diff --git a/charts/ksail-operator/crds/ksail.io_clusters.yaml b/charts/ksail-operator/crds/ksail.io_clusters.yaml index 8e0d202aeb..3f735a2054 100644 --- a/charts/ksail-operator/crds/ksail.io_clusters.yaml +++ b/charts/ksail-operator/crds/ksail.io_clusters.yaml @@ -112,6 +112,16 @@ spec: strategy for the cluster autoscaler. type: string type: array + ignoreDaemonsetsUtilization: + description: |- + IgnoreDaemonsetsUtilization excludes DaemonSet pods from a node's + resource-utilization calculation when the autoscaler decides whether a node + is unneeded (upstream --ignore-daemonsets-utilization, off by default). Set + this when every DaemonSet is a system component whose per-node overhead + should not, on its own, keep an otherwise-empty node above the scale-down + threshold — otherwise heavy node agents (CNI, storage, observability) can + pin every autoscaler node as "utilized" and prevent scale-down entirely. + type: boolean maxNodesTotal: description: |- MaxNodesTotal caps the total number of nodes in the cluster @@ -190,6 +200,28 @@ spec: ScaleDownUnneededTime is how long a node must be unneeded before it is eligible for scale down (e.g. "10m"). type: string + skipNodesWithLocalStorage: + description: |- + SkipNodesWithLocalStorage controls whether the Cluster Autoscaler refuses to + scale down a node that runs a pod with local storage (emptyDir, hostPath, or + a local PersistentVolume). Upstream defaults to true (never remove such + nodes). Set false to allow scale-down of nodes whose only local storage is + ephemeral scratch — required for overflow nodes to ever drain, since + emptyDir is pervasive. A pointer so an explicit false is preserved and only + an unset value inherits the upstream default. Ignored unless the node + autoscaler is installed (Talos on Hetzner with enabled: true). + type: boolean + skipNodesWithSystemPods: + description: |- + SkipNodesWithSystemPods controls whether the Cluster Autoscaler refuses to + scale down a node that runs a non-DaemonSet kube-system pod without a + controlling PodDisruptionBudget. Upstream defaults to true. Set false to let + overflow nodes hosting movable system Deployments (metrics-server, CSI + controllers, relays) drain — verify those components tolerate eviction and + carry PDBs. A pointer so an explicit false is preserved and only an unset + value inherits the upstream default. Ignored unless the node autoscaler is + installed (Talos on Hetzner with enabled: true). + type: boolean type: object pod: description: Pod configures pod-level autoscaling (horizontal diff --git a/docs/src/content/docs/configuration/declarative-configuration.mdx b/docs/src/content/docs/configuration/declarative-configuration.mdx index c740d31b28..b4a7f0ad02 100644 --- a/docs/src/content/docs/configuration/declarative-configuration.mdx +++ b/docs/src/content/docs/configuration/declarative-configuration.mdx @@ -414,6 +414,9 @@ NodeAutoscalerConfig defines configuration for node-level autoscaling. When Enab | `expander` | []enum | – | Node expander strategy for the cluster autoscaler. Accepts either a single value (e.g. LeastWaste) or an ordered priority list (e.g. [LeastNodes | | `scaleDownUnneededTime` | string | – | How long a node should be unneeded before it is eligible for scale down (e.g. 10m) | | `capacityBuffers` | boolean | – | Enable the Cluster Autoscaler capacity-buffers feature: KSail installs the CapacityBuffer CRD (capacitybuffers.autoscaling.x-k8s.io) and enables the buffer controller and pod-injection flags. CapacityBuffer resources then reserve scale-up headroom as virtual (pod-less) chunks simulated in autoscaler memory — a native replacement for low-priority balloon-pod overprovisioning. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true) | +| `ignoreDaemonsetsUtilization` | boolean | – | Exclude DaemonSet pods from a node's resource-utilization calculation when the Cluster Autoscaler decides whether a node is unneeded (upstream --ignore-daemonsets-utilization, off by default). Enable this when DaemonSets are system components (CNI, CSI, observability, security agents) whose per-node overhead should not keep an otherwise-empty node above the scale-down utilization threshold. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true). | +| `skipNodesWithLocalStorage` | boolean | – | Whether the Cluster Autoscaler refuses to scale down a node running a pod with local storage (emptyDir, hostPath, or a local PersistentVolume). Upstream --skip-nodes-with-local-storage defaults to true. Set false to let nodes whose only local storage is ephemeral scratch (emptyDir) be removed — required for overflow nodes to drain, since emptyDir is pervasive. Ensure durable data lives on real PVCs first. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true). | +| `skipNodesWithSystemPods` | boolean | – | Whether the Cluster Autoscaler refuses to scale down a node running a non-DaemonSet kube-system pod that has no controlling PodDisruptionBudget. Upstream --skip-nodes-with-system-pods defaults to true. Set false to let overflow nodes hosting movable system Deployments drain — confirm those components tolerate eviction and carry PDBs first. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true). | ### spec.cluster.autoscaler.node.pools[] (NodePool) diff --git a/pkg/apis/cluster/v1alpha1/autoscaler.go b/pkg/apis/cluster/v1alpha1/autoscaler.go index 1347495e31..40db443874 100644 --- a/pkg/apis/cluster/v1alpha1/autoscaler.go +++ b/pkg/apis/cluster/v1alpha1/autoscaler.go @@ -44,6 +44,32 @@ type NodeAutoscalerConfig struct { // headroom as virtual (pod-less) chunks — a native replacement for // low-priority balloon-pod overprovisioning. CapacityBuffers bool `json:"capacityBuffers,omitzero" jsonschema:"description=Enable the Cluster Autoscaler capacity-buffers feature: KSail installs the CapacityBuffer CRD (capacitybuffers.autoscaling.x-k8s.io) and enables the buffer controller and pod-injection flags. CapacityBuffer resources then reserve scale-up headroom as virtual (pod-less) chunks simulated in autoscaler memory — a native replacement for low-priority balloon-pod overprovisioning. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true)"` //nolint:lll + // IgnoreDaemonsetsUtilization excludes DaemonSet pods from a node's + // resource-utilization calculation when the autoscaler decides whether a node + // is unneeded (upstream --ignore-daemonsets-utilization, off by default). Set + // this when every DaemonSet is a system component whose per-node overhead + // should not, on its own, keep an otherwise-empty node above the scale-down + // threshold — otherwise heavy node agents (CNI, storage, observability) can + // pin every autoscaler node as "utilized" and prevent scale-down entirely. + IgnoreDaemonsetsUtilization bool `json:"ignoreDaemonsetsUtilization,omitzero" jsonschema_description:"Exclude DaemonSet pods from a node's resource-utilization calculation when the Cluster Autoscaler decides whether a node is unneeded (upstream --ignore-daemonsets-utilization, off by default). Enable this when DaemonSets are system components (CNI, CSI, observability, security agents) whose per-node overhead should not keep an otherwise-empty node above the scale-down utilization threshold. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true)."` //nolint:lll + // SkipNodesWithLocalStorage controls whether the Cluster Autoscaler refuses to + // scale down a node that runs a pod with local storage (emptyDir, hostPath, or + // a local PersistentVolume). Upstream defaults to true (never remove such + // nodes). Set false to allow scale-down of nodes whose only local storage is + // ephemeral scratch — required for overflow nodes to ever drain, since + // emptyDir is pervasive. A pointer so an explicit false is preserved and only + // an unset value inherits the upstream default. Ignored unless the node + // autoscaler is installed (Talos on Hetzner with enabled: true). + SkipNodesWithLocalStorage *bool `json:"skipNodesWithLocalStorage,omitzero" jsonschema_description:"Whether the Cluster Autoscaler refuses to scale down a node running a pod with local storage (emptyDir, hostPath, or a local PersistentVolume). Upstream --skip-nodes-with-local-storage defaults to true. Set false to let nodes whose only local storage is ephemeral scratch (emptyDir) be removed — required for overflow nodes to drain, since emptyDir is pervasive. Ensure durable data lives on real PVCs first. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true)."` //nolint:lll + // SkipNodesWithSystemPods controls whether the Cluster Autoscaler refuses to + // scale down a node that runs a non-DaemonSet kube-system pod without a + // controlling PodDisruptionBudget. Upstream defaults to true. Set false to let + // overflow nodes hosting movable system Deployments (metrics-server, CSI + // controllers, relays) drain — verify those components tolerate eviction and + // carry PDBs. A pointer so an explicit false is preserved and only an unset + // value inherits the upstream default. Ignored unless the node autoscaler is + // installed (Talos on Hetzner with enabled: true). + SkipNodesWithSystemPods *bool `json:"skipNodesWithSystemPods,omitzero" jsonschema_description:"Whether the Cluster Autoscaler refuses to scale down a node running a non-DaemonSet kube-system pod that has no controlling PodDisruptionBudget. Upstream --skip-nodes-with-system-pods defaults to true. Set false to let overflow nodes hosting movable system Deployments drain — confirm those components tolerate eviction and carry PDBs first. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true)."` //nolint:lll } // NodePool defines a Hetzner node pool managed by the cluster autoscaler. diff --git a/pkg/apis/cluster/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/cluster/v1alpha1/zz_generated.deepcopy.go index ce270c27fe..39a9aa8198 100644 --- a/pkg/apis/cluster/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/cluster/v1alpha1/zz_generated.deepcopy.go @@ -510,6 +510,16 @@ func (in *NodeAutoscalerConfig) DeepCopyInto(out *NodeAutoscalerConfig) { *out = make(AutoscalerExpanderList, len(*in)) copy(*out, *in) } + if in.SkipNodesWithLocalStorage != nil { + in, out := &in.SkipNodesWithLocalStorage, &out.SkipNodesWithLocalStorage + *out = new(bool) + **out = **in + } + if in.SkipNodesWithSystemPods != nil { + in, out := &in.SkipNodesWithSystemPods, &out.SkipNodesWithSystemPods + *out = new(bool) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeAutoscalerConfig. diff --git a/pkg/svc/chat/docs_generated.go b/pkg/svc/chat/docs_generated.go index d5a24a2e4d..9054afe027 100644 --- a/pkg/svc/chat/docs_generated.go +++ b/pkg/svc/chat/docs_generated.go @@ -4,4 +4,4 @@ package chat // generatedDocumentation contains the pre-processed KSail documentation, // built at go:generate time from docs/src/content/docs/. -const generatedDocumentation = "\n## Installation\n\n## Prerequisites\n\n### System Requirements\n\nKSail works on all major operating systems and modern CPU architectures:\n\n| OS | Architecture |\n| -------------------- | --------------- |\n| 🐧 Linux | amd64 and arm64 |\n| \uf8ff macOS | arm64 |\n| ⊞ Windows (native untested; WSL2 recommended) | amd64 and arm64 |\n\n### Docker (Required for the Docker Provider)\n\n**Docker is required** to create local clusters using the Docker provider. Install Docker Desktop or Docker Engine and ensure `docker ps` works.\n\n- [Install Docker Desktop](https://www.docker.com/get-started/)\n- [Install Docker Engine](https://docs.docker.com/engine/install/)\n\nAfter installation, verify Docker is running:\n\n```bash\ndocker ps\n```\n\n### Provider Support\n\nEach Kubernetes distribution runs on one or more infrastructure providers (Docker, Kubernetes, Hetzner, Omni, AWS), and you need access to at least one provider for your chosen distribution. See the [Support Matrix](/support-matrix/) for the full distribution × provider compatibility table and per-provider requirements.\n\n> [!NOTE]\n> The Kubernetes provider runs nested clusters as pods inside an existing host cluster — no Docker required on the host. See [Kubernetes Provider](/providers/kubernetes/) for setup details.\n> Talos on Hetzner requires a Hetzner Cloud account and API token (`HCLOUD_TOKEN`). Talos on Omni requires a [Sidero Omni](https://www.siderolabs.com/omni/) account, a service account key provided via environment variable (defaults to `OMNI_SERVICE_ACCOUNT_KEY`, configurable via `spec.provider.omni.serviceAccountKeyEnvVar`), and an Omni API endpoint configured via `spec.provider.omni.endpoint` in `ksail.yaml`.\n\n## Installation Methods\n\n\n \n ### Homebrew (macOS/Linux)\n\n The easiest way to install KSail on macOS or Linux:\n\n ```bash\n brew install --cask devantler-tech/tap/ksail\n ```\n\n This installs the latest stable release and makes `ksail` available in your PATH.\n\n \n\n \n ### Go Install\n\n If you have Go 1.26.1+ installed, you can build and install KSail via `go install`:\n\n ```bash\n go install github.com/devantler-tech/ksail/v7@latest\n ```\n\n This builds and installs the `ksail` binary to `$GOPATH/bin` (typically `~/go/bin`). Ensure this directory is in your PATH.\n\n \n\n \n ### Binary Download\n\n Download pre-built binaries from the [GitHub Releases](https://github.com/devantler-tech/ksail/releases) page:\n\n 1. Navigate to the [latest release](https://github.com/devantler-tech/ksail/releases/latest)\n 2. Download the appropriate binary for your OS and architecture\n 3. Extract the archive\n 4. Move the `ksail` binary to a directory in your PATH (e.g., `/usr/local/bin`)\n 5. Make it executable (Linux/macOS): `chmod +x ksail`\n\n \n\n \n ### Build from Source\n\n Clone the repository and build the binary:\n\n ```bash\n git clone https://github.com/devantler-tech/ksail.git\n cd ksail\n go build -o ksail\n ```\n\n The `ksail` binary will be created in the current directory. Move it to a directory in your PATH if desired.\n\n \n\n\n## Embedded Tools\n\nKSail embeds common Kubernetes tools as Go libraries — including kubectl, helm, kind (Vanilla), k3d (K3s), vcluster/Vind (VCluster), flux, argocd, sops, and others — so no separate installation is needed. All tools are accessible through KSail's unified CLI.