expression must be an integer or a string.
--subresource
If specified, gets the subresource of the requested object.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--watch, -w
After listing/getting the requested object, watch for changes.
--watch-only
Watch for changes to the requested object(s), without listing/getting first.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k kustomize

Usage:

d8 k kustomize DIR [options]

Build a kustomization target from a directory or URL

Build a set of KRM resources using a 'kustomization.yaml' file. The DIR argument must be a path to a directory containing 'kustomization.yaml', or a git repository URL with a path suffix specifying same with respect to the repository root. If DIR is omitted, '.' is assumed.

Options

--as-current-user
use the uid and gid of the command executor to run the function in the container
--enable-alpha-plugins
enable kustomize plugins
--enable-helm
Enable use of the Helm chart inflator generator.
--enable-managedby-label
enable adding app.kubernetes.io/managed-by
--env, -e
a list of environment variables to be used by functions
--helm-api-versions
Kubernetes api versions used by Helm for Capabilities.APIVersions
--helm-command
helm command (path to executable)
--helm-debug
Enable debug output from the Helm chart inflator generator.
--helm-kube-version
Kubernetes version used by Helm for Capabilities.KubeVersion
--load-restrictor
if set to 'LoadRestrictionsNone', local kustomizations may load files from outside their root. This does, however, break the relocatability of the kustomization.
--mount
a list of storage options read from the filesystem
--network
enable network access for functions that declare it
--network-name
the docker network to run the container in
--output, -o
If specified, write output to this path.
--reorder
Reorder the resources just before output. Use 'legacy' to apply a legacy reordering (Namespaces first, Webhooks last, etc). Use 'none' to suppress a final reordering.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k label

Usage:

d8 k label [--overwrite] (-f FILENAME | TYPE NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--resource-version=version] [options]

Update the labels on a resource

Update the labels on a resource.

  *  A label key and value must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to 63 characters each.
  *  Optionally, the key can begin with a DNS subdomain prefix and a single '/', like example.com/my-app.
  *  If --overwrite is true, then existing labels can be overwritten, otherwise attempting to overwrite a label will result in an error.
  *  If --resource-version is specified, then updates will use this resource version, otherwise the existing resource-version will be used.

Options

--all
Select all resources, in the namespace of the specified resource types
--all-namespaces, -A
If true, check the specified action in all namespaces.
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--field-selector
Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.
--filename, -f
Filename, directory, or URL to files identifying the resource to update the labels
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--list
If true, display the labels for a given resource.
--local
If true, label will NOT contact api-server but run locally.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--overwrite
If true, allow labels to be overwritten, otherwise reject label updates that overwrite existing labels.
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--resource-version
If non-empty, the labels update will only succeed if this is the current resource-version for the object. Only valid when specifying a single resource.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k logs

Usage:

d8 k logs [-f] [-p] (POD | TYPE/NAME) [-c CONTAINER] [options]

Print the logs for a container in a pod

Print the logs for a container in a pod or specified resource. If the pod has only one container, the container name is optional.

Options

--all-containers
Get all containers' logs in the pod(s).
--all-pods
Get logs from all pod(s). Sets prefix to true.
--container, -c
Print the logs of this container
--follow, -f
Specify if the logs should be streamed.
--ignore-errors
If watching / following pod logs, allow for any errors that occur to be non-fatal
--insecure-skip-tls-verify-backend
Skip verifying the identity of the kubelet that logs are requested from. In theory, an attacker could provide invalid log content back. You might want to use this if your kubelet serving certificates have expired.
--limit-bytes
Maximum bytes of logs to return. Defaults to no limit.
--max-log-requests
Specify maximum number of concurrent logs to follow when using by a selector. Defaults to 5.
--pod-running-timeout
The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running
--prefix
Prefix each log line with the log source (pod name and container name)
--previous, -p
If true, print the logs for the previous instance of the container in a pod if it exists.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--since
Only return logs newer than a relative duration like 5s, 2m, or 3h. Defaults to all logs. Only one of since-time / since may be used.
--since-time
Only return logs after a specific date (RFC3339). Defaults to all logs. Only one of since-time / since may be used.
--tail
Lines of recent log file to display. Defaults to -1 with no selector, showing all log lines otherwise 10, if a selector is provided.
--timestamps
Include timestamps on each line in the log output

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k options

Usage:

d8 k options [options]

Print the list of flags inherited by all commands

Print the list of flags inherited by all commands

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k patch

Usage:

d8 k patch (-f FILENAME | TYPE NAME) [-p PATCH|--patch-file FILE] [options]

Update fields of a resource

Update fields of a resource using strategic merge patch, a JSON merge patch, or a JSON patch.

 JSON and YAML formats are accepted.

 Note: Strategic merge patch is not supported for custom resources.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files identifying the resource to update
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--local
If true, patch will operate on the content of the file, not the server-side resource.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--patch, -p
The patch to be applied to the resource JSON file.
--patch-file
A file containing a patch to be applied to the resource.
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--subresource
If specified, patch will operate on the subresource of the requested object.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--type
The type of patch being provided; one of [json merge strategic]

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k plugin

Usage:

d8 k plugin [flags] [options]

Provides utilities for interacting with plugins

Provides utilities for interacting with plugins.

 Plugins provide extended functionality that is not part of the major command-line distribution. Please refer to the documentation and examples for more information about how write your own plugins.

 The easiest way to discover and install plugins is via the kubernetes sub-project krew: [krew.sigs.k8s.io]. To install krew, visit https://krew.sigs.k8s.io/docs/user-guide/setup/install

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k plugin list

Usage:

d8 k plugin [flags] list [options]

List all visible plugin executables on a user's PATH

List all available plugin files on a user's PATH. To see plugins binary names without the full path use --name-only flag.

 Available plugin files are those that are: - executable - anywhere on the user's PATH - begin with "kubectl-"

Options

--name-only
If true, display only the binary name of each plugin, rather than its full path

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k port-forward

Usage:

d8 k port-forward TYPE/NAME [options] [LOCAL_PORT:]REMOTE_PORT [...[LOCAL_PORT_N:]REMOTE_PORT_N]

Forward one or more local ports to a pod

Forward one or more local ports to a pod.

 Use resource type/name such as deployment/mydeployment to select a pod. Resource type defaults to 'pod' if omitted.

 If there are multiple pods matching the criteria, a pod will be selected automatically. The forwarding session ends when the selected pod terminates, and a rerun of the command is needed to resume forwarding.

Options

--address
Addresses to listen on (comma separated). Only accepts IP addresses or localhost as a value. When localhost is supplied, kubectl will try to bind on both 127.0.0.1 and ::1 and will fail if neither of these addresses are available to bind.
--pod-running-timeout
The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k proxy

Usage:

d8 k proxy [--port=PORT] [--www=static-dir] [--www-prefix=prefix] [--api-prefix=prefix] [options]

Run a proxy to the Kubernetes API server

Creates a proxy server or application-level gateway between localhost and the Kubernetes API server. It also allows serving static content over specified HTTP path. All incoming data enters through one port and gets forwarded to the remote Kubernetes API server port, except for the path matching the static content path.

Options

--accept-hosts
Regular expression for hosts that the proxy should accept.
--accept-paths
Regular expression for paths that the proxy should accept.
--address
The IP address on which to serve on.
--api-prefix
Prefix to serve the proxied API under.
--append-server-path
If true, enables automatic path appending of the kube context server path to each request.
--disable-filter
If true, disable request filtering in the proxy. This is dangerous, and can leave you vulnerable to XSRF attacks, when used with an accessible port.
--keepalive
keepalive specifies the keep-alive period for an active network connection. Set to 0 to disable keepalive.
--port, -p
The port on which to run the proxy. Set to 0 to pick a random port.
--reject-methods
Regular expression for HTTP methods that the proxy should reject (example --reject-methods='POST,PUT,PATCH').
--reject-paths
Regular expression for paths that the proxy should reject. Paths specified here will be rejected even accepted by --accept-paths.
--unix-socket, -u
Unix socket on which to run the proxy.
--www, -w
Also serve static files from the given directory under the specified prefix.
--www-prefix, -P
Prefix to serve static files under, if static file directory is specified.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k replace

Usage:

d8 k replace -f FILENAME [options]

Replace a resource by file name or stdin

Replace a resource by file name or stdin.

 JSON and YAML formats are accepted. If replacing an existing resource, the complete resource spec must be provided. This can be obtained by

        $ kubectl get TYPE NAME -o yaml

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--cascade
Must be "background", "orphan", or "foreground". Selects the deletion cascading strategy for the dependents (e.g. Pods created by a ReplicationController). Defaults to background.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
The files that contain the configurations to replace.
--force
If true, immediately remove resources from API and bypass graceful deletion. Note that immediate deletion of some resources may result in inconsistency or data loss and requires confirmation.
--grace-period
Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. Set to 1 for immediate shutdown. Can only be set to 0 when --force is true (force deletion).
--kustomize, -k
Process a kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--raw
Raw URI to PUT to the server. Uses the transport specified by the kubeconfig file.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--subresource
If specified, replace will operate on the subresource of the requested object.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--timeout
The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.
--wait
If true, wait for resources to be gone before returning. This waits for finalizers.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k rollout

Usage:

d8 k rollout SUBCOMMAND [options]

Manage the rollout of a resource

Manage the rollout of one or many resources.
        
 Valid resource types include:

  *  deployments
  *  daemonsets
  *  statefulsets

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k rollout history

Usage:

d8 k rollout SUBCOMMAND history (TYPE NAME | TYPE/NAME) [flags] [options]

View rollout history

View previous rollout revisions and configurations.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--filename, -f
Filename, directory, or URL to files identifying the resource to get from a server.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--revision
See the details, including podTemplate of the revision specified
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k rollout pause

Usage:

d8 k rollout SUBCOMMAND pause RESOURCE [options]

Mark the provided resource as paused

Mark the provided resource as paused.

 Paused resources will not be reconciled by a controller. Use "kubectl rollout resume" to resume a paused resource. Currently only deployments support being paused.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files identifying the resource to get from a server.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k rollout restart

Usage:

d8 k rollout SUBCOMMAND restart RESOURCE [options]

Restart a resource

Restart a resource.

        Resource rollout will be restarted.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files identifying the resource to get from a server.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k rollout resume

Usage:

d8 k rollout SUBCOMMAND resume RESOURCE [options]

Resume a paused resource

Resume a paused resource.

 Paused resources will not be reconciled by a controller. By resuming a resource, we allow it to be reconciled again. Currently only deployments support being resumed.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files identifying the resource to get from a server.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k rollout status

Usage:

d8 k rollout SUBCOMMAND status (TYPE NAME | TYPE/NAME) [flags] [options]

Show the status of the rollout

Show the status of the rollout.

 By default 'rollout status' will watch the status of the latest rollout until it's done. If you don't want to wait for the rollout to finish then you can use --watch=false. Note that if a new rollout starts in-between, then 'rollout status' will continue watching the latest revision. If you want to pin to a specific revision and abort if it is rolled over by another revision, use --revision=N where N is the revision you need to watch for.

Options

--filename, -f
Filename, directory, or URL to files identifying the resource to get from a server.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--revision
Pin to a specific revision for showing its status. Defaults to 0 (last revision).
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--timeout
The length of time to wait before ending watch, zero means never. Any other values should contain a corresponding time unit (e.g. 1s, 2m, 3h).
--watch, -w
Watch the status of the rollout until it's done.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k rollout undo

Usage:

d8 k rollout SUBCOMMAND undo (TYPE NAME | TYPE/NAME) [flags] [options]

Undo a previous rollout

Roll back to a previous rollout.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--filename, -f
Filename, directory, or URL to files identifying the resource to get from a server.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--to-revision
The revision to rollback to. Default to 0 (last revision).

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k run

Usage:

d8 k run NAME --image=image [--env="key=value"] [--port=port] [--dry-run=server|client] [--overrides=inline-json] [--command] -- [COMMAND] [args...] [options]

Run a particular image on the cluster

Create and run a particular image in a pod.

