Manifest reference

Reference for manifest.yaml, including the schema, initialization and validation commands, and an annotated example.

阅读时间2 分钟

最后更新于 2 天前

manifest.yaml

is the single input that drives every vpctl operation. It enforces the schema at load time by using an embedded CUE schema. Commit it to version control.: the manifest acts as a controlled input for release upgrades: bumping

releaseVersion

and any other field, and rerunning

vpctl release generate

produces a reviewable diff your team can approve before deployment, and Argo CD or your CD picks it up from there. The manifest contains no secrets: secrets are generated separately by

vpctl secret generate

from

secrets.import.yaml

, which lives in your CI secret store or a vault, never in Git.

Initialize a manifest

If you don't already have one, generate one interactively:


vpctl manifest init

This walks you through platform, release version, registry, namespace, autoscaling, monitoring, and ingress settings. The output defaults to

./manifest.yaml

, you can override with

--output

Validate a manifest


vpctl manifest validatevpctl manifest validate --file path/to/manifest.yaml

Validates against the embedded CUE schema. The validation catches missing required fields, disallowed values, and cross-field rules. For example,

maxReplicas >= minReplicas

, a TLS certificate is required when TLS is enabled.

Annotated example

A minimal on-premises manifest looks like this:


# manifest.yamlplatform: onprem                       # required: only "onprem" is documented for customer usereleaseVersion: 0.15.0                 # required: matches the release tag in the Unity registryartifactSync:  sourceRepository: uccmpprivatecloud.azurecr.io  concurrency: 5                       # parallel image/ORAS sync workers (default: 5)deployment:  # helmChartMode: "remote"            # default "local": charts come from the release package  helm:    concurrency: 4                     # optional, default 1; deploy charts within the same wave                                       # in parallel (helm format only). Waves remain sequential.                                       # The `--concurrency` CLI flag overrides this when both are set.  argocd:                              # defaults for `release generate --format argocd`    repoURL: "git@github.com:your-org/your-argocd-charts.git"    pathPrefix: ""                     # subdirectory in the repo (e.g. "cluster1/")    destinationServer: "https://kubernetes.default.svc"    targetRevision: "main"configuration:  # imageVariant: hardened             # optional. When set, vpctl appends the matching                                       # suffix (such as -hardened) to image versions that                                       # declare the variant. Omit for default images.  networking:    appDomain: uam.example.com         # the FQDN your customers reach the app at    # ipFamily: ipv6                   # optional. "ipv4" (default) or "ipv6" for                                       # single-stack IPv6 clusters. Omit for IPv4.    allowedIngressCIDRs:               # IPs allowed to reach the LoadBalancer      - "203.0.113.0/24"    ingress:      traefik:        type: LoadBalancer        tls:          enabled: true          certificate: traefik-tls-cert  # name of the K8s Secret holding the cert        # nodePorts:                   # optional. Pin nodePorts for the traefik entrypoints.        #   web: 32080                 # Omit (default) to let Kubernetes auto-assign; the        #   websecure: 32443           # assigned port stays stable for the life of the service.    # trustedCaSecretName: my-ca-bundle  # K8s Secret (key ca-bundle.crt) mounted into Argo workflow pods; set when ingress TLS is signed by a private CA    serviceMesh:      istio:        enabled: false  kubernetes:    namespace: asset-solutions          # namespace where workloads are deployed    dnsService: kube-dns                # CoreDNS Service in kube-system, for example rke2-coredns-rke2-coredns on RKE2    docker:      repository: registry.example.com  # your registry (used after `artifact sync`)      namespace: asset-solutions        # subpath/namespace within the registry    imagePullSecret: regcred            # K8s Secret holding registry pull credentials    autoscaling:      minReplicas: 1      maxReplicas: 10    storage:      defaultStorageClass: gp3      readWriteManyStorageClass: efs  transformations:    parallelism: 30                     # max concurrent transformation workflows  monitoring:    database:      enabled: true    prometheus:      enabled: true                     # auto-detected if Prometheus is already installed    logCollection:      enabled: true                     # Loki + Alloy  authentication:    x509:      enabled: false      # caSecretName: x509-ca-cert      # required when enabled  infrastructure:    sizing: medium                      # small | medium (default) | large    # singleNode: true                  # optional: collapse infrastructure components to                                        # single-replica for ephemeral test clusters.                                        # Not for production.    # components: { ... }               # per-component CPU/memory/storage overrides

Full schema reference

The annotated example above covers the most common fields. For the complete field list which include every type, default value, constraint, and cross-field rule, print the schema your installed vpctl is using:


vpctl manifest schema

To export the CUE schema for standalone validation (useful in CI, without installing vpctl):


vpctl manifest schema --export manifest.cuecue vet manifest.cue manifest.yaml -d '#Manifest'

Auto-discovery

vpctl searches upward from the current working directory for

manifest.yaml

. Pass

--manifest <path>

to override.

文档

Development

User Acquisition

Monetization

工业

文档