\n\n## Optional: GitHub Copilot CLI (for AI Chat)\n\nInstall the [GitHub Copilot CLI](https://docs.github.com/en/copilot/how-tos/copilot-cli/install-copilot-cli) and run `copilot auth login`. Set `COPILOT_CLI_PATH` if the CLI is not in your PATH.\n\n> [!NOTE]\n> An active GitHub Copilot subscription is required. All other KSail features work without it.\n\n## VSCode Extension\n\nFor Visual Studio Code users, install the KSail extension to manage clusters directly from your editor.\n\n\n \n ### Install from Marketplace\n\n 1. Open VSCode\n 2. Press `Cmd+Shift+X` (macOS) or `Ctrl+Shift+X` (Windows/Linux) to open Extensions view\n 3. Search for \"KSail\" — or type `@mcp` to filter MCP-compatible extensions and find KSail there\n 4. Click **Install** on the extension by devantler\n\n **Marketplace Link:** [KSail - Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=devantler.ksail)\n\n \n\n \n ### Install from VSIX\n\n 1. Download the latest `.vsix` file from [GitHub Releases](https://github.com/devantler-tech/ksail/releases)\n 2. Open VSCode\n 3. Press `Cmd+Shift+P` (macOS) or `Ctrl+Shift+P` (Windows/Linux)\n 4. Type `Extensions: Install from VSIX...`\n 5. Select the downloaded `.vsix` file\n\n \n\n\n### Extension Prerequisites\n\n- **KSail CLI** installed and available in PATH (see [installation methods](#installation-methods) above)\n- **Docker** running (for cluster operations)\n- **K9s** (optional, for cluster connection via `Connect to Cluster` command)\n\nSee the [VSCode Extension](/integrations/vscode-extension/) guide for detailed capabilities, commands, and settings.\n\n## Verification\n\n```bash\nksail --version # show version\nksail --help # show all commands\n```\n\n## Support Matrix\n\nKSail supports multiple Kubernetes distributions, providers, and components. This matrix shows compatibility and support status.\n\n## Distribution × Provider Matrix\n\n| Distribution | Docker | Kubernetes | Hetzner | Omni | AWS |\n| ---------------- | ------ | ---------- | ------- | ---- | ----- |\n| Vanilla (Kind) | ✅ | ✅ | ❌ | ❌ | ❌ |\n| K3s (K3d) | ✅ | ✅ | ❌ | ❌ | ❌ |\n| Talos | ✅ | ✅ | ✅ | ✅ | ❌ |\n| VCluster (Vind) | ✅ | ✅ | ❌ | ❌ | ❌ |\n| KWOK (kwokctl) | ✅ | ✅ | ❌ | ❌ | ❌ |\n| EKS | ❌ | ❌ | ❌ | ❌ | 🚧¹⁰ |\n\n**Notes:**\n\n- Docker provider requires Docker Desktop or Docker Engine installed locally — see [Docker Provider](/providers/docker/) for setup details\n- Kubernetes provider runs nested cluster nodes as pods inside an existing host Kubernetes cluster — no Docker daemon required on the host; see [Kubernetes Provider](/providers/kubernetes/) for setup details\n- Hetzner provider requires `HCLOUD_TOKEN` environment variable and a Talos ISO uploaded to your Hetzner account (x86: `125127` for Talos 1.12.4; for ARM, look up the matching ISO ID in the Hetzner Cloud Console — see [Talos options](/configuration/declarative-configuration/#distribution-and-tool-options)) — see [Hetzner Provider](/providers/hetzner/) for setup details\n- Omni provider requires a [Sidero Omni](https://www.siderolabs.com/omni/) account, an `OMNI_SERVICE_ACCOUNT_KEY` environment variable, and an Omni API endpoint configured via `spec.provider.omni.endpoint` in your KSail configuration — see [Omni Provider](/providers/omni/) for setup details\n- ¹⁰ AWS provider requires AWS credentials and an AWS account with EKS permissions — see [AWS Provider](/providers/aws/) for setup details; `ksail cluster create` is not yet functional for EKS\n- VCluster uses the [Vind](https://github.com/loft-sh/vcluster) Docker driver to run the control plane and optional worker nodes directly as Docker containers\n- KWOK uses the kwokctl Docker runtime to run etcd, kube-apiserver, and kwok-controller as Docker containers — nodes and pods are simulated at the API level\n\n## Component × Distribution Matrix\n\n| Component | Vanilla | K3s | Talos | VCluster | KWOK | EKS |\n| ----------------------------- | ------- | -------- | ------------------- | -------- | -------- | ---------------- |\n| **CNI** |\n| Cilium | ✅ | ✅ | ✅ | N/A¹ | ❌¹¹ | ❌ |\n| Calico | ✅ | ✅ | ✅ | N/A¹ | ❌¹¹ | ❌ |\n| Amazon VPC CNI | ❌ | ❌ | ❌ | ❌ | ❌ | Built-in |\n| **CSI** |\n| Local Path Provisioner | ✅ | Built-in | ✅ (Docker) | N/A² | ❌¹² | ❌ |\n| Hetzner CSI Driver | ❌ | ❌ | ✅ (Hetzner) | ❌ | ❌ | ❌ |\n| Amazon EBS CSI Driver | ❌ | ❌ | ❌ | ❌ | ❌ | Built-in |\n| **LoadBalancer** |\n| LoadBalancer Support | ✅ | Built-in | ✅ (Docker/Hetzner) | N/A³ | Sim⁷ | Built-in |\n| Cloud Provider KIND | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |\n| MetalLB | ❌ | ❌ | ✅ (Docker) | ❌ | ❌ | ❌ |\n| Hetzner CCM | ❌ | ❌ | ✅ (Hetzner) | ❌ | ❌ | ❌ |\n| AWS Load Balancer Controller | ❌ | ❌ | ❌ | ❌ | ❌ | 🚧¹⁰ |\n| **GitOps** |\n| Flux | ✅ | ✅ | ✅ | ✅ | ❌⁹ | 🚧¹⁰ |\n| ArgoCD | ✅ | ✅ | ✅ | ✅ | Sim⁷ | 🚧¹⁰ |\n| **Observability** |\n| Metrics Server | ✅ | Built-in | ✅ | N/A⁴ | Sim⁷ | 🚧¹⁰ |\n| **Security** |\n| cert-manager | ✅ | ✅ | ✅ | ✅ | ❌¹² | 🚧¹⁰ |\n| Kyverno | ✅ | ✅ | ✅ | ✅ | ❌⁸ | 🚧¹⁰ |\n| Gatekeeper | ✅ | ✅ | ✅ | ✅ | ❌⁸ | 🚧¹⁰ |\n| **Registry** |\n| Local Registry | ✅ | ✅ | ✅ | ✅ | Sim⁷ | ❌ |\n| Mirror Registries | ✅ | ✅ | ✅ | ✅ | Sim⁷ | ❌ |\n| External Registries with Auth | ✅ | ✅ | ✅ | ✅ | Sim⁷ | 🚧¹⁰ |\n| **Image Verification** |\n| Image Verification | ✅⁶ | ❌ | ✅ (1.13+) | ❌ | ❌ | ❌ |\n\n**Notes:**\n\n- \"Built-in\" means the distribution includes this component by default\n- K3s includes local-path-provisioner, metrics-server, and ServiceLB (load balancer) out of the box\n- Talos CSI support is provider-dependent: Local Path Provisioner for Docker, Hetzner CSI Driver for Hetzner Cloud\n- **LoadBalancer support by distribution** — see [LoadBalancer Configuration](/configuration/loadbalancer/) for full details:\n - **Vanilla (Kind) on Docker**: Uses cloud-provider-kind (runs as external Docker container)\n - **K3s on Docker**: Uses built-in ServiceLB (Klipper-LB)\n - **Talos on Docker**: Uses MetalLB with default IP pool (172.18.255.200-172.18.255.250)\n - **Talos on Hetzner**: Uses Hetzner Cloud Load Balancer (cloud provider integration)\n- **VCluster footnotes:**\n - ¹ CNI is managed internally by the vCluster control plane — Vind configures networking within the Docker containers\n - ² CSI is managed internally by vCluster — no separate CSI driver needed\n - ³ LoadBalancer is delegated to the host cluster by vCluster — `spec.cluster.loadBalancer` has no effect on VCluster and KSail does not install any LoadBalancer controller\n - ⁴ Metrics Server is managed internally by vCluster\n- **⁷ KWOK Simulation**: Components are installed as API objects and their pods appear Running via KWOK's Stage simulation. They do not execute real workloads — KWOK simulates pod lifecycle at the API level. See [KWOK Distribution](/distributions/kwok/) for details.\n- **⁸ KWOK Policy Engines**: Kyverno and Gatekeeper are not installed on KWOK. Both register global `MutatingWebhookConfigurations` that intercept all Kubernetes API requests. On KWOK, no real pod serves the webhook endpoint, so every webhook call times out — breaking all subsequent Helm installs. KSail silently skips policy engine installation when `spec.cluster.distribution: KWOK` is set and emits a warning at cluster creation time.\n- **⁹ KWOK Flux**: Flux is not installed on KWOK. KSail skips Flux installation and configuration entirely (with a warning) because Flux cannot function on KWOK. GitOps reconciliation is not functional on KWOK, including with ArgoCD, because controller pods are only simulated and cannot sync resources. Use a non-KWOK distribution for real GitOps syncing, or use `ksail workload apply` on KWOK for non-GitOps manifest application.\n- **¹⁰ EKS (Planned)**: Full component installer support for EKS is in progress. `ksail project init` is available, but `ksail cluster create` is not yet functional. See [EKS Distribution](/distributions/eks/) for details.\n- **¹¹ KWOK CNI**: Cilium and Calico are not installed on KWOK. KWOK runs simulated pods with no real network dataplane, so CNI plugins are never functional and are always skipped. If a non-default CNI is configured in `ksail.yaml` for a KWOK cluster, KSail emits a warning and skips installation. The `spec.cluster.cni` setting has no effect on KWOK clusters.\n- **¹² KWOK CSI and cert-manager**: Local Path Provisioner (CSI) and cert-manager are not installed on KWOK. The Local Path Provisioner Deployment pod and cert-manager webhook pods require real container processes that KWOK does not provide, so readiness never becomes true and installation would time out. KSail skips installation of these components when `spec.cluster.distribution: KWOK` is set and emits a warning at cluster creation time.\n\n## Secret Management × Provider Matrix\n\n| Provider | Encryption | Decryption | Edit |\n| --------------- | ---------- | ---------- | ---- |\n| age | ✅ | ✅ | ✅ |\n| PGP | ✅ | ✅ | ✅ |\n| AWS KMS | ✅ | ✅ | ✅ |\n| GCP KMS | ✅ | ✅ | ✅ |\n| Azure Key Vault | ✅ | ✅ | ✅ |\n| HashiCorp Vault | ✅ | ✅ | ✅ |\n\n**Notes:**\n\n- Cloud KMS providers require appropriate credentials configured\n- See [SOPS documentation](https://github.com/getsops/sops) for provider-specific setup\n\n## CLI Commands\n\nSee the generated [CLI Flags reference](/cli-flags/) for the complete, always-current list of command groups, commands, and flags.\n\n## Update Behavior\n\nThe `ksail cluster update` command applies configuration changes to a running cluster.\nChanges are classified by impact: **in-place** (no disruption), **reboot-required** (node restart needed), or **recreate-required** (full cluster recreation).\n\n| Change | Vanilla (Kind) | K3s (K3d) | Talos | VCluster (Vind) | KWOK (kwokctl) | EKS |\n| ------------------------ | -------------- | --------- | -------- | --------------- | -------------- | ---------- |\n| Distribution | Recreate | Recreate | Recreate | Recreate | Recreate | 🚧¹⁰ |\n| Provider | Recreate | Recreate | Recreate | Recreate | Recreate | 🚧¹⁰ |\n| CNI | In-place | In-place | In-place | N/A | N/A¹¹ | 🚧¹⁰ |\n| CSI | N/A⁵ | In-place | In-place | N/A | ❌¹² | 🚧¹⁰ |\n| Metrics Server | In-place | In-place | In-place | N/A | Sim⁷ | 🚧¹⁰ |\n| Load Balancer | In-place | In-place | N/A¹ | N/A | Sim⁷ | 🚧¹⁰ |\n| cert-manager | In-place | In-place | In-place | In-place | ❌¹² | 🚧¹⁰ |\n| Policy Engine | In-place | In-place | In-place | In-place | ❌⁸ | 🚧¹⁰ |\n| GitOps Engine | In-place | In-place | In-place | In-place | Sim⁷ | 🚧¹⁰ |\n| Local Registry | Recreate | In-place | In-place | In-place | Sim⁷ | ❌ |\n| Mirrors Dir | Recreate | N/A | N/A | N/A | N/A | ❌ |\n| Control Planes | Recreate | Recreate | In-place | Recreate | Recreate | 🚧¹⁰ |\n| Workers | Recreate | In-place | In-place | N/A | N/A | 🚧¹⁰ |\n| Hetzner Server Type (CP) | N/A | N/A | Recreate | N/A | N/A | N/A |\n| Hetzner Location | N/A | N/A | Recreate | N/A | N/A | N/A |\n| Hetzner Network | N/A | N/A | Recreate | N/A | N/A | N/A |\n\n**Notes:**\n\n- \"In-place\" changes are applied without cluster downtime via Helm or provider APIs\n- \"Recreate\" changes trigger a cluster recreation. `ksail cluster update` will prompt before proceeding; use `--force` (or `-y` / `--yes`) to skip the prompt for non-interactive runs, or run `ksail cluster delete && ksail cluster create` manually.\n- If no changes are detected, `ksail cluster update` exits immediately with no modifications (idempotent no-op)\n- Use `ksail cluster update --dry-run` to preview changes before applying; add `--output json` for machine-readable diff output (suitable for CI gating or [MCP tools](/integrations/mcp/))\n- Talos supports the broadest set of in-place updates, including node scaling for both control-plane and worker nodes across all providers — including Omni (via declarative cluster template sync)\n- Kind does not support any structural node changes after creation\n- VCluster (Vind) runs control-plane and optional worker nodes as Docker containers — CNI, CSI, and metrics-server are managed by the vCluster Helm chart and are N/A for update operations; LoadBalancer services are provided by the host cluster, and `spec.cluster.loadBalancer` is ignored for VCluster and will not trigger a cluster update\n- **¹ Load Balancer for Talos**: For Talos, the provider determines which LoadBalancer implementation is used (MetalLB on Docker, Hetzner Cloud Controller Manager on Hetzner). The `spec.cluster.loadBalancer` setting controls whether KSail installs LoadBalancer support. See [FAQ](/faq/#which-distributions-support-loadbalancer-services) for details.\n- **⁵ CSI for Vanilla (Kind)**: Kind bundles local-path-provisioner by default. KSail's detector reports it as `CSIEnabled` but cannot distinguish Kind's bundled CSI from a KSail-installed CSI driver, so CSI comparison is skipped entirely during `ksail cluster update`. To change CSI settings on a Vanilla cluster, recreate it with `ksail cluster delete && ksail cluster create`.\n- **⁶ Image Verification for Vanilla (Kind)**: Uses the containerd `io.containerd.image-verifier.v1.bindir` plugin (requires containerd 2.x / Kind `v0.31.0+` / `kindest/node:v1.35.1+`). Verifier binaries (e.g., Cosign, Notation) must be pre-installed in a custom Kind node image at `/opt/image-verifier/bin`. See [Vanilla Image Verification](/distributions/vanilla/#image-verification).