Options

--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--annotations
Annotations to apply to the pod.
--attach
If true, wait for the Pod to start running, and then attach to the Pod as if 'kubectl attach ...' were called. Default false, unless '-i/--stdin' is set, in which case the default is true. With '--restart=Never' the exit code of the container process is returned.
--cascade
Must be "background", "orphan", or "foreground". Selects the deletion cascading strategy for the dependents (e.g. Pods created by a ReplicationController). Defaults to background.
--command
If true and extra arguments are present, use them as the 'command' field in the container, rather than the 'args' field which is the default.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--env
Environment variables to set in the container.
--expose
If true, create a ClusterIP service associated with the pod. Requires `--port`.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
to use to replace the resource.
--force
If true, immediately remove resources from API and bypass graceful deletion. Note that immediate deletion of some resources may result in inconsistency or data loss and requires confirmation.
--grace-period
Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. Set to 1 for immediate shutdown. Can only be set to 0 when --force is true (force deletion).
--image
The image for the container to run.
--image-pull-policy
The image pull policy for the container. If left empty, this value will not be specified by the client and defaulted by the server.
--kustomize, -k
Process a kustomization directory. This flag can't be used together with -f or -R.
--labels, -l
Comma separated labels to apply to the pod. Will override previous values.
--leave-stdin-open
If the pod is started in interactive mode or with stdin, leave stdin open after the first attach completes. By default, stdin will be closed after the first attach completes.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--override-type
The method used to override the generated object: json, merge, or strategic.
--overrides
An inline JSON override for the generated object. If this is non-empty, it is used to override the generated object. Requires that the object supply a valid apiVersion field.
--pod-running-timeout
The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running
--port
The port that this container exposes.
--privileged
If true, run the container in privileged mode.
--quiet, -q
If true, suppress prompt messages.
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--restart
The restart policy for this Pod. Legal values [Always, OnFailure, Never].
--rm
If true, delete the pod after it exits. Only valid when attaching to the container, e.g. with '--attach' or with '-i/--stdin'.
--save-config
If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--stdin, -i
Keep stdin open on the container in the pod, even if nothing is attached.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--timeout
The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object
--tty, -t
Allocate a TTY for the container in the pod.
--wait
If true, wait for resources to be gone before returning. This waits for finalizers.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k scale

Usage:

d8 k scale [--resource-version=version] [--current-replicas=count] --replicas=COUNT (-f FILENAME | TYPE NAME) [options]

Set a new size for a deployment, replica set, or replication controller

Set a new size for a deployment, replica set, replication controller, or stateful set.

 Scale also allows users to specify one or more preconditions for the scale action.

 If --current-replicas or --resource-version is specified, it is validated before the scale is attempted, and it is guaranteed that the precondition holds true when the scale is sent to the server.

Options

--all
Select all resources in the namespace of the specified resource types
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--current-replicas
Precondition for current size. Requires that the current size of the resource match this value in order to scale. -1 (default) for no condition.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--filename, -f
Filename, directory, or URL to files identifying the resource to set a new size
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--replicas
The new desired number of replicas. Required.
--resource-version
Precondition for resource version. Requires that the current resource version match this value in order to scale.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--timeout
The length of time to wait before giving up on a scale operation, zero means don't wait. Any other values should contain a corresponding time unit (e.g. 1s, 2m, 3h).

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k set

Usage:

d8 k set SUBCOMMAND [options]

Set specific features on objects

Configure application resources.

 These commands help you make changes to existing application resources.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k set env

Usage:

d8 k set SUBCOMMAND env RESOURCE/NAME KEY_1=VAL_1 ... KEY_N=VAL_N [options]

Update environment variables on a pod template

Update environment variables on a pod template.

 List environment variable definitions in one or more pods, pod templates. Add, update, or remove container environment variable definitions in one or more pod templates (within replication controllers or deployment configurations). View or modify the environment variable definitions on all containers in the specified pods or pod templates, or just those that match a wildcard.

 If "--env -" is passed, environment variables can be read from STDIN using the standard env syntax.

 Possible resources include (case insensitive):

        pod (po), replicationcontroller (rc), deployment (deploy), daemonset (ds), statefulset (sts), cronjob (cj), replicaset (rs)

Options

--all
If true, select all resources in the namespace of the specified resource types
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--containers, -c
The names of containers in the selected pod templates to change - may use wildcards
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--env, -e
Specify a key-value pair for an environment variable to set into each container.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files the resource to update the env
--from
The name of a resource from which to inject environment variables
--keys
Comma-separated list of keys to import from specified resource
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--list
If true, display the environment and any changes in the standard format. this flag will removed when we have kubectl view env.
--local
If true, set env will NOT contact api-server but run locally.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--overwrite
If true, allow environment to be overwritten, otherwise reject updates that overwrite existing environment.
--prefix
Prefix to append to variable names
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--resolve
If true, show secret or configmap references when listing variables
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k set image

Usage:

d8 k set SUBCOMMAND image (-f FILENAME | TYPE NAME) CONTAINER_NAME_1=CONTAINER_IMAGE_1 ... CONTAINER_NAME_N=CONTAINER_IMAGE_N [options]

Update the image of a pod template

Update existing container image(s) of resources.

 Possible resources include (case insensitive):

        pod (po), replicationcontroller (rc), deployment (deploy), daemonset (ds), statefulset (sts), cronjob (cj), replicaset (rs)

Options

--all
Select all resources, in the namespace of the specified resource types
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files identifying the resource to get from a server.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--local
If true, set image will NOT contact api-server but run locally.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k set resources

Usage:

d8 k set SUBCOMMAND resources (-f FILENAME | TYPE NAME)  ([--limits=LIMITS & --requests=REQUESTS] [options]

Update resource requests/limits on objects with pod templates

Specify compute resource requirements (CPU, memory) for any resource that defines a pod template.  If a pod is successfully scheduled, it is guaranteed the amount of resource requested, but may burst up to its specified limits.

 For each compute resource, if a limit is specified and a request is omitted, the request will default to the limit.

 Possible resources include (case insensitive): Use "kubectl api-resources" for a complete list of supported resources..

Options

--all
Select all resources, in the namespace of the specified resource types
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--containers, -c
The names of containers in the selected pod templates to change, all containers are selected by default - may use wildcards
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files identifying the resource to get from a server.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--limits
The resource requirement requests for this container. For example, 'cpu=100m,memory=256Mi'. Note that server side components may assign requests depending on the server configuration, such as limit ranges.
--local
If true, set resources will NOT contact api-server but run locally.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--requests
The resource requirement requests for this container. For example, 'cpu=100m,memory=256Mi'. Note that server side components may assign requests depending on the server configuration, such as limit ranges.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k set selector

Usage:

d8 k set SUBCOMMAND selector (-f FILENAME | TYPE NAME) EXPRESSIONS [--resource-version=version] [options]

Set the selector on a resource

Set the selector on a resource. Note that the new selector will overwrite the old selector if the resource had one prior to the invocation of 'set selector'.

 A selector must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to 63 characters. If --resource-version is specified, then updates will use this resource version, otherwise the existing resource-version will be used. Note: currently selectors can only be set on Service objects.

Options

--all
Select all resources in the namespace of the specified resource types
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
identifying the resource.
--local
If true, annotation will NOT contact api-server but run locally.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--resource-version
If non-empty, the selectors update will only succeed if this is the current resource-version for the object. Only valid when specifying a single resource.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k set serviceaccount

Alias: sa

Usage:

d8 k set SUBCOMMAND serviceaccount (-f FILENAME | TYPE NAME) SERVICE_ACCOUNT [options]

Update the service account of a resource

Update the service account of pod template resources.

 Possible resources (case insensitive) can be:

 replicationcontroller (rc), deployment (deploy), daemonset (ds), job, replicaset (rs), statefulset

Options

--all
Select all resources, in the namespace of the specified resource types
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files identifying the resource to get from a server.
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--local
If true, set serviceaccount will NOT contact api-server but run locally.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--record
Record current kubectl command in the resource annotation. If set to false, do not record the command. If set to true, record the command. If not set, default to updating the existing annotation value only if one already exists.
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k set subject

Usage:

d8 k set SUBCOMMAND subject (-f FILENAME | TYPE NAME) [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none] [options]

Update the user, group, or service account in a role binding or cluster role binding

Update the user, group, or service account in a role binding or cluster role binding.

Options

--all
Select all resources, in the namespace of the specified resource types
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--filename, -f
Filename, directory, or URL to files the resource to update the subjects
--group
Groups to bind to the role
--kustomize, -k
Process the kustomization directory. This flag can't be used together with -f or -R.
--local
If true, set subject will NOT contact api-server but run locally.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--serviceaccount
Service accounts to bind to the role
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--user
Usernames to bind to the role

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k taint

Usage:

d8 k taint NODE NAME KEY_1=VAL_1:TAINT_EFFECT_1 ... KEY_N=VAL_N:TAINT_EFFECT_N [options]

Update the taints on one or more nodes

Update the taints on one or more nodes.

  *  A taint consists of a key, value, and effect. As an argument here, it is expressed as key=value:effect.
  *  The key must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to 253 characters.
  *  Optionally, the key can begin with a DNS subdomain prefix and a single '/', like example.com/my-app.
  *  The value is optional. If given, it must begin with a letter or number, and may contain letters, numbers, hyphens, dots, and underscores, up to 63 characters.
  *  The effect must be NoSchedule, PreferNoSchedule or NoExecute.
  *  Currently taint can only apply to node.

Options

--all
Select all nodes in the cluster
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--field-manager
Name of the manager used to track field ownership.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--overwrite
If true, allow taints to be overwritten, otherwise reject taint updates that overwrite existing taints.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--validate
Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k top

Usage:

d8 k top [options]

Display resource (CPU/memory) usage

Display resource (CPU/memory) usage.

 This command provides a view of recent resource consumption for nodes and pods. It fetches metrics from the Metrics Server, which aggregates this data from the kubelet on each node. The Metrics Server must be installed and running in the cluster for this command to work.

 The metrics shown are specifically optimized for Kubernetes autoscaling decisions, such as those made by the Horizontal Pod Autoscaler (HPA) and Vertical Pod Autoscaler (VPA). Because of this, the values may not match those from standard OS tools like 'top', as the metrics are designed to provide a stable signal for autoscalers rather than for pinpoint accuracy.

 When to use this command:

  *  For on-the-fly spot-checks of resource usage (e.g. identify which pods are consuming the most resources at a glance, or get a quick sense of the load on your nodes)
  *  Understand current resource consumption patterns
  *  Validate the behavior of your HPA or VPA configurations by seeing the metrics they use for scaling decisions.

 It is not intended to be a replacement for full-featured monitoring solutions. Its primary design goal is to provide a low-overhead signal for autoscalers, not to be a perfectly accurate monitoring tool. For high-accuracy reporting, historical analysis, dashboarding, or alerting, you should use a dedicated monitoring solution.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k top node

Aliases: nodes, no

Usage:

d8 k top node [NAME | -l label] [options]

Display resource (CPU/memory) usage of nodes

Display resource (CPU/memory) usage of nodes.

 The top-node command allows you to see the resource consumption of nodes.

Options

--no-headers
If present, print output without headers
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-capacity
Print node resources based on Capacity instead of Allocatable(default) of the nodes.
--show-swap
Print node resources related to swap memory.
--sort-by
If non-empty, sort nodes list using specified field. The field can be either 'cpu' or 'memory'.
--use-protocol-buffers
Enables using protocol-buffers to access Metrics API.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k top pod

Aliases: pods, po

Usage:

d8 k top pod [NAME | -l label] [options]

Display resource (CPU/memory) usage of pods

Display resource (CPU/memory) usage of pods.

 The 'top pod' command allows you to see the resource consumption of pods.

 Due to the metrics pipeline delay, they may be unavailable for a few minutes since pod creation.

Options

--all-namespaces, -A
If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.
--containers
If present, print usage of containers within a pod.
--field-selector
Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.
--no-headers
If present, print output without headers.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.
--show-swap
Print pod resources related to swap memory.
--sort-by
If non-empty, sort pods list using specified field. The field can be either 'cpu' or 'memory'.
--sum
Print the sum of the resource usage
--use-protocol-buffers
Enables using protocol-buffers to access Metrics API.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k uncordon

Usage:

d8 k uncordon NODE [options]

Mark node as schedulable

Mark node as schedulable.

Options

--dry-run
Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.
--selector, -l
Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k version

Usage:

d8 k version [options]

Print the client and server version information

Print the client and server version information for the current context.

Options

--client
If true, shows client version only (no server required).
--output, -o
One of 'yaml' or 'json'.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 k wait

Usage:

d8 k wait ([-f FILENAME] | resource.group/resource.name | resource.group [(-l label | --all)]) [--for=create|--for=delete|--for condition=available|--for=jsonpath='{}'[=value]] [options]

Experimental: Wait for a specific condition on one or many resources

Experimental: Wait for a specific condition on one or many resources.

 The command takes multiple resources and waits until the specified condition is seen in the Status field of every given resource.

 Alternatively, the command can wait for the given set of resources to be created or deleted by providing the "create" or "delete" keyword as the value to the --for flag.

 A successful message will be printed to stdout indicating when the specified condition has been met. You can use -o option to change to output destination.

Options

--all
Select all resources in the namespace of the specified resource types
--all-namespaces, -A
If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.
--allow-missing-template-keys
If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.
--field-selector
Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.
--filename, -f
identifying the resource.
--for
The condition to wait on: [create|delete|condition=condition-name[=condition-value]|jsonpath='{JSONPath expression}'=[JSONPath value]]. The default condition-value is true. Condition values are compared after Unicode simple case folding, which is a more general form of case-insensitivity.
--local
If true, annotation will NOT contact api-server but run locally.
--output, -o
Output format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--recursive, -R
Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.
--selector, -l
Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)
--show-managed-fields
If true, keep the managedFields when printing objects in JSON or YAML format.
--template
Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
--timeout
The length of time to wait before giving up. Zero means check once and don't wait, negative means wait for a week.

Global options

--as
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation.
--cache-dir
Default cache directory
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--kuberc
Path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
--log-flush-frequency
Maximum number of seconds between log flushes
--match-server-version
Require server version to match client version
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--profile
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output
Name of the file to write the profile to
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)
--warnings-as-errors
Treat warnings received from the server as errors and exit with a non-zero exit code

d8 mirror

Copy Deckhouse Kubernetes Platform distribution to the local filesystem or third-party registry

Copy Deckhouse Kubernetes Platform distribution to the local filesystem or the air-gapped registries.

