kindgi deploy

`kindgi deploy`

Synopsis

kindgi deploy [--env <name>] [--from-envelope <path>] [--endpoint <url>] [--token <bearer>] [--tenant <id>] [--project <id|slug>] [--hosted] [--idempotency-key <str>] [--dry-run] [--sync-secrets] [--allow-missing-env] [--target <t>] [--build-endpoint <url>] [--out <dir>] [--artifact-version <v>] [--published-at <iso>] [--signing-key <path>] [--signer-key-id <id>] [--registry-push-creds <ref>] [--skip-integrity-gate] [--skip-image-pull] [--skip-sign] [--path <dir>]

Signature

Deploy a signed pack image to Kindgi. Reads deploy-envelope.json (or runs kindgi build inline) + POSTs to /v1/deployments.

Options

Option	Default	Description
`--allow-missing-env`	off	Deploy, with a warning, even when a name in the pack's `env.required` has no value for `--env`.
`--artifact-version <value>`	for an inline build: the build time, as `YYYYMMDD.HHMMSS` (UTC)	For an inline build: the artifact version. Default: the build time as `YYYYMMDD.HHMMSS` (UTC). For a reproducible build, pass `--artifact-version` and `--published-at`.
`--build-endpoint <value>`	for an inline build: the env block's `build`	For an inline build: the build server (`kindgi build --endpoint`). Default: the env block's `build`.
`--dry-run`	off	Print the equivalent `curl` request instead of sending it. A missing envelope is still built first.
`--endpoint <value>`	the env block's `endpoint`, else the CLI's API URL (`--url`, `KINDGI_API_URL`, config files); required when none. A stored API key goes only to the address stored with it (`--token` or `KINDGI_API_TOKEN` gives another server's key); with `--hosted`, the endpoint can only be the CLI's API URL, and the `.kindgirc.json` that `kindgi dev` writes isn't read	The API to deploy to. Default: the env block's `endpoint`, else the CLI's API URL (`--url`, `KINDGI_API_URL`, config files).
`--env <value>`	`staging`	The environment: its block in `kindgi.config.ts` and its `.env.<name>` file. Default: `staging`.
`--from-envelope <value>`	`deploy-envelope.json` in `--out`; an inline build runs when it is missing	The envelope to deploy. Default: `deploy-envelope.json` in `--out`; when there is none, `kindgi build` runs first.
`--hosted`	off	Deploy to Kindgi hosted: an inline build runs on the hosted build service (as `kindgi build --hosted`), and after the deploy it waits, up to 5 minutes, for the deployment's pack service to be ready. Same as the env block's `build: 'hosted'`.
`--idempotency-key <value>`	a hash of the request body	The `Idempotency-Key` header. Default: a hash of the request body, so the same image deployed again returns the same deployment.
`--out <value>`	`.kindgi/build` under the pack root	Where the envelope is looked for, and an inline build writes. Default: `.kindgi/build` under the pack root.
`--path <value>`	the current directory	The pack root. Default: the current directory.
`--project <value>`	none: a tenant-wide deploy, into the tenant's Default project	The project to deploy into, one per client: its id, or its slug. A slug two orgs share is refused: pass the id. Default: a tenant-wide deploy, into the tenant's Default project.
`--published-at <value>`	for an inline build: the build time	For an inline build: the publish time (an ISO 8601 time with a zone, or a date: its start, UTC). Default: the build time. For a reproducible build, pass `--artifact-version` and `--published-at`.
`--registry-push-creds <value>`	none	For an inline build: a reference to the registry push credentials for the build server to use.
`--signer-key-id <value>`	for an inline build: the env block's `signerKeyId`, else the key file's name	For an inline build: the key id the signature names. Default: the env block's `signerKeyId`, else the key file's name.
`--signing-key <value>`	for an inline build: the env block's `signingKey`	For an inline build: the Ed25519 private key (PEM) to sign with. Default: the env block's `signingKey`.
`--skip-image-pull`	off	For an inline build: check the image's index by hash only, without pulling the image.
`--skip-integrity-gate`	off	For an inline build: sign without checking the image's index against the local one.
`--skip-sign`	off	For an inline build: write an unsigned envelope, which the deploy then refuses unless `--dry-run`.
`--sync-secrets`	off	After the deploy lands, also send the values in `.env.<env>` to the deployment's secrets. Off by default.
`--target <value>`	for an inline build: the env block's `buildTarget`, else the env name	For an inline build: the build target. Default: the env block's `buildTarget`, else the env name.
`--tenant <value>`	none (no check); an inline build takes the env block's `tenantId`, else `KINDGI_TENANT_ID`	Refuse unless the envelope was signed for this tenant (checked before sending). Also passed to an inline build.

Every command also takes the global flags.

Examples

From Deploy on Azure Container Apps:

pnpm exec kindgi deploy --env dev --endpoint "$URL"

From Deploy on Google Cloud Run:

pnpm exec kindgi deploy --env prod --endpoint "$URL"

See also