\n\n## Platform Requirements\n\n| Requirement | Minimum | Recommended |\n| ----------- | ---------------------------------------- | ------------- |\n| Docker | Docker Desktop 4.x or Docker Engine 24.x | Latest stable |\n| RAM | 4 GB | 8 GB+ |\n| CPU | 2 cores | 4 cores+ |\n| Disk | 10 GB | 20 GB+ |\n\n**Operating System Support:**\n\n| OS | Support |\n| --------------------- | ------- |\n| macOS (Apple Silicon) | ✅ |\n| Linux (x86_64) | ✅ |\n| Linux (arm64) | ✅ |\n| Windows (WSL2) | ✅ |\n| Windows (native) | ❌ |\n\n## Version Compatibility\n\nKSail embeds specific versions of Kubernetes tooling:\n\n| Tool | Embedded Version | Purpose |\n| ------------ | ----------------- | -------------------------- |\n| kubectl | Latest | Kubernetes CLI |\n| Helm | v4 (with kstatus) | Package manager |\n| Kind | Latest | Vanilla clusters |\n| K3d | Latest | K3s clusters |\n| vCluster SDK | v0.34.0 | VCluster virtual clusters |\n| kwokctl | Latest | KWOK simulated clusters |\n| Flux | Latest | GitOps toolkit |\n| ArgoCD | Latest | GitOps continuous delivery |\n| SOPS | Latest | Secret encryption |\n\n**Notes:**\n\n- Kubernetes versions depend on the distribution release\n- Component versions (CNI, CSI, etc.) are updated with KSail releases\n- See [releases](https://github.com/devantler-tech/ksail/releases) for specific version information\n\n## Troubleshooting\n\n## Cluster Creation Issues\n\n### Docker Connection Failed\n\nVerify Docker is running with `docker ps`. If not running, start Docker Desktop (macOS) or `sudo systemctl start docker` (Linux).\n\n### Cluster Creation Hangs\n\nCommon causes: insufficient resources, firewall blocking Docker network access, or leftover cluster state.\n\n```bash\nksail cluster list\nksail cluster delete --name \ndocker system prune -f\n```\n\n### Port Already in Use\n\nIf you see `Error: Port 5000 is already allocated`, specify a different port (e.g., `--local-registry localhost:5050`) or kill the conflicting process:\n\n**macOS/Linux:**\n\n```bash\nlsof -ti:5000 | xargs kill -9\n```\n\n**Windows (PowerShell):**\n\n```powershell\nnetstat -ano | findstr :5000\ntaskkill /PID /F\n```\n\n## GitOps Workflow Issues\n\n### Registry Access and Image Push Failures\n\nKSail automatically retries transient registry errors (HTTP 429, 5xx, timeouts) during cluster create/update and `ksail workload push` (up to 5 attempts, exponential backoff 5s–30s). For authentication errors, verify connectivity and credentials:\n\n```bash\ncurl -I https://registry.example.com/v2/\ndocker ps | grep registry\nksail project init --local-registry '${REG_USER}:${REG_TOKEN}@registry.example.com/my-org/my-repo'\n```\n\n- `external registry credentials are incomplete: username is set but password is empty` — a username was provided (e.g. `GITHUB_ACTOR` is set) but the password/token is missing. Export the token environment variable (e.g. `export GITHUB_TOKEN=...`) and ensure both are set in `spec.cluster.localRegistry.registry` in `ksail.yaml`, or re-initialize with `ksail project init --local-registry 'user:token@host/repo'`.\n- `registry requires authentication` — missing or incorrect `--local-registry` credentials\n- `registry access denied` — credentials lack write permission\n- `registry is unreachable` — DNS failure, firewall, or registry down\n\nTo diagnose mirror registry health:\n\n```bash\ndocker ps --filter label=io.ksail.registry --format 'table {{.Names}}\\t{{.Status}}'\ndocker inspect --format '{{json .State.Health}}' \n```\n\n### Flux Operator Installation Timeout\n\nFlux CRDs can take 7–10 minutes on resource-constrained systems; KSail allows up to 12 minutes. If timeouts persist, check resources (`docker stats`) and ensure 4 GB+ RAM.\n\n```bash\nksail workload get pods -n flux-system\nkubectl get crd -o jsonpath='{.status.conditions[?(@.type==\"Established\")].status}'\n```\n\n### Cluster Stability Check Failures\n\nKSail checks cluster stability at two points during installation:\n\n- **Before infrastructure components** (Cilium CNI only): Ensures the eBPF dataplane is ready before deploying components (like metrics-server) that depend on ClusterIP connectivity.\n- **Before GitOps engines**: Ensures the API server is fully ready — especially important for K3s/K3d clusters, which report creation success before the API server can serve requests.\n\nIf you see `cluster not stable before infrastructure installation`, `cluster not stable after infrastructure installation`, or `in-cluster API connectivity check failed`, check resources and optionally recreate with fewer components:\n\n```bash\nksail workload get nodes\nksail workload get pods -A | grep -v Running\nksail cluster delete && ksail cluster create\n```\n\nIf the error mentions `connectivity check pod image pull failed` with `ImagePullBackOff` or `ErrImagePull`, the check pod could not pull `busybox:stable` — typically a transient Docker Hub rate-limit or network issue. Verify reachability (`curl -I https://registry-1.docker.io/v2/`) and retry with `ksail cluster delete && ksail cluster create`.\n\n### Flux Reconciliation Fails Immediately\n\nWhen `ksail workload reconcile` fails, KSail automatically displays a [diagnostic report](/guides/gitops-workflows/#automatic-failure-diagnostics) showing failing resources, pods, and recent warning events. Use this output as a starting point before running manual `kubectl` commands.\n\n`ksail workload reconcile` automatically resets HelmReleases stuck in Failed or Stalled states before polling begins. If a HelmRelease reset does not resolve the issue, or if a Flux Kustomization encounters a permanent error, reconciliation also fails fast (without waiting for the timeout):\n\n- **Build failure** — Kustomize cannot render your manifests (invalid YAML, missing patches, schema errors). Fix the manifests and re-push.\n- **Health check failure** — A deployed workload failed its readiness/liveness probe. Check pod logs for the affected workload.\n- **Upstream dependency failure** — A Kustomization that another depends on failed permanently; dependent Kustomizations fail immediately to surface the root cause rather than timing out.\n\nRun `ksail workload get kustomization -n flux-system` and `ksail workload get pods -A | grep -v Running` to identify the failing resource and its error message.\n\n### Flux/ArgoCD Not Reconciling\n\nIf changes don't appear after `ksail workload reconcile`, check status and logs:\n\n```bash\nksail workload get pods -n flux-system # Flux\nksail workload get pods -n argocd # ArgoCD\nksail workload logs -n flux-system deployment/source-controller\nksail workload reconcile --timeout=5m\n```\n\n## Image Export Issues\n\n### Blob Integrity Check Failed\n\nAfter `ksail workload export`, KSail validates the SHA256 digest of every blob in the exported OCI tar archive. If a blob is truncated or corrupt — which `ctr export` can produce silently when containerd's content store has incomplete data (e.g., from an interrupted image pull or runner resource pressure) — you will see an error like:\n\n```text\nblob integrity check failed: blob blobs/sha256/: computed SHA256 (read N of M bytes)\n```\n\nor\n\n```text\nblob integrity check failed: tar archive is truncated or corrupted: ...\n```\n\n**Resolution**: The containerd content store on the node has an incomplete or corrupt blob for one of the exported images. Pull a fresh copy of the affected image locally and import it into the cluster to replace the corrupt data, then re-export:\n\n```bash\n# Pull a fresh copy of the affected image into your local Docker daemon\ndocker pull \n# Save it to a tar archive\ndocker save -o fresh.tar\n# Import the fresh image into the cluster\nksail workload import fresh.tar\n# Re-export\nksail workload export\n```\n\nIf the error spans multiple images or you cannot identify the affected image from the blob SHA, recreate the cluster to force a full re-pull of all images:\n\n```bash\nksail cluster delete && ksail cluster create\nksail workload export\n```\n\n## Component Installation Issues\n\n### Installation Failures and Timeouts\n\nKSail retries transient Helm registry errors automatically (5 attempts, exponential backoff). For persistent failures, check resources with `docker stats` and `curl -I https://ghcr.io`, then recreate: `ksail cluster delete && ksail cluster create`. On resource-constrained systems, increase Docker limits, skip optional components, or use K3s.\n\n## Configuration Issues\n\n### Invalid ksail.yaml\n\nValidate against the [schema](https://github.com/devantler-tech/ksail/blob/main/schemas/ksail-config.schema.json) or re-initialize: `ksail project init --name my-cluster --distribution Vanilla`\n\n### Environment Variables Not Expanding\n\nEnsure environment variables are set before running KSail. Verify with `echo $MY_TOKEN` before using `${MY_TOKEN}` in configuration.\n\n## LoadBalancer Issues\n\n### LoadBalancer Service Stuck in Pending\n\nIf `kubectl get svc` shows `` for `EXTERNAL-IP`, verify LoadBalancer is enabled in `ksail.yaml` (reinitialize with `--load-balancer Enabled` if not) and check the controller for your distribution:\n\n- **Vanilla**: `docker ps | grep ksail-cloud-provider-kind`\n- **Talos**: `kubectl get pods -n metallb-system`\n- **Hetzner**: `kubectl get pods -n kube-system | grep hcloud`\n\n### Cannot Access LoadBalancer IP\n\nIf connection fails despite an external IP, ensure the application listens on `0.0.0.0` (not `127.0.0.1`). Debug with `kubectl logs -l app=my-app`, `kubectl describe svc my-app`, and `kubectl exec -it -- netstat -tlnp` to check listening ports.\n\n### MetalLB IP Pool Exhausted\n\nIf new LoadBalancer services remain pending after several successful allocations, the MetalLB IP pool is exhausted. See the [LoadBalancer Configuration Guide](/configuration/loadbalancer/#troubleshooting) to expand the address range.\n\n## Network Issues\n\n### CNI Installation Failed\n\nIf pods are stuck in `ContainerCreating` with CNI errors, check CNI pods with `ksail workload get pods -n kube-system -l k8s-app=cilium` (or `calico-node`). If failed, recreate: `ksail project init --cni Cilium && ksail cluster create`\n\n## Talos Issues\n\n### Transient Image Pull Failures\n\nKSail automatically retries transient Talos node image pull failures (up to 3 attempts, exponential backoff 5s–30s) to handle network glitches from `ghcr.io` (e.g., 504 Gateway Timeout). `Talos image pull attempt N failed (retrying in Xs): ...` messages are expected — no action required.\n\nIf all retries fail, check your internet connection and `ghcr.io` availability with `curl -I https://ghcr.io/v2/`, then retry with `ksail cluster delete && ksail cluster create`.\n\n### \"failed to append CA certificate to RootCAs pool\" on `cluster update`\n\n`ksail cluster update` against a Talos cluster fails with:\n\n```text\nfailed to apply updates: failed to sync cluster secrets:\n failed to create Talos client for secret sync:\n failed to create Talos client from saved config:\n failed to create client connection:\n failed to append CA certificate to RootCAs pool\n```\n\nThis means the CA certificate stored under the current context in `~/.talos/config` is structurally malformed. KSail validates the saved CA before opening a Talos client and surfaces the path, context name, and underlying X.509 parse error.\n\n**Recover automatically:**\n\n```bash\nksail cluster repair\n```\n\nThe `talosconfig-ca` repair detects a known single-byte BasicConstraints corruption pattern, fixes it in place, and writes a timestamped backup (`~/.talos/config.bak.`) before overwriting. The repair is idempotent and only modifies CA bytes whose corruption it recognizes.\n\n**Verify manually** (optional):\n\n```bash\nyq '.contexts..ca' ~/.talos/config | base64 -d | openssl x509 -noout -text\n```\n\nIf neither the repair nor a backup restore work, regenerate the talosconfig by re-running `ksail cluster create` (note: this requires destroying and recreating the cluster).\n\n## VCluster Issues\n\n### Transient Startup Failures\n\nKSail automatically retries transient VCluster startup failures (up to 5 attempts, 5-second delay), including exit status 22/EINVAL, D-Bus errors, network transients, GHCR pull failures, and node join timeouts (kubelet TLS bootstrap). `Retrying vCluster create (attempt 2/5)...` messages are expected — no action required.\n\nIf all retries fail, check Docker resource limits and D-Bus availability. See the [VCluster guide](/distributions/vcluster/#troubleshooting) for details.\n\n### kubectl Commands Fail After VCluster Creation\n\nWait a few seconds if `kubectl get nodes` returns connection errors immediately after creation — VCluster control planes need time to start. Verify the active context with `kubectl config current-context` and `ksail workload get nodes`.\n\n## Hetzner Cloud Issues\n\n- **HCLOUD_TOKEN not working**: Verify read/write permissions (Hetzner Cloud Console → Security → API Tokens). Test with `hcloud server list` if installed.\n- **Talos ISO not found**: The default ISO ID may be outdated. Find the correct ID in [Hetzner Cloud Console](https://console.hetzner.com/) under Images → ISOs.\n\n## Getting More Help\n\nCheck [GitHub Issues](https://github.com/devantler-tech/ksail/issues) and [Discussions](https://github.com/devantler-tech/ksail/discussions). When reporting issues, include KSail version, OS, Docker version, `ksail.yaml`, error messages, and reproduction steps.\n\n## Faq\n\n## General Questions\n\n### What is KSail?\n\nKSail is a CLI tool that bundles common Kubernetes tooling into a single binary. It provides a unified interface to create clusters, deploy workloads, and operate cloud-native stacks across different Kubernetes distributions and infrastructure providers.\n\n### Why use KSail instead of kubectl/helm/kind/k3d directly?\n\nKSail eliminates tool sprawl by embedding kubectl, helm, kind, k3d, vcluster, flux, and argocd into one binary with a consistent workflow across distributions. It uses standard native config files (kind.yaml, k3d.yaml, vcluster.yaml), provides declarative configuration with built-in best practices, and includes GitOps integration—without vendor lock-in.\n\n### Am I locked into KSail?\n\nNo. KSail generates native configuration files usable directly with their respective tools:\n\n```bash\nkind create cluster --config kind.yaml\nk3d cluster create --config k3d.yaml\ntalosctl cluster create --config-patch @talos/cluster/patches.yaml\nvcluster create my-cluster --values vcluster.yaml\n```\n\n### Is KSail production-ready?\n\nKSail targets **local development, CI/CD, and learning environments**. For production, use managed services (EKS, GKE, AKS) with proper HA and security. The Talos Hetzner provider suits personal homelabs but should be evaluated carefully for production use.\n\n## Installation & Setup\n\n### Which operating systems does KSail support?