 For more information on how to use it, consult the docs at https://deckhouse.io/products/kubernetes-platform/documentation/latest/installing/#manual-loading-of-dkp-images-and-vulnerability-db-into-a-private-registry

 LICENSE NOTE: The d8 mirror functionality is exclusively available to users holding a valid license for any commercial version of the Deckhouse Kubernetes Platform.

 © Flant JSC 2025

d8 mirror pull

Usage:

d8 mirror pull <images-bundle-path> [options]

Copy Deckhouse Kubernetes Platform distribution to the local filesystem

Download Deckhouse Kubernetes Platform distribution to the local filesystem.
		
This command downloads the Deckhouse Kubernetes Platform distribution bundle 
containing specific platform releases and it's modules, 
to be pushed into the air-gapped container registry at a later time.

For more information on how to use it, consult the docs at 
https://deckhouse.io/products/kubernetes-platform/documentation/latest/installing/#manual-loading-of-dkp-images-and-vulnerability-db-into-a-private-registry

Additional configuration options for the d8 mirror family of commands are available as environment variables:

 * $SSL_CERT_FILE           — Path to the SSL certificate. If the variable is set, system certificates are not used;
 * $SSL_CERT_DIR            — List of directories to search for SSL certificate files, separated by a colon.
                              If set, system certificates are not used. More info at https://docs.openssl.org/1.0.2/man1/c_rehash/;
 * $HTTP_PROXY/$HTTPS_PROXY — URL of the proxy server for HTTP(S) requests to hosts that are not listed in the $NO_PROXY;
 * $NO_PROXY                — Comma-separated list of hosts to exclude from proxying.
                              Supported value formats include IP's', CIDR notations (1.2.3.4/8), domains, and asterisk sign (*).
                              The IP addresses and domain names can also include a literal port number (1.2.3.4:80).
                              The domain name matches that name and all the subdomains.
                              The domain name with a leading . matches subdomains only.
                              For example, foo.com matches foo.com and bar.foo.com; .y.com matches x.y.com but does not match y.com.
                              A single asterisk * indicates that no proxying should be done;

LICENSE NOTE:
The d8 mirror functionality is exclusively available to users holding a 
valid license for any commercial version of the Deckhouse Kubernetes Platform.

© Flant JSC 2025

Options

--deckhouse-cli-tag
Specific d8 CLI version to mirror, e.g. "v0.13.1". Without this flag the newest published stable version is mirrored. The CLI binary lives at the deckhouse-cli registry segment, next to the plugins catalog; a registry that publishes no such repository is reported in the summary instead of failing the pull, unless this flag asked for a version.
--deckhouse-tag
Specific Deckhouse build tag to pull. Conflicts with --since-version and --include-platform. If registry contains release channel image for specified tag, all release channels in the bundle will be pointed to it.
--dry-run
Print what would be pulled without downloading any images. Useful for fast validation of flags and filters.
--exclude-module, -e
Blacklist specific modules from downloading. Format is "module-name[@constraint]", the same dialect as --include-module, quoting included. Use one flag per each module. Overridden by use of --include-module.
--exclude-package
Blacklist specific packages from downloading. Format is "package-name[@constraint]", the same dialect as --include-module, quoting included. Use one flag per each package. Overridden by use of --include-package.
--force
Overwrite existing bundle packages if they are conflicting with current pull operation.
--gost-digest
Calculate GOST R 34.11-2012 STREEBOG digest for downloaded bundle
--ignore-suspend
Ignore suspended release channels and continue mirroring. Use with caution.
--images-bundle-chunk-size, -c
Split resulting bundle file into chunks of at most N gigabytes
--include-module, -i
Whitelist specific modules for downloading. Format is "module-name[@constraint]". Use one flag per each module. Disables blacklisting by --exclude-module. Quote the whole value when the constraint uses >= or <=: --include-module "module-name@>=1.3.0". Unquoted, the shell takes > as a redirection and d8 receives a module with no version. A constraint keeps the latest patch in each minor it covers, plus whatever the release channels point at. Versions named with >= or <= are kept as well. An exact tag (=) pins one tag and publishes it to the release channels. Given v1.0.0, v1.1.0, v1.2.0, v1.3.0, v1.3.3, v1.4.0, v1.4.1: module-name only what the release channels point at, like a pull with no filters module-name@1.3.0 >=1.3.0 <2.0.0, same major line: v1.3.3, v1.4.1 module-name@~1.3.0 >=1.3.0 <1.4.0: v1.3.3 module-name@^1.3.0 >=1.3.0 <2.0.0: v1.3.3, v1.4.1 "module-name@>=1.3.0" the same, plus the named v1.3.0 "module-name@>=1.3.0 <=1.4.0" v1.3.0, v1.3.3, v1.4.0 module-name@=v1.3.0 only v1.3.0, published to every release channel module-name@=v1.3.0+stable only v1.3.0, published to stable module-name@=bobV1 only the bobV1 tag, published to every release channel For a 0.x module the bare form spans the whole 0.x line (0.4.0 means >=0.4.0 <1.0.0) while the caret locks the minor (^0.4.0 means >=0.4.0 <0.5.0).
--include-package
Whitelist specific packages for downloading. Format is "package-name[@constraint]", the same dialect as --include-module, quoting included. Use one flag per each package. Disables blacklisting by --exclude-package. Packages live under the packages/ registry segment, with release metadata under packages//version.
--include-platform
Select platform releases to download by a semver constraint. Same dialect as the version part of --include-module. Conflicts with --since-version and --deckhouse-tag. Always quote the value: > and < are shell redirections. A constraint keeps the latest patch in each minor it covers. Versions named with >= or <= are kept as well. An exact tag (=) pins one release and propagates it to the release channels, just like --deckhouse-tag. Given platform releases v1.63.x .. v1.71.x: ">=1.64 <=1.68" latest patch per minor in v1.64..v1.68, plus v1.64.0 and v1.68.0 "~1.65.0" latest v1.65.x patch "^1.65.0" latest patch per minor from v1.65.x up "1.65.0" same as ^1.65.0 here: platform majors are always >= 1 "=v1.65.3" only v1.65.3, published to every release channel "=v1.65.3+stable" only v1.65.3; the +channel suffix is accepted but changes nothing here
--include-plugin
Mirror a specific d8 CLI plugin in addition to the automatic selection. Format is "plugin-name[@constraint]", the same dialect as --include-module, quoting included. Use one flag per each plugin. Plugins live under the deckhouse-cli/plugins registry segment. Without this flag, plugins required by the mirrored modules (and their plugin dependencies) are selected automatically.
--insecure
Interact with registries over HTTP.
--installer-tag
Specific Deckhouse installer build tag to pull. If not specified, the latest tag for the installer will be pulled from the registry path.
--license, -l
Deckhouse license key. Shortcut for --source-login=license-token --source-password=<>.
--modules-path-suffix
Registry path suffix to read modules from, relative to the source repo. Use "/" to read modules from the repo root.
--no-installer
Do not pull Deckhouse installer into bundle.
--no-modules
Do not pull Deckhouse modules into bundle.
--no-packages
Do not pull Deckhouse packages into bundle.
--no-platform
Do not pull Deckhouse Kubernetes Platform into bundle.
--no-pull-resume
Do not continue last unfinished pull operation and start from scratch.
--no-security-db
Do not pull security databases into bundle.
--only-extra-images
Pull only extra images for modules (additional images like security databases, scanners, etc.) without pulling main module images.
--proxy-registry
Pull from a proxy/caching registry that does not implement the registry catalog API. Instead of calling the registry's "list tags" endpoint (which proxy registries typically return empty), this mode probes individual tags by incrementing patch -> minor -> major from the version explicitly named via --include-platform / --include-module. The probe stops once both a new patch and a new minor of the current major fail to resolve, then attempts the next major; if that also fails the probe terminates and downloads what was discovered. Requires --include-platform when platform is not skipped via --no-platform, and at least one --include-module when modules are not skipped via --no-modules. --exclude-module and --no-platform are respected. Cannot be combined with --deckhouse-tag or --since-version (use --include-platform's lower bound instead).
--since-version
Minimal Deckhouse release to pull. Ignored if above current Rock Solid release. Conflicts with --deckhouse-tag.
--skip-vex-images
Do not pull VEX images.
--source
Source registry to pull Deckhouse images from (format: registry-host[:port]/path).
--source-login
Source registry login.
--source-password
Source registry password.
--tls-skip-verify
Disable TLS certificate validation.
--tmp-dir
Path to a temporary directory to use for image pulling and pushing. All processing is done in this directory, so make sure there is enough free disk space to accommodate the entire bundle you are downloading;
--verbose-summary
List every module and package in the end-of-pull summary with its resolved versions (and VEX count, when present), instead of just the totals. Output only - it does not change what is pulled.

d8 mirror push

Usage:

d8 mirror push [images-bundle-path] <registry> [options]

Copy Deckhouse Kubernetes Platform distribution to the third-party registry

Upload Deckhouse Kubernetes Platform distribution bundle to the third-party registry.

This command pushes the Deckhouse Kubernetes Platform distribution into the specified container registry.

For more information on how to use it, consult the docs at 
https://deckhouse.io/products/kubernetes-platform/documentation/latest/installing/#manual-loading-of-dkp-images-and-vulnerability-db-into-a-private-registry

Additional configuration options for the d8 mirror family of commands are available as environment variables:

 * $SSL_CERT_FILE           — Path to the SSL certificate. If the variable is set, system certificates are not used;
 * $SSL_CERT_DIR            — List of directories to search for SSL certificate files, separated by a colon.
                              If set, system certificates are not used. More info at https://docs.openssl.org/1.0.2/man1/c_rehash/;
 * $HTTP_PROXY/$HTTPS_PROXY — URL of the proxy server for HTTP(S) requests to hosts that are not listed in the $NO_PROXY;
 * $NO_PROXY                — Comma-separated list of hosts to exclude from proxying.
                              Supported value formats include IP's', CIDR notations (1.2.3.4/8), domains, and asterisk sign (*).
                              The IP addresses and domain names can also include a literal port number (1.2.3.4:80).
                              The domain name matches that name and all the subdomains.
                              The domain name with a leading . matches subdomains only.
                              For example, foo.com matches foo.com and bar.foo.com; .y.com matches x.y.com but does not match y.com.
                              A single asterisk * indicates that no proxying should be done;

LICENSE NOTE:
The d8 mirror functionality is exclusively available to users holding a 
valid license for any commercial version of the Deckhouse Kubernetes Platform.

© Flant JSC 2025

Options

--file
`Path` to a tar or chunked package to push. May be repeated to push multiple packages. Can be used instead of the bundle directory argument or combined with it.
--insecure
Interact with registries over HTTP.
--modules-path-suffix
Registry path suffix to push modules to, relative to the target repo. Use "/" to push modules to the repo root.
--registry-login, -u
Username to log into the target registry.
--registry-password, -p
Password to log into the target registry.
--tls-skip-verify
Disable TLS certificate validation.
--tmp-dir
Path to a temporary directory to use for image pulling and pushing. All processing is done in this directory, so make sure there is enough free disk space to accommodate the entire bundle you are downloading;

d8 network

Alias: n

A group of commands to operate network related tasks in The Deckhouse Ecosystem.

A group of commands to operate network related tasks in The Deckhouse Ecosystem.

 © Flant JSC 2025

d8 network cni-migration

Usage:

d8 network cni-migration [options]

A group of commands to switch CNI in the cluster

A group of commands to switch the CNI (Container Network Interface) provider in the DKP.

The migration process is handled automatically by an in-cluster controller.
This CLI tool is used to trigger the migration and monitor its status.

Workflow:

  1. 'd8 network cni-migration switch --to-cni <CNI>' - Initiates the migration.
     This creates a CNIMigration resource, which triggers the deployment of the migration agent.
     The agent then performs all necessary steps (validation, node checks, CNI switching).

  2. 'd8 network cni-migration watch' - (Optional) Monitors the progress of the migration.
     Since the process is automated, this command simply watches the status.

  3. 'd8 network cni-migration cleanup' - Cleans up the migration resources after completion.

d8 network cni-migration cleanup

Usage:

d8 network cni-migration cleanup [options]

Cleans up resources created during CNI switching

d8 network cni-migration switch

Usage:

d8 network cni-migration switch [options]

Initiates the CNI switching

Options

--to-cni
Target CNI provider to switch to. Supported values: cilium, flannel, simple-bridge

d8 network cni-migration watch

Usage:

d8 network cni-migration watch [options]

Monitors the CNI switching progress

d8 package

Package build and bootstrap tool for containerized packages

A plugin for building and bootstrapping packages.

This plugin helps you:
	• Bootstrap new packages from templates with registry configuration
	• Build containerized packages and push them to container registries
	• Manage package lifecycle with semantic versioning

d8 package bootstrap

Usage:

d8 package bootstrap [options]

Bootstrap a new package (module or application)

Bootstrap a new package from templates.

Use 'bootstrap module <name>' for a module (with hooks, CRDs).
Use 'bootstrap app <name>' for an application package (per-instance resources).

d8 package bootstrap app

Alias: application

Usage:

d8 package bootstrap app <name> [options]

Bootstrap a new application package

Bootstrap a new application package from templates.