\n\nKSail supports Linux (amd64, arm64), macOS (arm64/Apple Silicon), and Windows (WSL2 recommended). See the [Installation Guide](/installation/) for details.\n\n### Do I need to install Docker, kubectl, helm, etc.?\n\nDocker is required for local cluster creation. KSail embeds kubectl, helm, kind, k3d, vcluster, flux, and argocd as Go libraries—no separate installation needed. For Hetzner cloud clusters, you need a Hetzner account and API token.\n\n### How do I update KSail?\n\nThe update method depends on how you installed it:\n\n```bash\nbrew upgrade devantler-tech/tap/ksail # Homebrew\ngo install github.com/devantler-tech/ksail/v7@latest # Go install\n# Binary: https://github.com/devantler-tech/ksail/releases\n```\n\n## Cluster Management\n\n### Which Kubernetes distributions does KSail support?\n\nKSail currently supports **Vanilla** (Kind), **K3s** (K3d), **Talos**, **VCluster** (Vind), **KWOK** (kwokctl, simulated), and **EKS** (scaffolding available; `ksail cluster create` is not yet functional). See the [Support Matrix](/support-matrix/) for current provider compatibility and feature status.\n\n### Can I create multiple clusters?\n\nYes. Use `ksail project init --name ` then `ksail cluster create` for each cluster. List all with `ksail cluster list`.\n\n### How do I create an ephemeral cluster that auto-destroys?\n\nUse `--ttl` with `ksail cluster create`. The process blocks until the TTL elapses, then auto-deletes the cluster and its state. Press Ctrl+C to cancel the wait and keep the cluster running.\n\n```bash\n# Cluster auto-destroys after 1 hour\nksail cluster create --ttl 1h\n\n# Supported duration formats: 30m, 1h, 2h30m\n```\n\nFor usage patterns and tips, see [Ephemeral Clusters](/guides/ephemeral-clusters/).\n\n### How do I switch between clusters?\n\nUse `ksail cluster switch` for the native experience. Run it without arguments for an interactive picker, or pass a cluster name directly:\n\n```bash\nksail cluster switch # interactive picker — recent clusters shown first (requires a TTY)\nksail cluster switch dev # switch directly to \"dev\"\n```\n\nThe interactive picker orders recently-switched clusters (up to the last 5) at the top, making it fast to cycle between a small set of active clusters. History is saved to `~/.ksail/switch-history.json`.\n\nYou can also use `kubectl config use-context ` directly, or list all contexts with `kubectl config get-contexts`.\n\n### Can I use my own container registry?\n\nYes! KSail supports local registries with optional authentication, mirror registries to avoid rate limits, and external registries with authentication. Credentials are automatically discovered from Docker config (`~/.docker/config.json`), environment variables, or GitOps secrets. See [Registry Management](/guides/registry-management/) for configuration examples.\n\n### What happens if I change the distribution or provider in ksail.yaml?\n\nChanging the distribution (e.g., Vanilla to Talos) or provider (e.g., Docker to Hetzner) requires full cluster recreation. Delete the old cluster with `ksail cluster delete`, then run `ksail cluster create`.\n\n### Which distributions support LoadBalancer services?\n\nLoadBalancer support varies by distribution and provider:\n\n- **Vanilla**: cloud-provider-kind\n- **K3s**: built-in ServiceLB\n- **Talos/Docker**: MetalLB (pool 172.18.255.200-172.18.255.250); **Talos/Hetzner**: Hetzner Cloud Load Balancer\n- **VCluster**: delegates to host cluster (`spec.cluster.loadBalancer` has no effect)\n- **KWOK**: simulated via API (no real traffic routing)\n- **EKS**: built-in AWS Load Balancer Controller (planned)\n\nSee the [Support Matrix](/support-matrix/#component--distribution-matrix) for the full compatibility table.\n\n### Can I add nodes to an existing cluster?\n\nNode scaling support depends on the distribution: Talos supports both control-plane and worker nodes via `ksail cluster update`, K3s supports worker (agent) nodes only (server scaling requires recreation), and Vanilla (Kind) requires full recreation. See the [Update Behavior](/support-matrix/#update-behavior) table for details.\n\n### What does `ksail cluster update --dry-run` show?\n\nPreviews all detected configuration changes without applying them. Each change is listed with an emoji classification and `old → new` values:\n\n- 🟢 **In-place** — applied without disruption\n- 🟡 **Reboot-required** — applied but requires node reboots\n- 🔴 **Recreate-required** — requires full cluster recreation\n\nOutputs `No changes detected` when configuration is already in sync.\n\n### What happens when I run `ksail cluster update` with no changes?\n\nIt compares the current cluster state against `ksail.yaml` and exits with `No changes detected` if nothing has changed—making it safe to run frequently in CI/CD pipelines.\n\n## Workload Management\n\n### What's the difference between `ksail workload apply` and `ksail workload reconcile`?\n\n`apply` deploys directly (kubectl-style, no GitOps); `reconcile` syncs via Flux or ArgoCD for Git-driven deployments.\n\n### Can I use Helm charts with KSail?\n\nYes. KSail includes Helm v4. Use `ksail workload install --namespace ` to install a chart, or `ksail workload gen helmrelease --source=oci://registry/chart` to generate a HelmRelease for GitOps.\n\n### How do I debug failing pods?\n\nUse `ksail workload logs ` to view logs, `ksail workload describe ` to inspect resources, and `ksail workload exec -- /bin/sh` to shell into a container.\n\n## GitOps\n\n### Which GitOps tools does KSail support?\n\nKSail supports both **Flux** and **ArgoCD**, chosen with `--gitops-engine Flux` or `--gitops-engine ArgoCD` during `ksail project init`.\n\n### Do I need a Git repository for GitOps?\n\nNot necessarily. KSail packages manifests as OCI artifacts and pushes to a local registry, enabling GitOps without Git (useful for local development):\n\n```bash\nksail project init --gitops-engine Flux --local-registry localhost:5050\nksail cluster create\nksail workload push\nksail workload reconcile\n```\n\nTo use your own Git repository, configure the GitOps engine after initialization—KSail scaffolds the initial CRs.\n\n### Why does Flux operator installation take so long?\n\nFlux operator CRDs can take 7-12 minutes to become established on resource-constrained systems; KSail handles this automatically with a 12-minute timeout. Ensure 4GB+ RAM is available. See [Troubleshooting - Flux Operator Installation Timeout](/troubleshooting/#flux-operator-installation-timeout) for details.\n\n## Configuration\n\n### What's the difference between CLI flags and ksail.yaml?\n\nCLI flags provide quick overrides and scripting support, while ksail.yaml offers declarative configuration suitable for version control and team consistency. CLI flags override ksail.yaml values. See [Configuration Overview](/configuration/).\n\n### Can I version control my cluster configuration?\n\nYes! Commit `ksail.yaml` (and generated distribution configs like kind.yaml) to Git—team members can recreate the same cluster from it.\n\n### How do I share configurations between environments?\n\nUse the `--config` flag to point KSail at environment-specific files:\n\n```bash\nksail --config ksail.dev.yaml cluster create\nksail --config ksail.staging.yaml cluster update\nksail --config ksail.prod.yaml workload push\n```\n\nAlternatively, use environment variable placeholders in a shared `ksail.yaml`. For a complete walkthrough covering both approaches and CI/CD patterns, see [Multi-Environment Workflows](/guides/multi-environment/).\n\n## Security & Secrets\n\n### How do I manage secrets with KSail?\n\nKSail includes **SOPS** for secret encryption via `ksail workload cipher ` (age, PGP, cloud KMS). See [Secret Management](/guides/secret-management/).\n\n### Are my credentials stored securely?\n\nKSail expands `${VAR}` syntax at runtime; credentials are never stored in config files. Example: `ksail project init --local-registry 'user:${REGISTRY_TOKEN}@registry.example.com'` (set `REGISTRY_TOKEN` before running).\n\n## Licensing\n\n### Why is KSail licensed under PolyForm Shield 1.0.0?\n\nKSail was relicensed from Apache-2.0 (via GPL-3.0-only in [#4543](https://github.com/devantler-tech/ksail/pull/4543)) to [PolyForm Shield 1.0.0](https://polyformproject.org/licenses/shield/1.0.0) in [#4603](https://github.com/devantler-tech/ksail/pull/4603) (May 2026). The PolyForm Shield license allows anyone to use, modify, and distribute KSail for any purpose — except providing a competing product. This protects the project from commercial exploitation while keeping the code freely available for all other use cases.\n\n### Is KSail open source?\n\nKSail is **source-available**, not open source by the [OSI definition](https://opensource.org/osd). The non-compete clause disqualifies it from OSI approval. In practice, the difference only matters if you intend to build a competing product — for all other use cases (CLI tool, library, internal tooling, learning, forking), KSail works exactly like an open-source project.\n\n### Can I use KSail in my proprietary project?\n\n**Yes.** PolyForm Shield does not impose copyleft requirements — your project can use any license. You can use KSail as a CLI tool, embed it as a Go library, or incorporate its code into your own projects. If you redistribute KSail or derivatives, you must include the [license terms](https://polyformproject.org/licenses/shield/1.0.0) and required copyright notice, and the non-compete restriction still applies.\n\n### What counts as \"competing\"?\n\nThe [PolyForm Shield license](https://polyformproject.org/licenses/shield/1.0.0) defines competition broadly: goods and services compete even across different interfaces, platforms, or programming languages, and even when provided free of charge. If you market a product as a practical substitute for KSail, it competes.\n\n### How does the license affect contributors?\n\nBy submitting a pull request, you agree that your contribution is licensed under PolyForm Shield 1.0.0. Any third-party code included in contributions must be compatible with this license. See [CONTRIBUTING.md](https://github.com/devantler-tech/ksail/blob/main/CONTRIBUTING.md) for details.\n\n## Troubleshooting\n\nFor common solutions, see the [Troubleshooting Guide](/troubleshooting/). To clean up all cluster and Docker resources, run `ksail cluster delete && docker system prune`. For help, visit [GitHub Discussions](https://github.com/devantler-tech/ksail/discussions) or [GitHub Issues](https://github.com/devantler-tech/ksail/issues).\n\n## Declarative Configuration\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\nKSail uses declarative YAML configuration files for reproducible cluster setup. This page describes `ksail.yaml` — the project-level configuration file that defines your cluster's desired state.\n\n## What is ksail.yaml?\n\nEach KSail project includes a `ksail.yaml` file describing cluster distribution, networking, components, and workload configuration. Run `ksail project init` to generate it — commit to version control to share with your team.\n\n## Environment Variable Expansion\n\nKSail supports environment variable expansion in all string configuration values using the `${VAR_NAME}` syntax for secure credentials, environment-specific paths, and dynamic values.\n\n### Syntax\n\n**Basic syntax:** `${VARIABLE_NAME}` — Reference an environment variable. If not set, expands to an empty string and logs a warning.\n\n**Default value syntax:** `${VARIABLE_NAME:-default}` — Use a default value if the variable is not set. No warning is logged when using defaults.\n\n```yaml\nspec:\n editor: \"${EDITOR:-vim}\"\n cluster:\n connection:\n kubeconfig: \"${HOME}/.kube/config\"\n context: \"${KUBE_CONTEXT:-kind-kind}\"\n distributionConfig: \"${CONFIG_DIR:-configs}/kind.yaml\"\n localRegistry:\n registry: \"${REGISTRY:-localhost:5000}\"\n vanilla:\n mirrorsDir: \"${MIRRORS_DIR:-mirrors}\"\n talos:\n config: \"${TALOS_CONFIG_PATH:-~/.talos/config}\"\n provider:\n hetzner:\n sshKeyName: \"${HCLOUD_SSH_KEY}\"\n workload:\n sourceDirectory: \"${WORKLOAD_DIR:-k8s}\"\n chat:\n model: \"${CHAT_MODEL:-gpt-4o}\"\n```\n\n### Expansion Behavior\n\n| Syntax | Variable Set | Variable Not Set |\n| ----------------- | ------------ | ------------------------- |\n| `${VAR}` | Uses value | Empty string + warning |\n| `${VAR:-default}` | Uses value | Uses default (no warning) |\n| `${VAR:-}` | Uses value | Empty string (no warning) |\n\n### Scope\n\nEnvironment variables are expanded in all string fields of `ksail.yaml`, distribution configs (`kind.yaml`, `k3d.yaml`), and Talos patch files (`talos/cluster/`, `talos/control-planes/`, `talos/workers/`):\n\n```yaml\n# kind.yaml - Environment variables are expanded before parsing\nkind: Cluster\napiVersion: kind.x-k8s.io/v1alpha4\ncontainerdConfigPatches:\n - |-\n [plugins.\"io.containerd.grpc.v1.cri\".registry.mirrors.\"${REGISTRY:-localhost:5000}\"]\n endpoint = [\"http://${REGISTRY:-localhost:5000}\"]\n```\n\n```yaml\n# talos/cluster/registry.yaml - Environment variables are expanded\nmachine:\n registries:\n mirrors:\n docker.io:\n endpoints:\n - http://${REGISTRY:-localhost:5000}\n```\n\nBecause patch files are expanded too, you can inject **registry credentials** into the Talos\nmachine config as config-as-code — keeping the secret in the environment, never committed. This is\nthe supported way to give nodes registry auth (for example, so containerd can fetch cosign\nsignatures for **private** packages during image verification) without passing credentials via CLI\nflags:\n\n```yaml\n# talos/cluster/registry-auth.yaml - Credentials are injected from the environment at load time\nmachine:\n registries:\n config:\n ghcr.io:\n auth:\n username: my-user\n password: ${GHCR_TOKEN} # expanded at load; commit the placeholder, not the token\n```\n\n### Example: Credentials\n\n```yaml\nspec:\n cluster:\n localRegistry:\n registry: \"${REGISTRY_USER}:${REGISTRY_PASS}@${REGISTRY_HOST:-ghcr.io}/myorg/myrepo\"\n```\n\n```bash\nexport REGISTRY_USER=\"github-user\"\nexport REGISTRY_PASS=\"ghp_secrettoken123\"\nksail cluster create\n```\n\n### Example: Multi-Environment Setup\n\n```yaml\nspec:\n cluster:\n connection:\n context: \"${CLUSTER_NAME:-kind-kind}\"\n distributionConfig: \"${ENV:-dev}/kind.yaml\"\n workload:\n sourceDirectory: \"${ENV:-dev}/k8s\"\n```\n\n```bash\n# Development (using defaults)\nksail cluster create\n\n# Production (override with environment variables)\nexport ENV=\"prod\"\nexport CLUSTER_NAME=\"prod-cluster\"\nksail cluster create\n```\n\n## Minimal Example\n\n```yaml\n# yaml-language-server: $schema=https://raw.githubusercontent.com/devantler-tech/ksail/main/schemas/ksail-config.schema.json\napiVersion: ksail.io/v1alpha1\nkind: Cluster\nspec:\n cluster:\n distribution: Vanilla\n distributionConfig: kind.yaml\n```\n\nThis minimal configuration creates a Vanilla cluster (implemented with Kind) using defaults for all other settings.\n\n## Complete Example\n\n```yaml\n# yaml-language-server: $schema=https://raw.githubusercontent.com/devantler-tech/ksail/main/schemas/ksail-config.schema.json\napiVersion: ksail.io/v1alpha1\nkind: Cluster\nspec:\n editor: code --wait\n cluster:\n distribution: Vanilla\n distributionConfig: kind.yaml\n connection:\n kubeconfig: ~/.kube/config\n context: kind-kind\n timeout: 5m\n cni: Cilium\n csi: Default\n metricsServer: Enabled\n certManager: Enabled\n policyEngine: Kyverno\n localRegistry:\n registry: localhost:5050\n gitOpsEngine: Flux\n workload:\n sourceDirectory: k8s\n validateOnPush: true\n```\n\n## Configuration Reference\n\n### Top-Level Fields\n\n| Field | Type | Required | Description |\n| ----- | ---- | -------- | ----------- |\n| `apiVersion` | string | Yes | Must be `ksail.io/v1alpha1` |\n| `kind` | string | Yes | Must be `Cluster` |\n| `spec` | object | Yes | Cluster and workload specification (see below) |\n\n### spec\n\nThe `spec` field is a `Spec` object that defines editor, cluster, and workload configuration.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `editor` | string | – | Editor command for interactive workflows (e.g. code --wait). CLI-only; ignored by the operator. |\n| `cluster` | ClusterSpec | – | Cluster configures the Kubernetes cluster KSail manages: distribution, provider, components, and connection settings. |\n| `provider` | ProviderSpec | – | Provider holds infrastructure-provider-specific options (Hetzner, Omni, AWS, GCP, and the Kubernetes provider for nested clusters). |\n| `workload` | WorkloadSpec | – | Workload configures workload management: the manifest source directory, OCI push and validation settings, and GitOps bootstrap options. |\n| `chat` | ChatSpec | – | Chat configures the KSail AI chat assistant. CLI-only; ignored by the operator (the Cluster CRD shares this type but never reads it). |\n\n### spec.editor\n\nEditor command for interactive workflows (e.g., `code --wait`, `vim`). Falls back to `SOPS_EDITOR`, `KUBE_EDITOR`, `EDITOR`, `VISUAL`, or system defaults.\n\n### spec.cluster (ClusterSpec)\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `distributionConfig` | string | – | Path to the distribution's own configuration file (kind.yaml |\n| `connection` | Connection | – | Connection defines how KSail connects to the cluster: the kubeconfig path, context name, and operation timeout. CLI-only (local kubeconfig path/context); ignored by the operator. |\n| `distribution` | enum | – | Distribution selects the Kubernetes distribution to provision: Vanilla (Kind), K3s (K3d), Talos, VCluster, KWOK (simulated), EKS (AWS), or GKE (Google Cloud). |\n| `provider` | enum | – | Provider selects the infrastructure that runs the cluster nodes: Docker, Hetzner, Omni, AWS, GCP, or Kubernetes (nested clusters inside an existing cluster). Each distribution supports a subset of providers; when empty, KSail uses the distribution's default provider. |\n| `cni` | enum | – | CNI selects the Container Network Interface plugin. Default keeps the distribution's built-in CNI; Cilium or Calico install that CNI instead. |\n| `csi` | enum | – | CSI controls Container Storage Interface support. Default keeps the distribution's behavior; Enabled installs a CSI driver (local-path-provisioner, or Hetzner CSI on Hetzner); Disabled installs none. |\n| `cdi` | enum | – | CDI controls Container Device Interface support in the container runtime (Default, Enabled, or Disabled). |\n| `metricsServer` | enum | – | MetricsServer controls metrics-server installation. Default keeps the distribution's behavior; Enabled or Disabled override it. |\n| `loadBalancer` | enum | – | LoadBalancer controls load-balancer support. Default keeps the distribution and provider behavior; Enabled or Disabled override it. |\n| `certManager` | enum | – | CertManager controls whether cert-manager is installed (Enabled or Disabled). |\n| `imageVerification` | enum | – | Container-image signature verification scaffolding for all distributions: Talos scaffolds an ImageVerificationConfig document (1.13+); Vanilla/Kind injects a containerd verifier plugin patch; K3s/K3d scaffolds a containerd config template and mounts it into node containers. Requires verifier binaries (and typically policy) in the node image bin_dir. Disabled skips it. |\n| `policyEngine` | enum | – | PolicyEngine selects the policy engine to install: None, Kyverno, or Gatekeeper. |\n| `localRegistry` | LocalRegistry | – | LocalRegistry configures the host-local OCI registry (or an external registry for cloud providers) used by GitOps workflows. |\n| `gitOpsEngine` | enum | – | GitOpsEngine selects the GitOps engine KSail bootstraps: None, Flux, or ArgoCD. |\n| `sops` | SOPS | – | SOPS configures automatic creation of the SOPS Age secret used to decrypt encrypted manifests in the cluster. |\n| `nodeAutoscaling` | enum | – | Deprecated. Use autoscaler.node.enabled instead. Do not set both nodeAutoscaling and autoscaler. |\n| `autoscaler` | AutoscalerConfig | – | Pod and node autoscaling configuration (supersedes deprecated nodeAutoscaling) |\n| `importImages` | string | – | Path to tar archive with container images to import after cluster creation but before component installation |\n| `controlPlanes` | int32 | `1` | Number of control-plane nodes to create for the cluster (provider/distribution-agnostic) |\n| `workers` | int32 | – | Number of worker nodes to create for the cluster (provider/distribution-agnostic) |\n| `kubernetesVersion` | string | – | Kubernetes version to deploy. When set: cluster create/update reconcile toward it. When unset: cluster update follows the latest stable version and new clusters use a default compatible with the pinned Talos version. |\n| `oidc` | OIDCSpec | – | OIDC authentication configuration for the API server and kubeconfig |\n| `vanilla` | OptionsVanilla | – | Vanilla holds options specific to the Vanilla (Kind) distribution. |\n| `talos` | OptionsTalos | – | Talos holds options specific to the Talos distribution. |\n\n#### distribution\n\nSee [Distributions](/concepts/#distributions) for detailed information.\n\n- `Vanilla` (default) – Standard upstream Kubernetes via [Kind](https://kind.sigs.k8s.io/)\n- `K3s` – Lightweight Kubernetes via [K3d](https://k3d.io/)\n- `Talos` – [Talos Linux](https://www.talos.dev/) in Docker containers or Hetzner Cloud servers\n- `VCluster` – Virtual clusters via [vCluster](https://www.vcluster.com/)\n- `KWOK` – Simulated clusters via [KWOK](https://kwok.sigs.k8s.io/) (control-plane only, no real workloads)\n- `EKS` – Amazon Elastic Kubernetes Service via [eksctl](https://eksctl.io/) (requires AWS credentials and the `eksctl` CLI on `PATH`)\n- `GKE` – Google Kubernetes Engine via the native Go SDK (requires Google Cloud Application Default Credentials and a project via `GOOGLE_CLOUD_PROJECT`)\n\n#### provider\n\nSee [Providers](/concepts/#providers) for more details.\n\n- `Docker` (default) – Run nodes as Docker containers (local development)\n- `Hetzner` – Run nodes on Hetzner Cloud servers (requires `HCLOUD_TOKEN`)\n- `Omni` – Manage Talos cluster nodes through [Sidero Omni](https://omni.siderolabs.com/)\n- `AWS` – Manage EKS clusters on Amazon Web Services (requires standard AWS SDK credentials)\n- `GCP` – Manage GKE clusters on Google Cloud (requires Application Default Credentials)\n\n> [!NOTE]\n> Hetzner and Omni providers are only supported with the `Talos` distribution. The AWS provider is only supported with the `EKS` distribution, and the GCP provider only with the `GKE` distribution.\n\n#### distributionConfig\n\nPath to the distribution-specific configuration file or directory. This tells KSail where to find settings like node counts, port mappings, and distribution-specific features.\n\n**Default values by distribution:**\n\n- `Vanilla` → `kind.yaml`\n- `K3s` → `k3d.yaml`\n- `Talos` → `talos/` (directory)\n- `VCluster` → `vcluster.yaml`\n- `KWOK` → `kwok/` (directory)\n- `EKS` → `eks.yaml`\n- `GKE` → `gke.yaml` (optional – the GKE API owns the cluster shape)\n\nSee [Distribution Configuration](#distribution-configuration) below for details on each format.\n\n#### connection (Connection)\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `kubeconfig` | string | `~/.kube/config` | Path to kubeconfig file |\n| `context` | string | (derived) | Kubeconfig context name |\n| `timeout` | duration | – | Timeout for cluster operations |\n\n**Context defaults by distribution:**\n\n- `Vanilla` → `kind-kind`\n- `K3s` → `k3d-k3d-default`\n- `Talos` (Docker/Hetzner) → `admin@talos-default`\n- `Talos` (Omni) → the context name generated by Omni (e.g., `devantler-prod`)\n- `VCluster` → `vcluster-docker_vcluster-default`\n- `KWOK` → `kwok-kwok-default`\n\nWhen using Talos with Omni, Omni generates the context name; set `spec.cluster.connection.context` to that generated name.\n\n**Timeout format:** Go duration string (e.g., `30s`, `5m`, `1h`)\n\n#### cni\n\nSee [CNI](/concepts/#container-network-interface-cni) for more details.\n\n- `Default` (default) – Uses the distribution's built-in CNI (`kindnetd` for Vanilla, `flannel` for K3s)\n- `Cilium` – Installs [Cilium](https://cilium.io/) for advanced networking and observability\n- `Calico` – Installs [Calico](https://www.tigera.io/project-calico/) for network policies\n\n#### csi\n\nSee [CSI](/concepts/#container-storage-interface-csi) for more details.\n\n- `Default` (default) – Uses the distribution × provider's default behavior:\n - K3s: includes local-path-provisioner\n - Vanilla/Talos × Docker: no CSI\n - Talos × Hetzner: includes Hetzner CSI driver\n- `Enabled` – Explicitly installs CSI driver (local-path-provisioner for local clusters, Hetzner CSI for Talos × Hetzner)\n- `Disabled` – Disables CSI installation (for K3s, this disables the default local-storage)\n\n#### metricsServer\n\nWhether to install [metrics-server](/concepts/#metrics-server) for resource metrics.\n\n- `Default` (default) – Uses distribution's default behavior (K3s includes metrics-server; Vanilla and Talos do not)\n- `Enabled` – Install metrics-server\n- `Disabled` – Skip installation\n\nWhen metrics-server is enabled on Vanilla or Talos, KSail automatically:\n\n1. Configures kubelet certificate rotation (`serverTLSBootstrap: true`)\n2. Installs [kubelet-csr-approver](/concepts/#kubelet-csr-approver) to approve certificate requests\n3. Deploys metrics-server with secure TLS communication\n\n#### certManager\n\nWhether to install [cert-manager](/concepts/#cert-manager) for TLS certificate management.\n\n- `Enabled` – Install cert-manager\n- `Disabled` (default) – Skip installation\n\n#### policyEngine\n\nPolicy engine to install for enforcing security, compliance, and best practices. See [Policy Engines](/concepts/#policy-engines) for details.\n\n- `None` (default) – No policy engine\n- `Kyverno` – Install [Kyverno](https://kyverno.io/)\n- `Gatekeeper` – Install [OPA Gatekeeper](https://open-policy-agent.github.io/gatekeeper/)\n\n#### localRegistry\n\nRegistry configuration for GitOps workflows. Supports local Docker registries or external registries with authentication.\n\n**Format:** `[user:pass@]host[:port][/path]`\n\n**Examples:**\n\n- `localhost:5050` – Local Docker registry\n- `ghcr.io/myorg/myrepo` – GitHub Container Registry\n- `${USER}:${PASS}@ghcr.io:443/myorg` – With credentials from environment variables\n\n> [!NOTE]\n> Credentials support `${ENV_VAR}` placeholders for secure handling.\n\n#### gitOpsEngine\n\nGitOps engine for continuous deployment. See [GitOps](/concepts/#gitops). When set to `Flux` or `ArgoCD`, KSail scaffolds a GitOps CR into your source directory.\n\n- `None` (default) – No GitOps engine\n- `Flux` – Install [Flux CD](https://fluxcd.io/) and scaffold FluxInstance CR\n- `ArgoCD` – Install [Argo CD](https://argo-cd.readthedocs.io/) and scaffold Application CR\n\n#### Distribution and Tool Options\n\nAdvanced configuration options are direct fields under `spec.cluster`. See [Schema Support](#schema-support) for the complete structure.\n\n**Talos options (`spec.cluster.talos`):**\n\n- `controlPlanes` – Number of control-plane nodes (default: `1`)\n- `workers` – Number of worker nodes (default: `0`)\n- `config` – Path to talosconfig file (default: `~/.talos/config`)\n- `version` – Pin the Talos OS version (e.g. `v1.12.4`); caps upgrades and selects the node image (default: built-in)\n- `iso` – Cloud provider ISO/image ID for Talos Linux (default: `125127` for Talos 1.12.4 x86; for ARM, look up the matching ISO ID under **Images → ISOs** in the Hetzner Cloud Console)\n\nThe Kubernetes version is set at the top level (`spec.cluster.kubernetesVersion`), not under `talos`:\n\n- `kubernetesVersion` – Pin the Kubernetes version (e.g. `v1.32.0`). When unset, `cluster update` keeps the version already running (no unrequested upgrade) and new clusters default to one compatible with the pinned `talos.version`\n\n**Provider options (`spec.provider`):** infrastructure provider options (Hetzner, Omni, AWS, GCP, Kubernetes) are documented in the generated [spec.provider (ProviderSpec)](#specprovider-providerspec) sections below.