  • Creates a package with type Application in package.yaml
  • Includes hooks
  • Initializes a git repository with an initial commit

Options

--extended
Generate extended files in the package
--hooks
Generate hooks in the package
--output, -o
Custom path for the package (default: /)
--werf
Use werf file for images

d8 package bootstrap module

Usage:

d8 package bootstrap module <name> [options]

Bootstrap a new module package

Bootstrap a new module package from templates.

  • Creates a package with type Module in package.yaml
  • Includes hooks and CRDs; templates use package name
  • Initializes a git repository with an initial commit

Options

--extended
Generate extended files in the package
--hooks
Generate hooks in the package
--output, -o
Custom path for the package (default: /)
--werf
Use werf file for images

d8 package build

Usage:

d8 package build --version <version> [--repository <repository>] [--force] [options]

Build and push a package to a container registry

Build a package using Werf and push it to a container registry.

This command:
  • Validates the package structure (package.yaml)
  • Builds container images using Werf in a Docker container
  • Pushes the built images to the specified registry
  • Tags images with semantic version

Environment Variables:
  PACKAGE_BUILD_REPOSITORY                Registry URL for build command
  PACKAGE_BUILD_REPOSITORY_USER           Registry username for authentication
  PACKAGE_BUILD_REPOSITORY_TOKEN          Registry token for authentication
  PACKAGE_BUILD_FINAL_REPOSITORY          Final registry URL for the published artifact
  PACKAGE_BUILD_FINAL_REPOSITORY_USER     Final registry username for authentication
  PACKAGE_BUILD_FINAL_REPOSITORY_TOKEN    Final registry token for authentication
  PACKAGE_BUILD_INSECURE                  Allow plain HTTP and skip TLS verification

Options

--debug
enable debug logging
--final-repo
Final repository (env: PACKAGE_BUILD_FINAL_REPOSITORY)
--final-token
Final registry token (env: PACKAGE_BUILD_FINAL_REPOSITORY_TOKEN)
--final-user
Final registry user (env: PACKAGE_BUILD_FINAL_REPOSITORY_USER)
--force, -f
force update version in registry
--insecure
Allow plain HTTP and skip TLS verification for every registry used by the build, including the final repository and base-image pulls (env: PACKAGE_BUILD_INSECURE)
--repo, -r
Repository (env: PACKAGE_BUILD_REPOSITORY)
--sign
sign package with certificate and key. --sign-cert and --sign-key are required
--sign-cert
sign certificate path or base64 string (env: PACKAGE_BUILD_SIGN_CERT)
--sign-key
sign key path or base64 string or vault url (env: PACKAGE_BUILD_SIGN_KEY)
--token, -t
Registry token (env: PACKAGE_BUILD_REPOSITORY_TOKEN)
--user, -u
Registry user (env: PACKAGE_BUILD_REPOSITORY_USER)
--version, -v
Package version

d8 package doc

Usage:

d8 package doc [linter] [options]

Show documentation for verify linters and rules

Show documentation for the linters run by 'package verify'.

Use 'package doc' to list every linter.

Use 'package doc <linter>' to see what a linter checks, the rules it runs with
their default severities, and the .pkglint.yaml keys that configure it.

Use 'package doc <linter> --rule <rule>' to see what makes a single rule report a
finding and how to satisfy it.

A rule's impact caps the severity of its findings: ignored hides them, warn
reports them without failing, error fails verification.

Options

--rule
Show documentation for a single rule of the linter

d8 package render

Usage:

d8 package render [options]

Render package templates to Kubernetes manifests

Render a package's templates to Kubernetes manifests using stubbed runtime values.

Use 'package render' in a package directory to preview the manifests that would be
installed in a cluster. Image digests, registry and credentials are stubbed, so the
output is a smoke-check preview, not a faithful representation of a real cluster.

Use 'package render --remote <registry-path>/<package>:<version>' to render a
published bundle image instead of the current directory. The image must exist and
must carry an explicit tag or digest. Only the bundle image is renderable: the
release image ships without a templates directory.

Registry credentials default to the ambient Docker keychain. Pass --remote-user and
--remote-password to authenticate explicitly, or set them in the environment:

  PACKAGE_REMOTE_USER      fallback for --remote-user
  PACKAGE_REMOTE_PASSWORD  fallback for --remote-password

Use --file to print only the manifests rendered from the template with that file
name, and --render-file to write a clean render (without '# Source:' headers) to a file.

Options

--file
Show only manifests rendered from the template with this file name
--remote, -r
Render a published bundle image by its reference, /:
--remote-password
Registry password or token for --remote (env: PACKAGE_REMOTE_PASSWORD)
--remote-user
Registry user for --remote (env: PACKAGE_REMOTE_USER)
--render-file
Write the clean render (without '# Source:' headers) to this file path

d8 package verify

Usage:

d8 package verify [options]

Verify a package structure and configuration

Verify a package structure and configuration.

Use 'package verify' to verify the current package directory against the
'static' linter settings.

Use 'package verify remote <registry-path> <package>' to verify a published
package instead.

Linter configuration can be customized via .pkglint.yaml in the package root.

Options

--hide-warnings
Hide warning-level messages
--lint-config
Path to lint config file
--show-ignored
Show ignored-level messages

d8 package verify remote

Usage:

d8 package verify remote <registry-path> <package> [options]

Verify a published package from a registry

Verify a published package.

The arguments are the registry path the package is published under and the package
name. Build publishes two images per version, both tagged with that version:

  bundle   <registry-path>/<package>:<version>
           checked against the 'remote.bundle' linter settings
  release  <registry-path>/<package>/version:<version>
           checked against the 'remote.release' linter settings

Without --version the latest published version is verified, chosen by comparing the
repository tags as semver. The bundle image carries the package itself and is always
verified; add --release to verify the release image alongside it, in which case both
are verified concurrently and each must exist.

Lint settings are read from the working directory, not from the image: published
images do not carry a .pkglint.yaml.

Options

--release
Also verify the release image published for the version
--version
Version to verify (default: the latest published version)

Global options

--hide-warnings
Hide warning-level messages
--lint-config
Path to lint config file
--show-ignored
Show ignored-level messages

d8 snapshot

Snapshot operations (create, delete, download, restore, upload, get)

d8 snapshot create

Usage:

d8 snapshot create <name> [options]

Create a Snapshot of a namespace

Create a Snapshot object that captures a namespace's state/configuration.

The Snapshot is created in the target namespace (defaults to the kubeconfig context
namespace). An empty selector captures the whole namespace; pass --selector to capture
only the objects matching the given labels (sets spec.resourceSelector.matchLabels).

The Snapshot is reconciled asynchronously by the state-snapshotter controller. Use --wait
to block until it reports Ready, after which it can be listed, downloaded, and imported.

Options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)
--namespace, -n
namespace to create the Snapshot in (defaults to the kubeconfig context namespace)
--output, -o
Output format: name|json|yaml
--selector, -l
capture only objects matching this label selector (e.g. app=demo,tier=db); sets spec.resourceSelector.matchLabels
--timeout
timeout for --wait
--wait
wait until the Snapshot reports Ready

d8 snapshot delete

Usage:

d8 snapshot delete [name...] [options]

Delete one or more Snapshots

Delete Snapshot objects in a namespace.

Targets are selected in exactly one of three ways:
  - by name:      d8 snapshot delete snap-a snap-b -n demo
  - by selector:  d8 snapshot delete -l app=demo -n demo
  - all:          d8 snapshot delete --all -n demo

Deleting a Snapshot lets the state-snapshotter controller garbage-collect the
associated SnapshotContent and data artifacts. Use --wait to block until the
Snapshot objects are fully removed from the API server.

Options

--all
delete all Snapshots in the namespace
--context
The name of the kubeconfig context to use
--ignore-not-found
do not error if a named Snapshot does not exist
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)
--namespace, -n
namespace of the Snapshots (defaults to the kubeconfig context namespace)
--selector, -l
delete Snapshots matching this label selector (e.g. app=demo,tier=db)
--timeout
timeout for --wait
--wait
wait until the Snapshots are fully deleted

d8 snapshot describe

Usage:

d8 snapshot describe [flags] <name> [options]

Show the snapshot hierarchy as a tree

Options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)
--namespace, -n
snapshot namespace (defaults to the kubeconfig context namespace)

d8 snapshot download

Usage:

d8 snapshot download [flags] <snapshot> [options]

Download a snapshot to a local directory tree

Download a Snapshot CR's manifest tree and volume data into a local directory tree
(consumed by 'd8 snapshot upload' or 'd8 snapshot restore').

--publish selects how each data leaf's volume bytes are streamed from its DataExport
exporter pod. With --publish=false (or when autodetection picks it), bytes come straight
from the exporter's in-cluster service, trusting only its internal CA (status.ca). With
--publish=true, bytes come through the storage-foundation-published Ingress endpoint
(status.publicURL) instead, so a kubeconfig without direct network access to the cluster's
internal service network can still download. If --publish is not given, the command probes
whether the in-cluster exporter endpoint is reachable and picks accordingly. Reusing an
existing DataExport upgrades its spec.publish from false to true when --publish=true is
requested, but never downgrades it back to false, so a concurrent run streaming through the
public endpoint is never torn down. IMPORTANT: the publish path works only with a kubeconfig
authenticated by a bearer token. Ingress terminates TLS with its own certificate and does not
forward the client's TLS certificate to the exporter pod, so a certificate-based kubeconfig
receives a 401 when --publish=true.

Options

--cleanup
delete the per-volume DataExport (and its server-side export chain) after each volume completes; --cleanup=false leaves them in the cluster for debugging
--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)
--max-parallel-downloads
global cap on concurrent whole-volume-stream downloads across all nodes (independent of --workers and --per-volume-concurrency)
--namespace, -n
snapshot namespace (required)
--node
restrict download to a single node subtree; format '/' (e.g. --node DemoVirtualDisk/bk-disk-a, --node Snapshot/my-snap); the generated snapshot CR name form (e.g. DemoVirtualDiskSnapshot/nss-child-abc) is still accepted
--output, -o
root output directory (required)
--per-volume-concurrency
maximum parallel chunk/file downloads per volume; lower to 1 on a distant or flaky link if long-lived streams keep breaking
--publish
download volume data through the published (ingress) exporter endpoint instead of the in-cluster service; if unset, the in-cluster endpoint's reachability is auto-detected
--ttl
DataExport TTL (e.g. 2h, 30m)
--volume-compression
volume compression codec (none, zstd); block volumes: data.bin[.]; filesystem volumes: per-file compressed entries inside an uncompressed data.tar container
--volume-compression-level
compression level for the selected codec (0 = codec default; ignored when --volume-compression=none)
--workers
maximum number of nodes downloaded concurrently

d8 snapshot get

Aliases: list, ls

Usage:

d8 snapshot get [options]

List Snapshot resources in the cluster

Options

--all-namespaces, -A
list Snapshots across all namespaces
--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)
--namespace, -n
namespace to list Snapshots from (defaults to the kubeconfig context namespace)
--output, -o
Output format: table|json|yaml

d8 snapshot local

Usage:

d8 snapshot local [options]

Operate on a locally downloaded snapshot archive (no kubeconfig required)

d8 snapshot local describe

Usage:

d8 snapshot local describe <DIR> [options]

Show the structure of a locally downloaded snapshot archive as a tree

Show the structure of a locally downloaded snapshot archive as a tree.

By default, every node's content checksum and authenticated snapshot.yaml metadata are
verified before any output is rendered. Legacy archives without formatVersion and
metadataChecksum are rejected because their identity and volume metadata are unauthenticated.
Use --allow-unauthenticated-legacy only to inspect a trusted pre-version archive; the command
emits a warning because compatibility mode cannot distinguish a genuine legacy archive from a
downgraded and tampered current archive.

Options

--allow-unauthenticated-legacy
allow trusted pre-version archives with unauthenticated snapshot.yaml metadata (unsafe compatibility mode)

d8 snapshot local get

Usage:

d8 snapshot local get <DIR> [options]

Print a one-line summary of a locally downloaded snapshot archive

Print a one-line summary of a locally downloaded snapshot archive.

By default, every node's content checksum and authenticated snapshot.yaml metadata are
verified before any output is rendered. Legacy archives without formatVersion and
metadataChecksum are rejected because their identity and volume metadata are unauthenticated.
Use --allow-unauthenticated-legacy only to inspect a trusted pre-version archive; the command
emits a warning because compatibility mode cannot distinguish a genuine legacy archive from a
downgraded and tampered current archive.

Options

--allow-unauthenticated-legacy
allow trusted pre-version archives with unauthenticated snapshot.yaml metadata (unsafe compatibility mode)

d8 snapshot restore

Usage:

d8 snapshot restore [flags] <snapshot> [options]

Restore a snapshot in-place into its namespace

Restore a snapshot tree in-namespace.

The snapshot is restored into the same namespace it lives in: -n/--namespace is both
the source Snapshot namespace and the restore target. The required VolumeSnapshot /
VirtualDiskSnapshot leaves must already be present in that namespace (they exist after
the original snapshot, or after the snapshot is re-created in this namespace).

Cross-namespace restore is not a single command: it is a separate procedure that downloads
the snapshot from the source namespace, re-creates the Snapshot and its volume-snapshot
leaves in the target namespace, and then runs restore there.

The client walks the selected namespaced snapshot hierarchy and asks the server to compile
one node at a time. Every node response is independently size-bounded, and the complete
child-before-parent result is staged and validated before the first apply. PersistentVolumeClaims
already carry spec.dataSourceRef pointing at the VolumeSnapshot (or VirtualDiskSnapshot for
domain disks) present in the namespace, so CSI provisions the data.

--node restricts the restore to a single node subtree. The positional Snapshot always
anchors the hierarchy and must exist; the selection may use either the generated snapshot-CR
Kind/name or the original captured source Kind/name. A Ready child selected by its generated
identity remains restorable when the root is DEGRADED because an unrelated sibling CR was
deleted. Selecting that deleted generated child reports that it belongs to the tree but is
missing. Original-source selection fails closed while any child ref is unresolved, because a
missing child's original identity cannot be inspected; retry with the live match's generated
Kind/name and --node-api-version shown in the error.

--node-api-version disambiguates nodes whose selected Kind/name is shared across API groups
or versions. Use "v1" for the Kubernetes core group, or "<group>/<version>" for a named group.
It requires --node and must match the generated or original identity used by that selection.

--scope narrows how much of the addressed node (the root, or --node's selection) the server
compiles: "subtree" (default) compiles the node and its whole subtree, recursively; "node"
compiles only the addressed node itself, with no descendants. --scope node with no --node
selects the root Snapshot node alone.

--object restricts a --scope node restore to a single captured object within that node, by
"<Kind>/<name>"; it requires --scope node and fails fast, before any network call, otherwise.

--dry-run sends every apply with DryRunAll so the API server validates and admits objects
(schema validation, webhooks, immutable-field checks) without persisting them. Use it to
preflight a restore before committing. The --wait loop is skipped in dry-run mode because
no objects are actually created.

Without --edit or --dry-run, an interactive restore automatically opens one editor session
when the pre-mutation DryRunAll pass returns Kubernetes Invalid (HTTP 422), including schema,
webhook, and immutable-field Invalid responses. Both stdin and stdout must be terminals.
Use --no-auto-edit to opt out. Conflict (HTTP 409), AlreadyExists, conflicting duplicate
manifests, and an existing Bound PVC never trigger automatic editing. A generic Invalid
response does not imply that the object already exists or that an immutable field differs.
After an automatic edit, restore restages and validates the complete manifest set and retries
the full DryRunAll pass once; a repeated Invalid is returned without reopening the editor.
Explicit --edit opens before preflight and suppresses later automatic editing. Explicit
--dry-run never opens the automatic editor. In non-interactive use, Invalid is returned
with the original API response preserved as its cause and without invoking an editor.
Editor selection is $KUBE_EDITOR, then $EDITOR,
falling back to vi; a blank selected command, failed editor, unchanged file, or empty file
aborts instead of applying.

Before any dry-run or real apply, restore reads every target PersistentVolumeClaim. If a
same-named claim is already Bound, restore refuses to reuse it because that status may
describe stale data from an earlier operation. Restore never deletes or replaces the claim.

--wait only tracks PersistentVolumeClaims that appear in the restored manifest set, and it
reports when this command's own wait is over, not when a workload can use the restored data.
Disk-backed PVCs for domain objects are recreated asynchronously by the domain controller (not
part of this output), so they are not awaited; the command may return before such volumes finish
provisioning. A Pending PVC on a WaitForFirstConsumer StorageClass is not awaited while it has no
selected node, live Pod consumer, active provisioning event, or terminal provisioning failure:
every such claim is listed once, by namespace/name and StorageClass, as a claim this command does
not wait to become Bound. Once selected, consumed, or provisioning, it is polled until Bound
or --timeout; an observed provisioning failure is returned with its cause. An expired --timeout
means only that the wait could not be confirmed within that period: the objects were already
applied and are not rolled back. Success revalidates the post-apply PVC UID, restore source, and
bound PersistentVolume identity; it does not promise that every restored PVC is Bound.

Options

--context
The name of the kubeconfig context to use
--dry-run
validate objects via DryRunAll without persisting; skips --wait (use to preflight a restore)
--edit
open resolved manifests in $KUBE_EDITOR/$EDITOR (falling back to vi) before applying; aborts on non-zero exit, unchanged, or empty content
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)
--namespace, -n
snapshot namespace; also the restore target namespace (required)
--no-auto-edit
disable the one automatic editor session for interactive Kubernetes Invalid (HTTP 422) preflight responses
--node
restrict restore to a single node subtree; format '/' (e.g. --node DemoVirtualDisk/bk-disk-a); the generated snapshot CR name form (e.g. DemoVirtualDiskSnapshot/nss-child-abc123) is still accepted
--node-api-version
disambiguate --node by exact API version: 'v1' for core resources or '/' for named groups (requires --node)
--object
restrict a --scope node restore to a single captured object; format '/' (requires --scope node)
--scope
restore scope: 'subtree' (default) compiles the addressed node and its whole subtree; 'node' compiles only the addressed node itself
--timeout
bounds the --wait Bound check only; an expired timeout does not roll back the applied objects
--wait
wait for applicable manifest PVCs to become Bound; a dormant WaitForFirstConsumer PVC with no selected node, live consumer, or provisioning signal is listed by name and is not awaited

d8 snapshot upload

Alias: import

Usage:

d8 snapshot upload [flags] [options]

Upload a downloaded snapshot archive into a namespace

Upload a local snapshot archive (produced by 'd8 snapshot download') into a namespace.

The archive tree is reconstructed in stages: first every import-mode CR is created
top-down (parents before children) so each child carries a child->parent ownerRef the
state-snapshotter binders use to attach it to its parent; then every node's manifests plus
direct child refs are uploaded to the state-snapshotter aggregated API; only after all
manifests are uploaded are the data-leaf volume bytes uploaded via a DataImport. Manifests
are uploaded before any volume data because a leaf's DataImport stays pending until the leaf
VolumeSnapshot is bound, which requires its ancestors' manifests to already be present.
After the whole tree is uploaded it waits for the root Snapshot and its bound SnapshotContent
to become Ready, leaving the namespace ready for 'd8 snapshot restore'.

--node restricts the upload to a single node and its descendants. The selected node becomes
the upload root; it must be a core Snapshot, a CSI VolumeSnapshot data leaf, or a domain
data leaf (e.g. DemoVirtualDiskSnapshot). Domain aggregator nodes (a DemoVirtualMachineSnapshot
that references child snapshots) and manifest-only domain nodes cannot be selected as the
upload root (they have no parent SnapshotContent to attach to when uploaded standalone); they
are uploaded only as part of a full-archive upload (omit --node) or by selecting an ancestor
Snapshot.

Scope and limitations:
  - Full Snapshot trees are uploaded as-is, including domain aggregator nodes (a
    DemoVirtualMachineSnapshot that aggregates child DemoVirtualDiskSnapshot nodes): the CLI
    creates each node's unified import marker and uploads its manifests + child refs, and the
    server-side genericbinder reconstructs the aggregator's content from its children's
    SnapshotContents. The aggregator is a non-root node in this case, so no DataImport is
    created for it (only its data-leaf descendants stream volume bytes).
  - Manifest-only domain nodes (e.g. a disk-less DemoVirtualMachineSnapshot, which carries
    only manifests) are uploaded as part of their parent tree (the server materialises their
    content from the uploaded manifests alone, with no data leg).
  - A domain aggregator can be reconstructed only within a tree, never as a standalone --node
    root. To upload an individual disk snapshot from such a tree on its own, use
    --node <DomainDataLeafKind>/<name> (e.g. --node DemoVirtualDiskSnapshot/dvd-1).
  - Both block-volume and filesystem-volume data leaves are supported.
  - Filesystem archives can upload regular files only. Symlink, hardlink, device, FIFO, and
    socket entries, plus empty directories other than well-known filesystem-reserved names
    (for example lost+found), cannot be uploaded: the protocol supports only regular-file
    PUTs, and creates directories only as a side effect of a file PUT inside them.
  - --skip-unsupported-fs-entries uploads the supported regular files instead of failing,
    but causes data loss for each skipped path; review the bounded post-upload summary.
  - Legacy archives without formatVersion and metadataChecksum are rejected by default because
    their snapshot.yaml identity and volume metadata are unauthenticated. Use
    --allow-unauthenticated-legacy only for deliberate migration or inspection of trusted
    pre-version archives; this mode cannot distinguish a genuine legacy archive from a
    downgraded and tampered current archive.
  - Uploading requires RBAC to create DataImport (storage-volume-data-manager) and to call
    the manifests-and-children-refs-upload subresource (e.g. an admin kubeconfig); the
    read-only snapshot admin role is not sufficient.

--publish selects how each data leaf's bytes are streamed to its DataImport importer pod.
With --publish=false (or when autodetection picks it), bytes go straight to the importer's
in-cluster service, trusting only its internal CA (status.ca). With --publish=true, bytes go
through the storage-foundation-published Ingress endpoint (status.publicURL) instead, so a
kubeconfig without direct network access to the cluster's internal service network can still
upload. If --publish is not given, the command probes whether the in-cluster importer endpoint
is reachable and picks accordingly. IMPORTANT: the publish path works only with a kubeconfig
authenticated by a bearer token. Ingress terminates TLS with its own certificate and does not
forward the client's TLS certificate to the importer pod, so a certificate-based kubeconfig
receives a 401 when --publish=true.

Options

--allow-existing
downgrade namespace preflight conflict check to a warning (import-mode markers from a prior run are never conflicts regardless of this flag)
--allow-unauthenticated-legacy
allow trusted pre-version archives whose snapshot.yaml metadata is unauthenticated (unsafe; explicit compatibility mode)
--context
The name of the kubeconfig context to use
--input, -i
root archive directory produced by 'd8 snapshot download' (required)
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)
--namespace, -n
target namespace to import into (required)
--node
restrict import to a single node subtree; format '/' (e.g. --node VolumeSnapshot/pvc-1)
--publish
upload volume data through the published (ingress) importer endpoint instead of the in-cluster service; if unset, the in-cluster endpoint's reachability is auto-detected
--skip-unsupported-fs-entries
skip unsupported filesystem entries and report them after upload (causes data loss for skipped paths)
--timeout
timeout for per-node readiness/completion waits
--ttl
idle TTL for each data-leaf DataImport (e.g. 2h, 30m); must exceed the importer's provisioning and post-upload completion time
--workers
maximum number of data-leaf volume uploads to run in parallel (fixed cap via errgroup.SetLimit; default 5)

d8 status

Get cluster status information

Get status information about Deckhouse Kubernetes Platform

 © Flant JSC 2025

Options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 stronghold

Deckhouse Stronghold commands

d8 stronghold audit

Usage:

d8 stronghold [command] [args...] audit [options]

Interact with audit devices

d8 stronghold audit disable

Usage:

d8 stronghold [command] [args...] audit disable [options]

Disables an audit device

d8 stronghold audit enable

Usage:

d8 stronghold [command] [args...] audit enable [options]

Enables an audit device

d8 stronghold audit list

Usage:

d8 stronghold [command] [args...] audit list [options]

Lists enabled audit devices

d8 stronghold auth

Usage:

d8 stronghold [command] [args...] auth [options]

Interact with auth methods

d8 stronghold auth disable

Usage:

d8 stronghold [command] [args...] auth disable [options]

Disables an auth method

d8 stronghold auth enable

Usage:

d8 stronghold [command] [args...] auth enable [options]

Enables a new auth method

d8 stronghold auth help

Usage:

d8 stronghold [command] [args...] auth help [options]

Prints usage for an auth method

d8 stronghold auth list

Usage:

d8 stronghold [command] [args...] auth list [options]

Lists enabled auth methods

d8 stronghold auth move

Usage:

d8 stronghold [command] [args...] auth move [options]

Move an auth method to a new path

d8 stronghold auth tune

Usage:

d8 stronghold [command] [args...] auth tune [options]

Tunes an auth method configuration

d8 stronghold debug

Usage:

d8 stronghold [command] [args...] debug [options]

Runs the debug command

d8 stronghold delete

Usage:

d8 stronghold [command] [args...] delete [options]

Delete secrets and configuration

d8 stronghold events

Usage:

d8 stronghold [command] [args...] events [options]

d8 stronghold events subscribe

Usage:

d8 stronghold [command] [args...] events subscribe [options]

Subscribe to events

d8 stronghold kv

Usage:

d8 stronghold [command] [args...] kv [options]

Interact with Stronghold's Key-Value storage

d8 stronghold kv delete

Usage:

d8 stronghold [command] [args...] kv delete [options]

Deletes versions in the KV store

d8 stronghold kv destroy

Usage:

d8 stronghold [command] [args...] kv destroy [options]

Permanently removes one or more versions in the KV store

d8 stronghold kv enable-versioning

Usage:

d8 stronghold [command] [args...] kv enable-versioning [options]

Turns on versioning for a KV store

d8 stronghold kv get

Usage:

d8 stronghold [command] [args...] kv get [options]

Retrieves data from the KV store

d8 stronghold kv list

Usage:

d8 stronghold [command] [args...] kv list [options]