\n\n**Autoscaler options (`spec.cluster.autoscaler`):** pod and node autoscaling options are documented in the generated [spec.cluster.autoscaler (AutoscalerConfig)](#specclusterautoscaler-autoscalerconfig) sections below.\n\n**Vanilla options (`spec.cluster.vanilla`):**\n\n- `mirrorsDir` – Directory for containerd host mirror configuration\n\n### spec.cluster.autoscaler (AutoscalerConfig)\n\nAutoscalerConfig defines configuration for pod and node autoscaling.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `pod` | PodAutoscalerConfig | – | Pod configures pod-level autoscaling (horizontal and vertical). |\n| `node` | NodeAutoscalerConfig | – | Node configures node-level autoscaling via the Cluster Autoscaler. |\n\n### spec.cluster.autoscaler.pod (PodAutoscalerConfig)\n\nPodAutoscalerConfig defines configuration for pod-level autoscaling.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `horizontal` | enum | – | Horizontal controls Horizontal Pod Autoscaler (HPA) support. |\n| `vertical` | enum | – | Vertical controls Vertical Pod Autoscaler (VPA) support. |\n\n### spec.cluster.autoscaler.node (NodeAutoscalerConfig)\n\nNodeAutoscalerConfig defines configuration for node-level autoscaling. When Enabled, the Cluster Autoscaler manages worker node counts dynamically. KSail-specified node counts serve as a baseline; the autoscaler adds and removes workers based on workload demand. Node-count changes via ksail cluster update are still applied to the Talos machine config and will take effect normally.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `enabled` | enum | – | Whether the Cluster Autoscaler is installed to manage worker node counts dynamically (Enabled or Disabled). A YAML boolean is accepted as an alias (true=Enabled |\n| `pools` | []NodePool | – | Pools defines the node pools the Cluster Autoscaler may scale (Hetzner only). |\n| `maxNodesTotal` | int32 | – | Maximum total number of nodes in the cluster (control-planes + workers + autoscaler nodes). Passed verbatim to the cluster-autoscaler --max-nodes-total flag — the autoscaler evaluates it against the count of ALL nodes so this is the whole-cluster ceiling and not an autoscaler-only budget. Set to 0 to disable the global cap; growth is then bounded only by the per-pool max values and serverLimit. Should be <= serverLimit |\n| `expander` | []enum | – | Node expander strategy for the cluster autoscaler. Accepts either a single value (e.g. LeastWaste) or an ordered priority list (e.g. [LeastNodes |\n| `scaleDownUnneededTime` | string | – | How long a node should be unneeded before it is eligible for scale down (e.g. 10m) |\n| `capacityBuffers` | boolean | – | Enable the Cluster Autoscaler capacity-buffers feature: KSail installs the CapacityBuffer CRD (capacitybuffers.autoscaling.x-k8s.io) and enables the buffer controller and pod-injection flags. CapacityBuffer resources then reserve scale-up headroom as virtual (pod-less) chunks simulated in autoscaler memory — a native replacement for low-priority balloon-pod overprovisioning. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true) |\n\n### spec.cluster.autoscaler.node.pools[] (NodePool)\n\nNodePool defines a Hetzner node pool managed by the cluster autoscaler.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `name` | string | – | Name is the unique identifier for this node pool (DNS-1123 label). |\n| `serverType` | string | – | ServerType is the Hetzner server type for nodes in this pool (e.g. \"cx23\", \"cax11\"). |\n| `location` | string | – | Location is the Hetzner datacenter location for this pool (e.g. \"fsn1\", \"nbg1\"). |\n| `min` | int32 | – | Min is the minimum number of nodes in this pool. |\n| `max` | int32 | – | Max is the maximum number of nodes in this pool. |\n| `labels` | map[string]string | – | Kubernetes node labels applied to every node in this pool (via Talos machine.nodeLabels and the autoscaler scale-from-zero template). |\n| `taints` | []NodePoolTaint | – | Kubernetes node taints applied to every node in this pool (via Talos machine.nodeTaints and the autoscaler scale-from-zero template). |\n\n### spec.cluster.autoscaler.node.pools[].taints[] (NodePoolTaint)\n\nNodePoolTaint defines a Kubernetes node taint applied to every node in an autoscaler node pool.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `key` | string | – | Key is the taint key. Must be a valid Kubernetes label key (an optional DNS-subdomain prefix followed by a name segment). |\n| `value` | string | – | Value is the optional taint value. |\n| `effect` | enum | – | Effect is the scheduling effect: NoSchedule, PreferNoSchedule, or NoExecute. |\n\n### spec.provider (ProviderSpec)\n\nProviderSpec defines provider-specific configuration for infrastructure providers. This separates infrastructure provider concerns (Hetzner servers, Omni SaaS) from cluster/distribution concerns in ClusterSpec.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `hetzner` | OptionsHetzner | – | Hetzner holds options for the Hetzner Cloud provider. |\n| `omni` | OptionsOmni | – | Omni holds options for the Sidero Omni provider. |\n| `aws` | OptionsAWS | – | AWS holds options for the AWS provider used by the EKS distribution. |\n| `gcp` | OptionsGCP | – | GCP holds options for the Google Cloud provider used by the GKE distribution. |\n| `kubernetes` | OptionsKubernetes | – | Kubernetes holds options for the Kubernetes provider, which runs nested clusters as pods inside an existing host cluster. |\n\n### spec.provider.hetzner (OptionsHetzner)\n\nOptionsHetzner defines options specific to the Hetzner Cloud provider. These options are used when Provider is set to \"Hetzner\" for the Talos distribution.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `controlPlaneServerType` | string | `cx23` | ControlPlaneServerType is the Hetzner server type for control-plane nodes. Examples: \"cx23\" (x86), \"cax11\" (ARM), \"cpx21\" (AMD). Defaults to \"cx23\". |\n| `workerServerType` | string | `cx23` | WorkerServerType is the Hetzner server type for worker nodes. Examples: \"cx23\" (x86), \"cax11\" (ARM), \"cpx21\" (AMD). Defaults to \"cx23\". |\n| `location` | string | `fsn1` | Location is the Hetzner datacenter location. Examples: \"fsn1\" (Falkenstein), \"nbg1\" (Nuremberg), \"hel1\" (Helsinki). Defaults to \"fsn1\". |\n| `networkName` | string | – | NetworkName is the name of the private network to create or use. If empty, a network named \"<cluster-name>-network\" will be created. |\n| `networkCidr` | string | `10.0.0.0/16` | NetworkCIDR is the CIDR block for the private network. Defaults to \"10.0.0.0/16\". |\n| `sshKeyName` | string | – | SSHKeyName is the name of the SSH key to use for server access. The key must already exist in the Hetzner Cloud project. If empty, no SSH key is attached (only Talos API access). |\n| `tokenEnvVar` | string | `HCLOUD_TOKEN` | TokenEnvVar is the environment variable containing the Hetzner API token. Defaults to \"HCLOUD_TOKEN\". |\n| `placementGroupStrategy` | enum | `Spread` | PlacementGroupStrategy controls whether and how placement groups are used. \"Spread\" (default) distributes servers across different physical hosts for HA. \"None\" disables placement groups, useful when Hetzner resources are constrained. Note: Spread groups are limited to 10 servers per datacenter. |\n| `placementGroup` | string | – | PlacementGroup is the name of the placement group for server distribution. If empty, a placement group named \"<cluster-name>-placement\" will be created. Only used when PlacementGroupStrategy is \"Spread\". |\n| `fallbackLocations` | []string | – | Alternative datacenter locations to try when server creation in the primary location fails due to resource unavailability. When empty defaults to nbg1 and hel1 (both in the eu-central network zone matching the default fsn1 primary location). |\n| `placementGroupFallbackToNone` | boolean | – | PlacementGroupFallbackToNone allows automatic fallback to no placement group when spread placement constraints cannot be satisfied (e.g., due to datacenter capacity). When true and placement fails, retries server creation without a placement group. Defaults to false to preserve HA guarantees; set to true for best-effort provisioning. |\n| `floatingIPEnabled` | boolean | – | Provision a Hetzner floating IP and render it as the stable Kubernetes/Talos API endpoint (endpoint + certificate SANs + a control-plane Talos VIP block for leader ownership handover; the hcloud API token is embedded in the control-plane machine config). Defaults to false. |\n| `floatingIPLocation` | string | – | Hetzner location the floating IP is homed in (routing latency only). Defaults to the cluster's location. |\n| `ingressFirewall` | enum | `Enabled` | IngressFirewall controls the Talos OS-level ingress firewall configuration. When Enabled (default), KSail generates NetworkDefaultActionConfig and NetworkRuleConfig documents as Talos machine config patches, providing defense-in-depth at the node level independent of the Hetzner Cloud Firewall. See: https://www.talos.dev/latest/talos-guides/network/ingress-firewall/ |\n| `serverLimit` | int32 | `10` | Maximum total Hetzner servers allowed for this cluster — the account/project quota. Validation rejects configs whose reachable total (control-planes + workers + pool capacity clamped by autoscaler.node.maxNodesTotal when set) exceeds it. Set to 0 to use the default limit of 10 |\n| `allowedCidrs` | []string | – | CIDR blocks allowed to access the Kubernetes API and Talos API on control-plane nodes. When empty defaults to 0.0.0.0/0 and ::/0 (open to all IPv4 and IPv6). |\n| `workerPublicIPv4` | boolean | – | Assign a public IPv4 to worker nodes. Defaults to true. Set false for IPv4-less workers reached over the private network (requires private-network reachability and NAT egress). |\n| `workerPublicIPv6` | boolean | – | Assign a public IPv6 to worker nodes. Defaults to true. |\n| `controlPlanePublicIPv4` | boolean | – | Assign a public IPv4 to control-plane nodes. Defaults to true. Set false for IPv4-less control planes whose endpoint is the private-network IP (cluster reachable only from inside the private network). |\n| `controlPlanePublicIPv6` | boolean | – | Assign a public IPv6 to control-plane nodes. Defaults to true. |\n| `autoscalerNodePoolNames` | []string | – | AutoscalerNodePoolNames lists the node-group names configured in the Kubernetes Cluster Autoscaler for this cluster. When non-empty, KSail deletes servers labelled with hcloud/node-group=<name> during cluster deletion so that autoscaler-managed nodes are cleaned up alongside KSail-managed nodes. |\n\n### spec.provider.omni (OptionsOmni)\n\nOptionsOmni defines options specific to the Sidero Omni provider. These options are used when Provider is set to \"Omni\" for the Talos distribution.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `endpoint` | string | – | Endpoint is the Omni API endpoint URL. Example: \"https://<account>.omni.siderolabs.io:443\". |\n| `endpointEnvVar` | string | `OMNI_ENDPOINT` | EndpointEnvVar is the environment variable containing the Omni API endpoint URL. When set, the value of this environment variable takes precedence over Endpoint. Defaults to \"OMNI_ENDPOINT\". |\n| `serviceAccountKeyEnvVar` | string | `OMNI_SERVICE_ACCOUNT_KEY` | ServiceAccountKeyEnvVar is the environment variable containing the base64-encoded Omni service account key. Defaults to \"OMNI_SERVICE_ACCOUNT_KEY\". |\n| `talosVersion` | string | – | TalosVersion is the Talos version to use for the cluster in Omni. Accepts values with or without the \"v\" prefix (e.g., \"v1.11.2\" or \"1.11.2\"). Generated templates normalize the value to include the \"v\" prefix. This determines the Talos Linux version that Omni will deploy to machines. |\n| `kubernetesVersion` | string | – | KubernetesVersion is the Kubernetes version to use for the cluster in Omni. Accepts values with or without the \"v\" prefix (e.g., \"v1.32.0\" or \"1.32.0\"). Generated templates normalize the value to include the \"v\" prefix. This determines the Kubernetes version that Omni will deploy. |\n| `machineClass` | string | – | MachineClass is the Omni machine class name to use for dynamic node allocation. Machine classes are user-defined in the Omni dashboard and match machines by labels (e.g., CPU, region, role). The specified class must exist in the Omni account before cluster creation. The number of machines allocated is derived from the controlPlanes and workers count in the cluster spec. Mutually exclusive with Machines — set one or the other. When neither MachineClass nor Machines is set, KSail automatically discovers available (unallocated) machines in Omni and uses them for node allocation. |\n| `machines` | []string | – | Machines is a list of Omni machine UUIDs to use for static node allocation. The first N machines are assigned as control planes (where N = controlPlanes count), and the remaining machines are assigned as workers. Mutually exclusive with MachineClass — set one or the other. When neither MachineClass nor Machines is set, KSail automatically discovers available (unallocated) machines in Omni and uses them for node allocation. |\n\n### spec.provider.aws (OptionsAWS)\n\nOptionsAWS defines options specific to the AWS cloud provider. Credentials are resolved via the standard AWS SDK v2 credential chain; the *EnvVar fields let users point KSail at non-standard environment variable names (mirrors the Hetzner/Omni pattern).\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `profileEnvVar` | string | `AWS_PROFILE` | ProfileEnvVar is the environment variable containing the AWS shared-config profile name. Defaults to \"AWS_PROFILE\". |\n| `regionEnvVar` | string | `AWS_REGION` | RegionEnvVar is the environment variable containing the AWS region. When set, it overrides the region declared in eks.yaml. Defaults to \"AWS_REGION\". |\n| `accessKeyIdEnvVar` | string | `AWS_ACCESS_KEY_ID` | AccessKeyIDEnvVar is the environment variable containing a static AWS access key ID. Defaults to \"AWS_ACCESS_KEY_ID\". |\n| `secretAccessKeyEnvVar` | string | `AWS_SECRET_ACCESS_KEY` | SecretAccessKeyEnvVar is the environment variable containing a static AWS secret access key. Defaults to \"AWS_SECRET_ACCESS_KEY\". |\n| `sessionTokenEnvVar` | string | `AWS_SESSION_TOKEN` | SessionTokenEnvVar is the environment variable containing an AWS session token (used with temporary credentials from STS). Defaults to \"AWS_SESSION_TOKEN\". |\n\n### spec.provider.gcp (OptionsGCP)\n\nOptionsGCP defines options specific to the Google Cloud provider used by the GKE distribution. Credentials are resolved via Application Default Credentials (GOOGLE_APPLICATION_CREDENTIALS / gcloud ADC); the *EnvVar fields let users point KSail at non-standard environment variable names (mirrors the AWS/Hetzner/Omni pattern).