List data or secrets

d8 stronghold kv metadata

Usage:

d8 stronghold [command] [args...] kv metadata [options]

Interact with Stronghold's Key-Value storage

d8 stronghold kv metadata delete

Usage:

d8 stronghold [command] [args...] kv metadata delete [options]

Deletes all versions and metadata for a key in the KV store

d8 stronghold kv metadata get

Usage:

d8 stronghold [command] [args...] kv metadata get [options]

Retrieves key metadata from the KV store

d8 stronghold kv metadata patch

Usage:

d8 stronghold [command] [args...] kv metadata patch [options]

Patches key settings in the KV store

d8 stronghold kv metadata put

Usage:

d8 stronghold [command] [args...] kv metadata put [options]

Sets or updates key settings in the KV store

d8 stronghold kv patch

Usage:

d8 stronghold [command] [args...] kv patch [options]

Sets or updates data in the KV store without overwriting

d8 stronghold kv put

Usage:

d8 stronghold [command] [args...] kv put [options]

Sets or updates data in the KV store

d8 stronghold kv rollback

Usage:

d8 stronghold [command] [args...] kv rollback [options]

Rolls back to a previous version of data

d8 stronghold kv undelete

Usage:

d8 stronghold [command] [args...] kv undelete [options]

Undeletes versions in the KV store

d8 stronghold lease

Usage:

d8 stronghold [command] [args...] lease [options]

Interact with leases

d8 stronghold lease lookup

Usage:

d8 stronghold [command] [args...] lease lookup [options]

Lookup the lease of a secret

d8 stronghold lease renew

Usage:

d8 stronghold [command] [args...] lease renew [options]

Renews the lease of a secret

d8 stronghold lease revoke

Usage:

d8 stronghold [command] [args...] lease revoke [options]

Revokes leases and secrets

d8 stronghold list

Usage:

d8 stronghold [command] [args...] list [options]

List data or secrets

d8 stronghold login

Usage:

d8 stronghold [command] [args...] login [options]

Authenticate locally

d8 stronghold monitor

Usage:

d8 stronghold [command] [args...] monitor [options]

Stream log messages from a Stronghold server

d8 stronghold namespace

Usage:

d8 stronghold [command] [args...] namespace [options]

Interact with namespaces

d8 stronghold namespace create

Usage:

d8 stronghold [command] [args...] namespace create [options]

Create a new namespace

d8 stronghold namespace delete

Usage:

d8 stronghold [command] [args...] namespace delete [options]

Delete an existing namespace

d8 stronghold namespace list

Usage:

d8 stronghold [command] [args...] namespace list [options]

List child namespaces

d8 stronghold namespace lock

Usage:

d8 stronghold [command] [args...] namespace lock [options]

Lock the API for particular namespaces

d8 stronghold namespace lookup

Usage:

d8 stronghold [command] [args...] namespace lookup [options]

Look up an existing namespace

d8 stronghold namespace patch

Usage:

d8 stronghold [command] [args...] namespace patch [options]

Patch an existing namespace

d8 stronghold namespace unlock

Usage:

d8 stronghold [command] [args...] namespace unlock [options]

Unlock the API for particular namespaces

d8 stronghold operator

Usage:

d8 stronghold [command] [args...] operator [options]

Perform operator-specific tasks

d8 stronghold operator generate-root

Usage:

d8 stronghold [command] [args...] operator generate-root [options]

Generates a new root, DR operation, or recovery token

d8 stronghold operator init

Usage:

d8 stronghold [command] [args...] operator init [options]

Initializes a server

d8 stronghold operator key-status

Usage:

d8 stronghold [command] [args...] operator key-status [options]

Provides information about the active encryption key

d8 stronghold operator members

Usage:

d8 stronghold [command] [args...] operator members [options]

Returns the list of nodes in the cluster

d8 stronghold operator raft

Usage:

d8 stronghold [command] [args...] operator raft [options]

Interact with Vault's raft storage backend

d8 stronghold operator raft autopilot

Usage:

d8 stronghold [command] [args...] operator raft autopilot [options]

d8 stronghold operator raft autopilot get-config

Usage:

d8 stronghold [command] [args...] operator raft autopilot get-config [options]

Returns the configuration of the autopilot subsystem under integrated storage

d8 stronghold operator raft autopilot set-config

Usage:

d8 stronghold [command] [args...] operator raft autopilot set-config [options]

Modify the configuration of the autopilot subsystem under integrated storage

d8 stronghold operator raft autopilot state

Usage:

d8 stronghold [command] [args...] operator raft autopilot state [options]

Displays the state of the raft cluster under integrated storage as seen by autopilot

d8 stronghold operator raft demote

Usage:

d8 stronghold [command] [args...] operator raft demote [options]

Demotes a voter to a permanent non-voter

d8 stronghold operator raft join

Usage:

d8 stronghold [command] [args...] operator raft join [options]

Joins a node to the Raft cluster

d8 stronghold operator raft list-peers

Usage:

d8 stronghold [command] [args...] operator raft list-peers [options]

Returns the Raft peer set

d8 stronghold operator raft promote

Usage:

d8 stronghold [command] [args...] operator raft promote [options]

Promotes a permanent non-voter to a voter

d8 stronghold operator raft remove-peer

Usage:

d8 stronghold [command] [args...] operator raft remove-peer [options]

Removes a node from the Raft cluster

d8 stronghold operator raft snapshot

Usage:

d8 stronghold [command] [args...] operator raft snapshot [options]

Restores, saves and inspects snapshots from the Raft cluster

d8 stronghold operator raft snapshot inspect

Usage:

d8 stronghold [command] [args...] operator raft snapshot inspect [options]

Inspects a Raft snapshot

d8 stronghold operator raft snapshot restore

Usage:

d8 stronghold [command] [args...] operator raft snapshot restore [options]

Installs the provided snapshot, returning the cluster to the state defined in it

d8 stronghold operator raft snapshot save

Usage:

d8 stronghold [command] [args...] operator raft snapshot save [options]

Saves a snapshot of the current state of the Raft cluster into a file

d8 stronghold operator rekey

Usage:

d8 stronghold [command] [args...] operator rekey [options]

Generates new unseal keys

d8 stronghold operator rotate

Usage:

d8 stronghold [command] [args...] operator rotate [options]

Rotates the underlying encryption key

d8 stronghold operator seal

Usage:

d8 stronghold [command] [args...] operator seal [options]

Seals the Stronghold server

d8 stronghold operator step-down

Usage:

d8 stronghold [command] [args...] operator step-down [options]

Forces Stronghold to resign active duty

d8 stronghold operator unseal

Usage:

d8 stronghold [command] [args...] operator unseal [options]

Unseals the Stronghold server

d8 stronghold operator usage

Usage:

d8 stronghold [command] [args...] operator usage [options]

Lists historical client counts

d8 stronghold patch

Usage:

d8 stronghold [command] [args...] patch [options]

Patch data, configuration, and secrets

d8 stronghold path-help

Usage:

d8 stronghold [command] [args...] path-help [options]

Retrieve API help for paths

d8 stronghold pki

Usage:

d8 stronghold [command] [args...] pki [options]

Interact with Stronghold's PKI Secrets Engine

d8 stronghold pki health-check

Usage:

d8 stronghold [command] [args...] pki health-check [options]

Check a PKI Secrets Engine mount's health and operational status

d8 stronghold pki issue

Usage:

d8 stronghold [command] [args...] pki issue [options]

Given a parent certificate, and a list of generation parameters, creates an issuer on a specified mount

d8 stronghold pki list-intermediates

Usage:

d8 stronghold [command] [args...] pki list-intermediates [options]

Determine which of a list of certificates, were issued by a given parent certificate

d8 stronghold pki reissue

Usage:

d8 stronghold [command] [args...] pki reissue [options]

Uses a parent certificate and a template certificate to create a new issuer on a child mount

d8 stronghold pki verify-sign

Usage:

d8 stronghold [command] [args...] pki verify-sign [options]

Check whether one certificate validates another specified certificate

d8 stronghold plugin

Usage:

d8 stronghold [command] [args...] plugin [options]

Interact with Stronghold plugins and catalog

d8 stronghold plugin deregister

Usage:

d8 stronghold [command] [args...] plugin deregister [options]

Deregister an existing plugin in the catalog

d8 stronghold plugin info

Usage:

d8 stronghold [command] [args...] plugin info [options]

Read information about a plugin in the catalog

d8 stronghold plugin list

Usage:

d8 stronghold [command] [args...] plugin list [options]

Lists available plugins

d8 stronghold plugin register

Usage:

d8 stronghold [command] [args...] plugin register [options]

Registers a new plugin in the catalog

d8 stronghold plugin reload

Usage:

d8 stronghold [command] [args...] plugin reload [options]

Reload mounted plugin backend

d8 stronghold plugin reload-status

Usage:

d8 stronghold [command] [args...] plugin reload-status [options]

Get the status of an active or recently completed global plugin reload

d8 stronghold policy

Usage:

d8 stronghold [command] [args...] policy [options]

Interact with policies

d8 stronghold policy delete

Usage:

d8 stronghold [command] [args...] policy delete [options]

Deletes a policy by name

d8 stronghold policy list

Usage:

d8 stronghold [command] [args...] policy list [options]

Lists the installed policies

d8 stronghold policy read

Usage:

d8 stronghold [command] [args...] policy read [options]

Prints the contents of a policy

d8 stronghold policy write

Usage:

d8 stronghold [command] [args...] policy write [options]

Uploads a named policy from a file

d8 stronghold print

Usage:

d8 stronghold [command] [args...] print [options]

Prints runtime configurations

d8 stronghold print token

Usage:

d8 stronghold [command] [args...] print token [options]

Prints token currently in use

d8 stronghold read

Usage:

d8 stronghold [command] [args...] read [options]

Read data and retrieves secrets

d8 stronghold secrets

Usage:

d8 stronghold [command] [args...] secrets [options]

Interact with secrets engines

d8 stronghold secrets disable

Usage:

d8 stronghold [command] [args...] secrets disable [options]

Disable a secret engine

d8 stronghold secrets enable

Usage:

d8 stronghold [command] [args...] secrets enable [options]

Enable a secrets engine

d8 stronghold secrets list

Usage:

d8 stronghold [command] [args...] secrets list [options]

List enabled secrets engines

d8 stronghold secrets move

Usage:

d8 stronghold [command] [args...] secrets move [options]

Move a secrets engine to a new path

d8 stronghold secrets tune

Usage:

d8 stronghold [command] [args...] secrets tune [options]

Tune a secrets engine configuration

d8 stronghold ssh

Usage:

d8 stronghold [command] [args...] ssh [options]

Initiate an SSH session

d8 stronghold status

Usage:

d8 stronghold [command] [args...] status [options]

Print seal and HA status

d8 stronghold token

Usage:

d8 stronghold [command] [args...] token [options]

Interact with tokens

d8 stronghold token capabilities

Usage:

d8 stronghold [command] [args...] token capabilities [options]

Print capabilities of a token on a path

d8 stronghold token create

Usage:

d8 stronghold [command] [args...] token create [options]

Create a new token

d8 stronghold token lookup

Usage:

d8 stronghold [command] [args...] token lookup [options]

Display information about a token

d8 stronghold token renew

Usage:

d8 stronghold [command] [args...] token renew [options]

Renew a token lease

d8 stronghold token revoke

Usage:

d8 stronghold [command] [args...] token revoke [options]

Revoke a token and its children

d8 stronghold transit

Usage:

d8 stronghold [command] [args...] transit [options]

Interact with Stronghold's Transit Secrets Engine

d8 stronghold transit import

Usage:

d8 stronghold [command] [args...] transit import [options]

Import a key into the Transit secrets engines.

d8 stronghold transit import-version

Usage:

d8 stronghold [command] [args...] transit import-version [options]

Import key material into a new key version in the Transit secrets engines.

d8 stronghold unwrap

Usage:

d8 stronghold [command] [args...] unwrap [options]

Unwrap a wrapped secret

d8 stronghold version

Usage:

d8 stronghold [command] [args...] version [options]

Prints the Stronghold CLI version

d8 stronghold version-history

Usage:

d8 stronghold [command] [args...] version-history [options]

Prints the version history of the target Stronghold server

d8 stronghold write

Usage:

d8 stronghold [command] [args...] write [options]

Write data, configuration, and secrets

d8 system

Aliases: s, p, platform

Operate system options. Aliases: s, p, platform

Operate system options in DKP.

 © Flant JSC 2025

Options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system collect-debug-info

Usage:

d8 system collect-debug-info [flags] > deckhouse-debug-$(date +"%Y_%m_%d").tar.gz [options]

Collect debug info.

Collect debug info from Deckhouse Kubernetes Platform.

 © Flant JSC 2025

Options

--command-timeout
Timeout for each individual debug command execution
--exclude
Exclude specific files from the debug archive. Use comma-separated names as printed by --list-exclude; the file extension is optional. An unknown name is an error
--list-exclude, -l
List all files that can be excluded from the debug archive, then exit
--request-interval
Minimum interval between debug command executions to avoid overloading the cluster (e.g. 200ms, 500ms, 1s). Zero disables rate limiting (default 0s)

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system collect-debug-info virtualization

Usage:

d8 system collect-debug-info [flags] > deckhouse-debug-$(date +"%Y_%m_%d").tar.gz virtualization [flags] > deckhouse-debug-virtualization-$(date +"%Y_%m_%d").tar.gz [options]

Collect a separate virtualization debug archive.