\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `projectEnvVar` | string | `GOOGLE_CLOUD_PROJECT` | ProjectEnvVar is the environment variable containing the Google Cloud project ID. Defaults to \"GOOGLE_CLOUD_PROJECT\". |\n| `locationEnvVar` | string | `GOOGLE_CLOUD_LOCATION` | LocationEnvVar is the environment variable containing the GKE location (zone or region). Defaults to \"GOOGLE_CLOUD_LOCATION\". |\n\n### spec.provider.kubernetes (OptionsKubernetes)\n\nOptionsKubernetes defines options specific to the Kubernetes provider. The Kubernetes provider runs nested cluster nodes as pods inside an existing host cluster. It uses Gateway API (TCPRoute) to expose the nested cluster's API server.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `kubeconfig` | string | `~/.kube/config` | Kubeconfig is the path to the kubeconfig for the host cluster. Defaults to \"~/.kube/config\". |\n| `kubeconfigEnvVar` | string | `KSAIL_HOST_KUBECONFIG` | KubeconfigEnvVar is the environment variable containing the host kubeconfig path. Defaults to \"KSAIL_HOST_KUBECONFIG\". |\n| `context` | string | – | Context is the kubeconfig context for the host cluster. When empty, uses the current context. |\n| `contextEnvVar` | string | `KSAIL_HOST_CONTEXT` | ContextEnvVar is the environment variable containing the host kubeconfig context. Defaults to \"KSAIL_HOST_CONTEXT\". |\n| `gatewayClassName` | string | – | GatewayClassName is the GatewayClass to use for exposing the nested API server. Must reference a GatewayClass that exists on the host cluster. When empty, the API is exposed via ClusterIP Service only (no external Gateway). |\n| `podCidr` | string | `10.64.0.0/16` | PodCIDR is the pod CIDR for the nested cluster. Must not overlap with the host cluster's pod or service CIDRs. Defaults to \"10.64.0.0/16\". |\n| `serviceCidr` | string | `10.128.0.0/16` | ServiceCIDR is the service CIDR for the nested cluster. Must not overlap with the host cluster's pod or service CIDRs. Defaults to \"10.128.0.0/16\". |\n| `persistence` | KubernetesPersistence | – | Persistence defines storage persistence for the nested cluster's data directory. |\n\n### spec.provider.kubernetes.persistence (KubernetesPersistence)\n\nKubernetesPersistence defines storage persistence configuration for the Kubernetes provider. When enabled, a PVC is created for the nested cluster's data directory to survive pod restarts. When disabled (default), emptyDir is used and clusters are fully ephemeral.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `enabled` | boolean | – | Enabled controls whether a PVC is used for the nested cluster's data directory. When false (default), emptyDir is used and the cluster is ephemeral. |\n| `storageClassName` | string | – | StorageClassName is the StorageClass to use for the PVC. When empty, the cluster's default StorageClass is used. |\n| `size` | string | `20Gi` | Size is the storage request size for the PVC. Defaults to \"20Gi\". |\n\n### spec.workload (WorkloadSpec)\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `sourceDirectory` | string | `k8s` | Path to the directory containing Kubernetes manifests. Used as the default path by validate, watch, and push when no explicit path argument is given. |\n| `validateOnPush` | boolean | `false` | Validate manifests against schemas before pushing (validation disabled by default) |\n| `tag` | string | `dev` | OCI artifact tag used for workload push and GitOps reconciliation (Flux OCIRepository and ArgoCD Application). Push priority: CLI oci:// ref > this field > registry-embedded tag > dev. Reconciliation priority: this field > registry-embedded tag > dev |\n| `kustomizationFile` | string | – | Path to the kustomization directory relative to sourceDirectory. When set, Flux Sync.Path is configured to this path so Flux uses the specified kustomization as the entry point instead of requiring a root kustomization.yaml. |\n| `flux` | FluxConfig | – | Flux bootstrap configuration: operator/distribution version pins and signature verification for the generated OCIRepository. Empty values use KSail's pinned versions; a GitOps repo that declares these becomes the steady-state owner. |\n| `watch` | WatchConfig | – | Configuration for the workload watch command (pre-apply hooks, etc.) |\n| `validation` | ValidationConfig | – | Configuration for the workload validate command (additional kinds to skip, etc.). |\n| `scan` | ScanConfig | – | Configuration for the workload scan command (Kubescape exceptions, frameworks, compliance threshold) so 'ksail workload scan' (no args) can act as a turnkey CI gate. |\n\n\n### spec.chat (ChatSpec)\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `model` | string | – | Chat model (empty or 'auto' for API default) |\n| `reasoningEffort` | string | – | Reasoning effort level for chat responses (low, medium, or high) |\n\n\n## Distribution Configuration\n\nKSail references distribution-specific configuration files to customize cluster behavior. The path to these files is set via `spec.cluster.distributionConfig`.\n\n### Vanilla (implemented with Kind) Configuration\n\n**Default:** `kind.yaml`\n\nSee [Kind Configuration](https://kind.sigs.k8s.io/docs/user/configuration/) for the full schema.\n\n**Example:**\n\n```yaml\n# kind.yaml\nkind: Cluster\napiVersion: kind.x-k8s.io/v1alpha4\nnodes:\n - role: control-plane\n extraPortMappings:\n - containerPort: 30000\n hostPort: 30000\n```\n\n### K3s (implemented with K3d) Configuration\n\n**Default:** `k3d.yaml`\n\nSee [K3d Configuration](https://k3d.io/stable/usage/configfile/) for the full schema.\n\n**Example:**\n\n```yaml\n# k3d.yaml\napiVersion: k3d.io/v1alpha5\nkind: Simple\nservers: 1\nagents: 2\nports:\n - port: 8080:80\n nodeFilters:\n - loadbalancer\n```\n\n### Talos Configuration\n\n**Default:** `talos/` directory\n\nTalos uses a directory structure for [Talos machine configuration patches](https://www.talos.dev/latest/reference/configuration/). Place YAML patch files in `talos/cluster/` (all nodes), `talos/control-planes/`, or `talos/workers/`:\n\n```yaml\n# talos/cluster/kubelet.yaml (applies to all nodes)\nmachine:\n kubelet:\n extraArgs:\n max-pods: \"250\"\n```\n\nSee [Talos Configuration Reference](https://www.talos.dev/latest/reference/configuration/) for patch syntax. Use `spec.cluster.talos` to configure node counts:\n\n```yaml\nspec:\n cluster:\n distribution: Talos\n distributionConfig: talos\n talos:\n controlPlanes: 3\n workers: 2\n```\n\n#### Port Mappings (Docker Provider)\n\nOn macOS, Docker runs in a Linux VM, so MetalLB virtual IPs are not accessible from the host. Use `extraPortMappings` to expose container ports directly:\n\n```yaml\nspec:\n cluster:\n distribution: Talos\n talos:\n extraPortMappings:\n - containerPort: 80\n hostPort: 8080\n protocol: TCP\n - containerPort: 443\n hostPort: 8443\n protocol: TCP\n```\n\nAccess services at `http://localhost:8080`. Ports are exposed on the first control-plane node; in multi-control-plane clusters, `extraPortMappings` apply only to that node.\n\n## Schema Support\n\nKSail provides a JSON Schema for IDE validation and autocompletion. Reference it at the top of your `ksail.yaml`:\n\n```yaml\n# yaml-language-server: $schema=https://raw.githubusercontent.com/devantler-tech/ksail/main/schemas/ksail-config.schema.json\napiVersion: ksail.io/v1alpha1\nkind: Cluster\nspec:\n # ...\n```\n\nIDEs with YAML language support (e.g., VS Code + [Red Hat YAML extension](https://marketplace.visualstudio.com/items?itemName=redhat.vscode-yaml)) provide field autocompletion, inline docs, validation, and enum suggestions.\n\n## CLI Command Reference\n\n\n### Cluster Add Environment\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nClone an existing cluster environment into a new one.\n\nCopies the source environment's overlay (/clusters//) and\nits root config (ksail..yaml) into a new environment , repointing the\nstructured identity along the way: the cluster-meta cluster_name, the\nclusters/ path segment and content references, the root config's metadata\nname, the connection context (distribution-aware), and — when --provider is given\n— the provider. Every other byte is preserved, so the kustomize replacements block,\nbase wiring, version pins and comments survive intact.\n\nSOPS-encrypted files (*.enc.yaml) are copied verbatim with only their path\nrepointed; re-encrypt them to the new environment's recipients afterwards with\n`ksail cipher` if the environments use different keys.\n\nExamples:\n # Clone the \"prod\" environment into a new \"staging\" environment\n ksail project add-environment staging --from prod\n\n # Clone \"prod\" into \"dev\" on a different provider, overwriting any existing files\n ksail project add-environment dev --from prod --provider Docker --force\n\nUsage:\n ksail cluster add-environment [flags]\n\nFlags:\n --force Overwrite existing destination files\n -f, --from string Source environment to clone from (required)\n -p, --provider string Provider for the new environment (defaults to the source provider)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Backup\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreates a backup archive containing Kubernetes resource manifests.\n\nThe backup is stored as a compressed tarball (.tar.gz) with resources organized by type.\nMetadata about the backup is included for restore operations.\n\nNote: This backs up resource manifests (YAML) only. Persistent volume\ncontents are not included in the current implementation.\n\nExample:\n ksail cluster backup ./my-backup.tar.gz\n ksail cluster backup ./backup.tar.gz --namespaces default,kube-system\n ksail cluster backup ./backup.tar.gz --exclude-types events,pods\n\nUsage:\n ksail cluster backup [] [flags]\n\nFlags:\n --compression int Compression level (-1..9, -1 = gzip default) (default -1)\n --exclude-types strings Resource types to exclude from backup (default [events])\n --name string Name of the cluster to back up (resolves the kubeconfig like the other cluster commands; defaults to the current kubeconfig context when unset)\n --namespaces strings Namespaces to backup (default: all)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Connect\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nLaunch k9s terminal UI to interactively manage your Kubernetes cluster.\n\nThe editor is determined by (in order of precedence):\n 1. --editor flag\n 2. spec.editor from ksail.yaml config\n 3. EDITOR or VISUAL environment variables\n 4. Fallback to vim, nano, or vi\n\nk9s flags and arguments placed after a \"--\" separator are passed through to\nk9s unchanged, allowing you to use any k9s functionality. Examples:\n\n ksail cluster connect\n ksail cluster connect --name dev-cluster\n ksail cluster connect --editor \"code --wait\"\n ksail cluster connect -- --namespace default\n ksail cluster connect -- --context my-context\n ksail cluster connect -- --readonly\n\nThe cluster is resolved in the following priority order:\n 1. From the --name flag\n 2. From metadata.name in the ksail.yaml config file (if present)\n 3. From the current kubeconfig context\n\nThe kubeconfig is resolved in the following priority order:\n 1. From the --kubeconfig flag\n 2. From the KUBECONFIG environment variable\n 3. From the ksail.yaml config file (if present)\n 4. Defaults to ~/.kube/config\n\nUsage:\n ksail cluster connect [flags]\n\nFlags:\n -c, --context string Kubernetes context of cluster\n --editor string editor command to use for k9s edit actions (e.g., 'code --wait', 'vim', 'nano')\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n -n, --name string Name of the cluster to connect to (resolved like the other cluster commands; overrides the kubeconfig context derived from ksail.yaml)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Create\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a Kubernetes cluster as defined by configuration.\n\nUsage:\n ksail cluster create [flags]\n\nFlags:\n --allowed-cidrs strings CIDR blocks allowed to access the Kubernetes API and Talos API on control-plane nodes. When empty, both APIs are open to 0.0.0.0/0 and ::/0 (all IPv4 and IPv6). Example: --allowed-cidrs 203.0.113.0/24 --allowed-cidrs 198.51.100.0/24\n --cdi CDI Container Device Interface (Default: use distribution, Enabled: enable CDI, Disabled: disable CDI)\n --cert-manager CertManager Cert-Manager configuration (Enabled: install, Disabled: skip)\n --cni CNI Container Network Interface (CNI) to use\n -c, --context string Kubernetes context of cluster\n --control-planes int32 Number of control-plane nodes (default 1)\n --csi CSI Container Storage Interface (Default: use distribution, Enabled: install CSI, Disabled: skip CSI)\n -d, --distribution Distribution Kubernetes distribution to use\n --distribution-config string Configuration file for the distribution\n --distribution-version string Distribution version to deploy and reconcile toward (Talos OS version). When unset KSail follows the latest supported version; set it to pin a specific version. Other distributions carry their version in the distribution config.\n --drain-timeout duration Per-node pod-eviction budget for rolling node drains during cluster update (default 10m when unset). Increase it for stateful workloads that need longer to evict gracefully (e.g. Longhorn rebuilds, database failovers). On timeout the update aborts; re-run with --force-drain to delete pods bypassing PodDisruptionBudgets. Talos only.