Collect a separate debug archive with detailed data from the d8-virtualization namespace.

Options

--command-timeout
Timeout for each individual debug command execution
--request-interval
Minimum interval between debug command executions to avoid overloading the cluster (e.g. 200ms, 500ms, 1s). Zero disables rate limiting (default 0s)
--skip-ds-logs
Skip collecting logs from pods managed by a DaemonSet (virt-handler, virtualization-dra, vm-route-forge, ...) to reduce archive size on clusters with many nodes

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system edit

Usage:

d8 system edit [options]

Edit configuration files

Change configuration files in Kubernetes cluster conveniently and safely.

 © Flant JSC 2025

Options

--editor, -e
Your favourite editor.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system edit cluster-configuration

Usage:

d8 system edit cluster-configuration [options]

Edit cluster-configuration.

Edit cluster-configuration in Kubernetes cluster.

 © Flant JSC 2025

Options

--editor, -e
Your favourite editor.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system edit provider-cluster-configuration

Usage:

d8 system edit provider-cluster-configuration [options]

Edit provider-cluster-configuration.

Edit provider-cluster-configuration in Kubernetes cluster.

 © Flant JSC 2025

Options

--editor, -e
Your favourite editor.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system edit static-cluster-configuration

Usage:

d8 system edit static-cluster-configuration [options]

Edit static-cluster-configuration.

Edit static-cluster-configuration in Kubernetes cluster.

 © Flant JSC 2025

Options

--editor, -e
Your favourite editor.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system get

Usage:

d8 system get [options]

Get configuration files

Get configuration files from Kubernetes cluster.

 © Flant JSC 2025

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system get cluster-configuration

Usage:

d8 system get cluster-configuration [options]

Get cluster-configuration.

Get cluster-configuration from Kubernetes cluster.

 © Flant JSC 2025

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system get provider-cluster-configuration

Usage:

d8 system get provider-cluster-configuration [options]

Get provider-cluster-configuration.

Get provider-cluster-configuration from Kubernetes cluster.

 © Flant JSC 2025

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system get static-cluster-configuration

Usage:

d8 system get static-cluster-configuration [options]

Get static-cluster-configuration.

Get static-cluster-configuration from Kubernetes cluster.

 © Flant JSC 2025

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system logs

Usage:

d8 system logs [options]

Inspect deckhouse-controller logs.

Inspect deckhouse-controller logs from Deckhouse Kubernetes Platform.

 © Flant JSC 2025

Options

--follow, -f
Specify if the logs should be streamed.
--since
Show logs newer than a relative duration like 5s, 2m, or 1h. Only one of since-time / since may be used.
--since-time
Show logs after a specific timestamp, e.g. --since-time='2025-05-19 12:00:00'. Only one of since-time / since may be used.
--tail
Limit the number of lines in the output to the last N lines. Defaults to -1 with no limit.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system module

Usage:

d8 system module [options]

Operate the Deckhouse Kubernetes Platform modules

Operate the Deckhouse Kubernetes Platform modules.

 © Flant JSC 2025

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system module apply-now

Usage:

d8 system module apply-now <module-name> <version> [options]

Apply a module release immediately, bypassing update windows.

Apply a module release immediately, bypassing update windows.

 This command adds the annotation 'modules.deckhouse.io/apply-now="true"' to the specified ModuleRelease resource, forcing immediate deployment regardless of configured update windows or applyAfter schedules.

 This command is used for modules with Auto update policy that have update windows configured or releases scheduled for future deployment.

 © Flant JSC 2025

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system module approve

Usage:

d8 system module approve <module-name> <version> [options]

Approve a pending module release for Manual update policy.

Approve a pending module release for installation.

 This command adds the annotation 'modules.deckhouse.io/approved="true"' to the specified ModuleRelease resource, allowing it to be deployed according to the update policy.

 This command is used for modules with Manual update policy that require explicit approval before deployment.

 © Flant JSC 2025

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system module disable

Usage:

d8 system module disable [options]

Disable module.

Disable module using the ModuleConfig resource.

 © Flant JSC 2025

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system module enable

Usage:

d8 system module enable [options]

Enable module.

Enable module using the ModuleConfig resource.

 © Flant JSC 2025

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system module list

Usage:

d8 system module list [options]

List enabled modules.

List enabled Deckhouse Kubernetes Platform modules.

 © Flant JSC 2025

Options

--output, -o
Output format: yaml|json

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system module maintenance

Usage:

d8 system module maintenance [options]

Enable or disable module maintenance mode.

Enable or disable maintenance mode for a module via its ModuleConfig resource.

 While maintenance mode is enabled, Deckhouse stops reconciling the module's resources (it sets 'spec.maintenance="NoResourceReconciliation"' on the ModuleConfig). This lets you develop or tweak the module's resources.

 Disabling maintenance mode removes the 'spec.maintenance' field and lets Deckhouse resume normal reconciliation.

 The module's ModuleConfig must already exist. If it does not enable it first.

 © Flant JSC 2026

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system module maintenance disable

Usage:

d8 system module maintenance disable <module-name> [options]

Disable maintenance mode for a module using ModuleConfig resource.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system module maintenance enable

Usage:

d8 system module maintenance enable <module-name> [options]

Enable maintenance mode for a module using ModuleConfig resource.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system module snapshots

Usage:

d8 system module snapshots [options]

Dump shapshots.

Dump module hooks snapshots.

 © Flant JSC 2025

Options

--output, -o
Output format: yaml|json

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system module values

Usage:

d8 system module values [options]

Dump values.

Dump module hooks values.

 © Flant JSC 2025

Options

--output, -o
Output format: yaml|json

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system package

Usage:

d8 system package [options]

Operate the Deckhouse Kubernetes Platform packages

Operate the Deckhouse Kubernetes Platform packages.

 © Flant JSC 2026

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system package scan

Usage:

d8 system package scan <repository-name> [options]

Create a scan task for a PackageRepository

Create a scan task for a PackageRepository.

 This command creates a PackageRepositoryOperation resource that triggers a full scan of the specified package repository.

 © Flant JSC 2026

Options

--dry-run
Preview the operation without creating it
--name
Custom name for the PackageRepositoryOperation (auto-generated if not specified)
--timeout
Timeout for the scan operation

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system queue

Usage:

d8 system queue [options]

Dump queues.

Dump queues from Deckhouse Kubernetes Platform.

 © Flant JSC 2025

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system queue list

Usage:

d8 system queue list [options]

Dump all queues.

Dump all Deckhouse Kubernetes Platform queues.

 © Flant JSC 2025

Options

--output, -o
Output format: json|yaml|text.
--show-empty, -e
Show empty queues.
--watch, -w
Watch for changes to the queue list.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 system queue main

Usage:

d8 system queue main [options]

Dump main queue.

Dump main Deckhouse Kubernetes Platform queues.

 © Flant JSC 2025

Options

--output, -o
Output format: json|yaml|text.

Global options

--context
The name of the kubeconfig context to use
--kubeconfig, -k
Path to kubeconfig file. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)

d8 tools

Alias: t

Various useful tools for operating in The Deckhouse Ecosystem.

Various useful tools for operating in The Deckhouse Ecosystem.

 © Flant JSC 2025

d8 tools cosign

Usage:

d8 tools cosign [options]

Sign and verify container images with cosign v2

Built-in cosign v2 for signing and verifying container images.

 Deckhouse image signature verification (admission-policy-engine) supports cosign v2 signatures only, cosign v3 is not supported.

 Run "d8 tools cosign --help" for the full list of cosign commands.

 © Flant JSC 2026

d8 tools far-convert

Usage:

d8 tools far-convert [options]

Converts files with Falco rules to FalcoAuditRules CRD format

Converts files with Falco rules to FalcoAuditRules CRD format.

 © Flant JSC 2025

d8 tools gostsum

Usage:

d8 tools gostsum [options]

Calculate Streebog checksum of the data according to the RFC 6986 (GOST R 34.11-2012) specifications

Calculate Streebog checksum of the data according to the RFC 6986 (GOST R 34.11-2012) specifications.

 Data for checksumming is provided as a list of filepaths in the command-line arguments. If no filepaths are provided, data is assumed to be available from stdin.

 © Flant JSC 2025

Options

--hash-length, -l
Bit-length variant of the algorithm to use. Only 256 (default) and 512 bit lengths are supported.

d8 tools htpasswd

Usage:

d8 tools htpasswd [flags] [passwordfile] [username] [password] [options]

Manage password files and hash passwords (Apache htpasswd analog)

Manage password files and hash passwords, a self-contained analog of Apache htpasswd. No external htpasswd binary is required.

Usage mirrors htpasswd:

  d8 tools htpasswd [-cbdps... -C cost -r rounds] passwordfile username
  d8 tools htpasswd -b [...] passwordfile username password
  d8 tools htpasswd -n [-bmBdps...] [username]
  d8 tools htpasswd -D passwordfile username
  d8 tools htpasswd -v passwordfile username

Algorithms (choose one; default bcrypt):

  -B  bcrypt         secure, the default
  -m  apr1 MD5       Apache MD5, legacy htpasswd default
  -2  SHA-256 crypt  secure
  -5  SHA-512 crypt  secure
  -d  CRYPT (DES)    INSECURE, only first 8 chars used
  -s  SHA-1          INSECURE, unsalted
  -p  plaintext      INSECURE, no hashing

Unlike Apache htpasswd (apr1 at cost 5 by default), d8 defaults to bcrypt at cost 10, so 'd8 tools htpasswd -n <username>' produces a strong hash ready for 'd8 iam user create/reset-password --password-hash'. With -n and no username the bare hash is printed, which is exactly what --password-hash expects. The -2 and -5 SHA-crypt algorithms and the -r rounds flag are d8 extensions; Apache htpasswd has no -2, -5, or -r flag.

© Flant JSC 2026

Options

--batch, -b
Batch mode: take the password from the command line.
--bcrypt, -B
Use bcrypt (secure; the default).
--cost, -C
bcrypt cost/work factor (4-31); only with -B.
--create, -c
Create a new password file, overwriting any existing one.
--delete, -D
Delete the given user from the password file.
--des, -d
Use CRYPT (DES; INSECURE, 8-char limit).
--md5, -m
Use Apache MD5 (apr1).
--plaintext, -p
Store the password in plaintext (INSECURE).
--rounds, -r
SHA-256/512 rounds (1000-999999999); only with -2/-5.
--sha1, -s
Use SHA-1 (INSECURE, unsalted).
--sha256, -2
Use SHA-256 crypt (secure).
--sha512, -5
Use SHA-512 crypt (secure).
--stdin, -i
Read the password from stdin without verification.
--stdout, -n
Do not update a file; print the result to stdout.
--verify, -v
Verify the given password for the user.

d8 tools imagedigest

Usage:

d8 tools imagedigest [options]

Options

--debug, -d
Enable debug logging
--insecure, -i
Allow insecure connections to registries (skip TLS verification)
--json
Use JSON formatter for output logs

d8 tools imagedigest add

Usage:

d8 tools imagedigest add <image> [options]

Calculating and adding the image digest to the image metadata according to the GOST standard Streebog (GOST R 34.11-2012)

Calculating and adding the image digest to the image metadata according to the GOST standard Streebog (GOST R 34.11-2012)

Global options

--debug, -d
Enable debug logging
--insecure, -i
Allow insecure connections to registries (skip TLS verification)
--json
Use JSON formatter for output logs

d8 tools imagedigest calculate

Usage:

d8 tools imagedigest calculate <image> [options]

Calculating the image digest according to the GOST standard Streebog (GOST R 34.11-2012)

Calculating the image digest according to the GOST standard Streebog (GOST R 34.11-2012)

Global options

--debug, -d
Enable debug logging
--insecure, -i
Allow insecure connections to registries (skip TLS verification)
--json
Use JSON formatter for output logs

d8 tools imagedigest calculate-from-file

Usage:

d8 tools imagedigest calculate-from-file <file> [options]

Calculating the file digest according to the GOST standard Streebog (GOST R 34.11-2012). For stdin use '-'

Calculating the file digest according to the GOST standard Streebog (GOST R 34.11-2012)

Global options

--debug, -d
Enable debug logging
--insecure, -i
Allow insecure connections to registries (skip TLS verification)
--json
Use JSON formatter for output logs

d8 tools imagedigest validate

Usage:

d8 tools imagedigest validate <image> [options]

Validating the image digest in the image metadata calculated according to the GOST standard Streebog (GOST R 34.11-2012)

Validating the image digest in the image metadata calculated according to the GOST standard Streebog (GOST R 34.11-2012)

Options

--fix
Fix GOST Image Digest if it is incorrect

Global options

--debug, -d
Enable debug logging
--insecure, -i
Allow insecure connections to registries (skip TLS verification)
--json
Use JSON formatter for output logs

d8 tools pki

Usage:

d8 tools pki [options]

Tools for working with control-plane PKI

Tools for working with control-plane PKI.

 © Flant JSC 2026

d8 tools pki certs

Usage:

d8 tools pki certs [options]

Manage and inspect control-plane TLS certificates

Manage and inspect control-plane TLS certificates.

 © Flant JSC 2026

d8 tools pki certs check

Usage:

d8 tools pki certs check [PATH] [options]

Check expiration of control-plane certificates

Check expiration of control-plane certificates and kubeconfig client certificates.

 Without arguments, all known control-plane certificates under --path and the kubeconfig files under --kubeconfig-dir are checked.  Output is split into two sections – leaf certificates and certificate authorities – similar to "kubeadm certs check-expiration".

 Missing known files are skipped in full-scan mode, so on worker or arbiter nodes the command prints the artifacts that are actually present locally.

 --kubeconfig-dir defaults to the parent directory of --path, which matches the standard Kubernetes layout (/etc/kubernetes/pki → /etc/kubernetes).  Set it explicitly when using a non-default directory layout.

 With a single PATH argument, only that file is inspected.  The command auto-detects whether the file is a kubeconfig or a PEM certificate.

 © Flant JSC 2026

Options

--kubeconfig-dir
Directory containing kubeconfig files (full-scan mode only; defaults to the parent of --path)
--path
Directory containing the PKI certificates (used in full-scan mode only)

d8 tools pki certs renew

Usage:

d8 tools pki certs renew (all | PATH) [options]

Renew control-plane certificates and kubeconfig client certificates

Renew control-plane certificates and kubeconfig client certificates.

 Renewal is unconditional — certificates are re-signed regardless of their current expiration date.

 All Subject/SAN/Usage fields are read from the existing certificate on disk. No cluster configuration is required — this command is designed for emergency recovery when the Kubernetes API is unavailable.

 The signing CA must be present on disk and must not be expired. If the CA private key is absent (external CA), or the CA certificate has expired, the certificate is skipped; renewing leaf certificates against an expired CA is pointless because chain validation will fail. The command exits non-zero if any certificate was skipped.

 After renewal, restart kube-apiserver, kube-controller-manager, kube-scheduler and etcd so that the new certificates take effect or reboot the node/kubelet.

 © Flant JSC 2026

Options

--dry-run
Run all without writing any files
--kubeconfig-dir
Directory containing kubeconfig files (defaults to the parent of --path)
--path
Directory containing the PKI certificates and CA files

d8 tools pki certs renew all

Usage:

d8 tools pki certs renew (all | PATH) all [options]

Renew all control-plane certificates and kubeconfig client certificates

Options

--dry-run
Run all without writing any files
--kubeconfig-dir
Directory containing kubeconfig files (defaults to the parent of --path)
--path
Directory containing the PKI certificates and CA files
--san
New IP SAN to add to serving certificates (e.g. the new master IP)

d8 tools sig-migrate

Usage:

d8 tools sig-migrate [options]

Migrate Kubernetes resources by adding and removing migration annotations

Migrate Kubernetes resources by adding and removing migration annotations.

 This command collects all Kubernetes resources (both namespaced and cluster-wide), adds a migration annotation (d8-migration=<timestamp> ), and then removes the d8-migration- annotation prefix. This is useful for triggering reconciliation in Deckhouse controllers.

 The command supports: - Retrying failed annotations from previous runs - Using different service accounts via impersonation - Configurable log levels (INFO, DEBUG, TRACE)

 © Flant JSC 2025

Options

--as
Specify a Kubernetes service account for the kubectl operations (impersonation).
--context
The name of the kubeconfig context to use.
--kubeconfig
Path to the kubeconfig file to use for CLI requests. (default is $KUBECONFIG when it is set, otherwise the default kubeconfig path for the current OS user)
--log-level
Set the log level (INFO, DEBUG, TRACE). Defaults to DEBUG.
--measure-stages
Print execution time for major migration stages.
--object
Process objects by identifier in format //. Use 'clusterwide' namespace for cluster-scoped resources. Resource name must match kubectl api-resources output.
--retry
Retry annotation for previously failed objects.
--threads
Number of worker threads for resource discovery and migration. Values <=0 use default.

d8 v

Alias: virtualization

Commands to work with Deckhouse Virtualization Platform.

Options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v ansible-inventory

Usage:

d8 v [command] [args...] ansible-inventory [options]

Generate ansible inventory from virtual machines (ansible inventory script compatible).

Generate ansible inventory from virtual machines.

When called without arguments, returns all hosts (same as --list).

Only virtual machines with assigned IP addresses are included in the inventory.

Arguments:
  --list                   Return all hosts (default behavior if no arguments)
  --host <hostname>        Show variables for a particular host; output format matches inventory entries
  --output, -o <format>    Output format: json, ini, or yaml (default: json)
  --namespace, -n <ns>     Namespace to list virtual machines from
                          (overrides kubeconfig context namespace)

Host names format: <vmname>.<namespace> (e.g., myvm.default)

VM annotations:
  - Annotations with prefix 'vars.ansible.deckhouse.io/' are included
    as host variables (prefix is stripped from variable name)
  - Use 'ansible.deckhouse.io/groups' annotation to add VMs to groups
    (comma-separated list of group names)

Network access:
  - For VM access, the Default network interface is used
  - The 'ansible_ssh_common_args' variable is automatically set for port-forwarding
    through kubectl using 'd8 v port-forward' command; the --context, --server and
    --kubeconfig flags of this command are carried over into it
  - Additional network interfaces are not currently supported

Options

--host
Return variables for specific host
--list
Return all hosts (default behavior if no arguments)
--namespace, -n
Namespace to list virtual machines from (overrides kubeconfig context namespace)
--output, -o
Output format: json, ini, or yaml (default: json)

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v collect-debug-info

Usage:

d8 v [command] [args...] collect-debug-info (VirtualMachine) [options]

Collect debug information for VM: configuration, events, and logs. Output is written as compressed archive to stdout.

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v console

Usage:

d8 v [command] [args...] console (VirtualMachine) [options]

Connect to a console of a virtual machine.

Options

--force
Connect without asking, even when somebody else is using the console.
--timeout
Duration to wait until console is successfully connected (e.g., 1s, 5m, 300s).

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v evict

Usage:

d8 v [command] [args...] evict (VirtualMachine) [options]

Evict a virtual machine.

Options

--all
Set this flag to apply the action to all VMs.
--create-only, -c
Set this flag to only create the action without status warnings or notifications.
--force, -f
Set this flag to force the operation.
--label-selector, -l
Set this flag to apply the action to VMs with the specified labels.
--timeout, -t
Set this flag to change the timeout.
--wait, -w
Set this flag to wait for the operation to complete.
--yes, -y
Set this flag to confirm the action without prompting for confirmation.

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v migrate

Usage:

d8 v [command] [args...] migrate (VirtualMachine) [options]

Migrate a virtual machine.

Options

--all
Set this flag to apply the action to all VMs.
--create-only, -c
Set this flag to only create the action without status warnings or notifications.
--force, -f
Set this flag to force the operation.
--label-selector, -l
Set this flag to apply the action to VMs with the specified labels.
--target-node-name
Set the target node name for virtual machine migration.
--timeout, -t
Set this flag to change the timeout.
--wait, -w
Set this flag to wait for the operation to complete.
--yes, -y
Set this flag to confirm the action without prompting for confirmation.

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v port-forward

Usage:

d8 v [command] [args...] port-forward name[.namespace] [protocol/]localPort[:targetPort]... [options]

Forward local ports to a virtual machine

Forward local ports to a virtualmachine.
The port argument supports the syntax protocol/localPort:targetPort with protocol/ and :targetPort as optional fields.
Protocol supports TCP (default) and UDP.

Portforwards get established over the Kubernetes control-plane using websocket streams.
Usage can be restricted by the cluster administrator through the /portforward subresource.

Options

--address
--address=: Set this to the address the local ports should be opened on
--stdio
--stdio=true: Set this to true to forward the tunnel to stdout/stdin; Only works with a single port

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v restart

Usage:

d8 v [command] [args...] restart (VirtualMachine) [options]

Restart a virtual machine.

Options

--all
Set this flag to apply the action to all VMs.
--create-only, -c
Set this flag to only create the action without status warnings or notifications.
--force, -f
Set this flag to force the operation.
--label-selector, -l
Set this flag to apply the action to VMs with the specified labels.
--timeout, -t
Set this flag to change the timeout.
--wait, -w
Set this flag to wait for the operation to complete.
--yes, -y
Set this flag to confirm the action without prompting for confirmation.

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v scp

Usage:

d8 v [command] [args...] scp [flags] SOURCE TARGET [options]

Secure file CoPy from/to a virtual machine.

Options

--identity-file, -i
Specify a path to a private key passed to the local SSH/SCP client as -i; If not provided, OpenSSH default identity selection applies
--known-hosts
Set a path to the known_hosts file passed to the local SSH/SCP client as UserKnownHostsFile.
--local-ssh
Deprecated: local SSH/SCP client is always used
--local-ssh-opts
Deprecated: use --ssh-args instead
--port, -p
Specify a port to connect to
--preserve
Preserves modification times, access times, and modes from the original file.
--recursive, -r
Recursively copy entire directories
--ssh-args
Additional options to be passed to the local SSH/SCP client. May be repeated, or a single value may contain several options separated by spaces (e.g. --ssh-args='-o X -o Y').

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v ssh

Usage:

d8 v [command] [args...] ssh [-n|--namespace NAMESPACE] VIRTUAL-MACHINE-NAME [-- COMMAND [ARGS]...] [options]

Open a SSH connection to a virtual machine.

Options

--command, -c
Specify a command to execute in the VM. Equivalent to passing the command after --.
--identity-file, -i
Specify a path to a private key passed to the local SSH/SCP client as -i; If not provided, OpenSSH default identity selection applies
--known-hosts
Set a path to the known_hosts file passed to the local SSH/SCP client as UserKnownHostsFile.
--local-ssh
Deprecated: local SSH/SCP client is always used
--local-ssh-opts
Deprecated: use --ssh-args instead
--port, -p
Specify a port to connect to
--ssh-args
Additional options to be passed to the local SSH/SCP client. May be repeated, or a single value may contain several options separated by spaces (e.g. --ssh-args='-o X -o Y').
--username, -l
Specify user to log into virtual machine; If unassigned, this will be empty and the SSH default will apply

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v start

Usage:

d8 v [command] [args...] start (VirtualMachine) [options]

Start a virtual machine.

Options

--all
Set this flag to apply the action to all VMs.
--create-only, -c
Set this flag to only create the action without status warnings or notifications.
--force, -f
Set this flag to force the operation.
--label-selector, -l
Set this flag to apply the action to VMs with the specified labels.
--timeout, -t
Set this flag to change the timeout.
--wait, -w
Set this flag to wait for the operation to complete.
--yes, -y
Set this flag to confirm the action without prompting for confirmation.

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v stop

Usage:

d8 v [command] [args...] stop (VirtualMachine) [options]

Stop a virtual machine.

Options

--all
Set this flag to apply the action to all VMs.
--create-only, -c
Set this flag to only create the action without status warnings or notifications.
--force, -f
Set this flag to force the operation.
--label-selector, -l
Set this flag to apply the action to VMs with the specified labels.
--timeout, -t
Set this flag to change the timeout.
--wait, -w
Set this flag to wait for the operation to complete.
--yes, -y
Set this flag to confirm the action without prompting for confirmation.

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

d8 v vnc

Usage:

d8 v [command] [args...] vnc VirtualMachine [options]

Open a vnc connection to a virtual machine.

Options

--address
--address=127.0.0.1: Setting this will change the listening address of the VNC server. Example: --address=0.0.0.0 will make the server listen on all interfaces.
--force
Connect without asking, even when somebody else is using the VNC.
--port
--port=0: Assigning a port value to this will try to run the proxy on the given port if the port is accessible; If unassigned, the proxy will run on a random port
--proxy-only
--proxy-only=false: Setting this true will run only the vnc proxy and show the port where VNC viewers can connect

Global options

--as
Username to impersonate for the operation
--as-group
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
--as-uid
UID to impersonate for the operation
--certificate-authority
Path to a cert file for the certificate authority
--client-certificate
Path to a client certificate file for TLS
--client-key
Path to a client key file for TLS
--cluster
The name of the kubeconfig cluster to use
--context
The name of the kubeconfig context to use
--disable-compression
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure
--kubeconfig
Path to the kubeconfig file to use for CLI requests.
--log-flush-frequency
Maximum number of seconds between log flushes
--namespace, -n
If present, the namespace scope for this CLI request
--password
Password for basic authentication to the API server
--proxy-url
If provided, this URL will be used to connect via proxy
--request-timeout
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.
--server, -s
The address and port of the Kubernetes API server
--tls-server-name
If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used.
--token
Bearer token for authentication to the API server
--user
The name of the kubeconfig user to use
--username
Username for basic authentication to the API server
--v, -v
number for the log level verbosity
--vmodule
comma-separated list of pattern=N settings for file-filtered logging (only works for the default text log format)

Was the page useful?

Thanks for the review!

Your response is being processed, and changes can be made in 5 minutes.

An error has occurred

Please try again later

Tell us what you didn’t like.

Little useful There are errors It’s written incomprehensibly Outdated information Other