\n -g, --gitops-engine GitOpsEngine GitOps engine to use (None disables GitOps, Flux installs Flux controllers, ArgoCD installs Argo CD) (default None)\n --import-images string Path to tar archive with container images to import after cluster creation but before component installation\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n --kubernetes-version string Kubernetes version to deploy and reconcile toward. When unset KSail follows the latest supported version; set it to pin a specific version. Honored by the Talos distribution; Kind/K3d/EKS carry the version in their distribution config instead.\n --load-balancer LoadBalancer LoadBalancer support (Default: use distribution × provider, Enabled: install, Disabled: uninstall)\n --local-registry string Local registry specification: [user:pass@]host[:port][/path] (e.g., localhost:5050, ghcr.io/myorg, ${USER}:${PASS}@ghcr.io:443/org)\n --metrics-server MetricsServer Metrics Server (Default: use distribution, Enabled: install, Disabled: uninstall)\n --mirror-registry strings Configure mirror registries with optional authentication. Format: [user:pass@]host[=upstream]. Credentials support environment variables using ${VAR} syntax (quote placeholders so KSail can expand them). Examples: docker.io=https://registry-1.docker.io, '${USER}:${TOKEN}@ghcr.io=https://ghcr.io'\n -n, --name string Cluster name used for container names, registry names, and kubeconfig context\n --node-autoscaler-enabled NodeAutoscalerEnabled[=Enabled] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --node-autoscaling NodeAutoscaling [Deprecated: use autoscaler.node.enabled instead] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --oidc-ca-file string Path to CA certificate for self-signed OIDC providers\n --oidc-client-id string OIDC client ID for kubectl authentication\n --oidc-extra-scope strings Additional OIDC scopes beyond openid (repeatable)\n --oidc-groups-claim string JWT claim for Kubernetes groups (default \"groups\")\n --oidc-groups-prefix string Prefix for OIDC groups in Kubernetes (default \"oidc:\")\n --oidc-issuer-url string OIDC provider issuer URL (e.g. https://dex.example.com)\n --oidc-username-claim string JWT claim for Kubernetes username (default \"email\")\n --oidc-username-prefix string Prefix for OIDC usernames in Kubernetes (default \"oidc:\")\n --policy-engine PolicyEngine Policy engine (None: skip, Kyverno: install Kyverno, Gatekeeper: install Gatekeeper)\n -p, --provider Provider Infrastructure provider backend (e.g., Docker)\n --ttl string Auto-destroy cluster after duration (e.g. 1h, 30m, 2h30m). If not set, cluster persists indefinitely.\n --workers int32 Number of worker nodes\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Delete\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDestroy a cluster.\n\nThe cluster is resolved in the following priority order:\n 1. From the --name flag\n 2. From metadata.name in the ksail.yaml config file (if present)\n 3. From the current kubeconfig context\n\nThe provider is resolved in the following priority order:\n 1. From the --provider flag\n 2. From the ksail.yaml config file (if present)\n 3. Defaults to Docker\n\nThe kubeconfig is resolved in the following priority order:\n 1. From the --kubeconfig flag\n 2. From the KUBECONFIG environment variable\n 3. From the ksail.yaml config file (if present)\n 4. Defaults to ~/.kube/config\n\nUsage:\n ksail cluster delete [flags]\n\nFlags:\n --delete-storage Delete storage volumes when cleaning up (registry volumes for Docker, block storage for Hetzner)\n -f, --force Skip confirmation prompt and delete immediately\n -k, --kubeconfig string Path to kubeconfig file for context cleanup\n -n, --name string Name of the cluster to delete\n -p, --provider Provider Provider to use (Docker, Hetzner, Omni, AWS, GCP, Kubernetes)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Diagnose\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nSurface failing Kubernetes resources for the current cluster.\n\nThis command inspects the live cluster via the Kubernetes API and reports\nany pods that are not running successfully, any nodes that are not Ready,\nand any PersistentVolumeClaims stuck in Pending phase. Each finding\nincludes a severity classification and, where a known failure pattern is\ndetected, a proactive remediation suggestion.\n\nA health score (0–100) summarizes overall cluster health: each critical\nfinding deducts 25 points and each warning deducts 10 points.\n\nThe output is intentionally compact so it can be consumed directly by users\nor by the KSail AI chat assistant (ksail open chat) and MCP server, which expose\nthis command as part of the cluster_read tool. When used from the AI\nassistant the output is fed back as context so Copilot can explain the root\ncause and suggest remediation.\n\nThe cluster is resolved in the following priority order:\n 1. From --name flag\n 2. From ksail.yaml config file (if present)\n 3. From current kubeconfig context\n\nExit code 0 is returned even when pod or node failures are reported.\nA non-zero exit code indicates the Kubernetes API could not be queried\n(e.g., the cluster is unreachable or the credentials lack sufficient\npermissions).\n\nUsage:\n ksail cluster diagnose [flags]\n\nFlags:\n -n, --name string Name of the cluster to target\n --output string Output format: text or json. Use json for machine-readable structured output. (default \"text\")\n -p, --provider Provider Provider to use (Docker, Hetzner, Omni, AWS, GCP, Kubernetes)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Diff\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCompare the desired cluster configuration (ksail.yaml) against the live\ncluster state and report any drift.\n\nThis command detects installed components via the Kubernetes API and Helm\nrelease history, then compares them against the configuration defined in\nksail.yaml. Changes are classified by impact (in-place, reboot-required,\nrecreate-required, wipe-required) — the same categories used by\n'ksail cluster update'.\n\nNo changes are applied to the cluster; this is a read-only operation.\n\nThe cluster is resolved in the following priority order:\n 1. From the --name flag override\n 2. From metadata.name in the ksail.yaml config file\n 3. From the current kubeconfig context\n\nUse --output json for machine-readable output suitable for CI pipelines.\nUse --exit-code to return exit code 2 when drift is detected (useful for\nCI gates and monitoring scripts).\n\nUse --include-version-drift to also report the distribution/Kubernetes version\nreconciliation 'ksail cluster update' applies on every run (matching\n'update --dry-run'). It is off by default: resolving the latest available\nversion performs OCI registry lookups, so enabling it makes diff\nnetwork-dependent and may report drift whenever upstream cuts a release.\n\nUsage:\n ksail cluster diff [flags]\n\nFlags:\n -c, --context string Kubernetes context of cluster\n --exit-code Return exit code 2 when drift is detected (for CI gates)\n --include-version-drift Also report distribution/Kubernetes version drift the next 'cluster update' would reconcile (performs OCI registry lookups; off by default)\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n -n, --name string Cluster name used for container names, registry names, and kubeconfig context\n --output string Output format: text or json. Use json for machine-readable structured output. (default \"text\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Info\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDisplay cluster information from the infrastructure provider and Kubernetes API. Succeeds if information is available from any source.\n\nUsage:\n ksail cluster info [flags]\n\nFlags:\n -n, --name string Name of the cluster to target\n -p, --provider Provider Provider to use (Docker, Hetzner, Omni, AWS, GCP, Kubernetes)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Init\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nInitialize a new project in the specified directory (or current directory if none specified).\n\nUsage:\n ksail cluster init [flags]\n\nFlags:\n --allowed-cidrs strings CIDR blocks allowed to access the Kubernetes API and Talos API on control-plane nodes. When empty, both APIs are open to 0.0.0.0/0 and ::/0 (all IPv4 and IPv6). Example: --allowed-cidrs 203.0.113.0/24 --allowed-cidrs 198.51.100.0/24\n --cdi CDI Container Device Interface (Default: use distribution, Enabled: enable CDI, Disabled: disable CDI)\n --cert-manager CertManager Cert-Manager configuration (Enabled: install, Disabled: skip)\n --cni CNI Container Network Interface (CNI) to use\n -c, --context string Kubernetes context of cluster\n --control-planes int32 Number of control-plane nodes (default 1)\n --csi CSI Container Storage Interface (Default: use distribution, Enabled: install CSI, Disabled: skip CSI)\n -d, --distribution Distribution Kubernetes distribution to use\n --distribution-config string Configuration file for the distribution\n --distribution-version string Distribution version to deploy and reconcile toward (Talos OS version). When unset KSail follows the latest supported version; set it to pin a specific version. Other distributions carry their version in the distribution config.\n -f, --force Overwrite existing files\n -g, --gitops-engine GitOpsEngine GitOps engine to use (None disables GitOps, Flux installs Flux controllers, ArgoCD installs Argo CD) (default None)\n --image-verification ImageVerification Image verification (Talos: scaffold ImageVerificationConfig template; Vanilla/Kind: inject containerd verifier plugin patch; requires verifier binaries and typically policy to be present in the node image bin_dir; K3s/K3d: scaffold containerd config template with image verifier plugin and mount into node containers; requires verifier binaries and typically policy to be present in the node image bin_dir; Disabled: skip)\n --import-images string Path to tar archive with container images to import after cluster creation but before component installation\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n --kubernetes-version string Kubernetes version to deploy and reconcile toward. When unset KSail follows the latest supported version; set it to pin a specific version. Honored by the Talos distribution; Kind/K3d/EKS carry the version in their distribution config instead.\n --kustomization-file string Relative directory within sourceDirectory used as the kustomize entry point (e.g., clusters/local)\n --load-balancer LoadBalancer LoadBalancer support (Default: use distribution × provider, Enabled: install, Disabled: uninstall)\n --local-registry string Local registry specification: [user:pass@]host[:port][/path] (e.g., localhost:5050, ghcr.io/myorg, ${USER}:${PASS}@ghcr.io:443/org)\n --metrics-server MetricsServer Metrics Server (Default: use distribution, Enabled: install, Disabled: uninstall)\n --mirror-registry strings Configure mirror registries with optional authentication. Format: [user:pass@]host[=upstream]. Credentials support environment variables using ${VAR} syntax (quote placeholders so KSail can expand them). Examples: docker.io=https://registry-1.docker.io, '${USER}:${TOKEN}@ghcr.io=https://ghcr.io'\n --multi-cluster string Scaffold a multi-cluster source layout (clusters/base/ + clusters//) with the given initial environment name; the generated ksail.yaml points its kustomizationFile at the environment overlay\n -n, --name string Cluster name used for container names, registry names, and kubeconfig context\n --no-devcontainer Skip scaffolding .devcontainer/devcontainer.json\n --node-autoscaler-enabled NodeAutoscalerEnabled[=Enabled] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --node-autoscaling NodeAutoscaling [Deprecated: use autoscaler.node.enabled instead] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --oidc-ca-file string Path to CA certificate for self-signed OIDC providers\n --oidc-client-id string OIDC client ID for kubectl authentication\n --oidc-extra-scope strings Additional OIDC scopes beyond openid (repeatable)\n --oidc-groups-claim string JWT claim for Kubernetes groups (default \"groups\")\n --oidc-groups-prefix string Prefix for OIDC groups in Kubernetes (default \"oidc:\")\n --oidc-issuer-url string OIDC provider issuer URL (e.g. https://dex.example.com)\n --oidc-username-claim string JWT claim for Kubernetes username (default \"email\")\n --oidc-username-prefix string Prefix for OIDC usernames in Kubernetes (default \"oidc:\")\n -o, --output string Output directory for the project\n --policy-engine PolicyEngine Policy engine (None: skip, Kyverno: install Kyverno, Gatekeeper: install Gatekeeper)\n --provider Provider Infrastructure provider backend (e.g., Docker)\n -s, --source-directory string Directory containing workloads to deploy (default \"k8s\")\n --workers int32 Number of worker nodes\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster List\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nList all Kubernetes clusters managed by KSail.\n\nBy default, lists clusters from all distributions across all providers.\nUse --provider to filter results to a specific provider.\n\nOutput Format:\n PROVIDER DISTRIBUTION CLUSTER STATUS\n docker Vanilla dev-cluster Running\n docker K3s test-cluster Stopped\n hetzner Talos prod-cluster Unknown\n\nThe STATUS column reports the cluster's run-state: \"Running\" when its nodes are\nup, \"Stopped\" when they exist but are not running (e.g. a stopped Docker\ncluster), and \"Unknown\" for providers that cannot report it (cloud providers).\n\nWhen any cluster has a TTL set, a TTL column is appended:\n PROVIDER DISTRIBUTION CLUSTER STATUS TTL\n docker K3s dev-cluster Running 2h 30m\n\nThe PROVIDER and CLUSTER values from the output can be used directly\nwith other cluster commands:\n ksail cluster delete --name --provider \n ksail cluster stop --name --provider \n\nUse --output json for machine-readable output. The JSON is an array of objects:\n [\n {\"name\": \"dev\", \"provider\": \"docker\", \"distribution\": \"Vanilla\", \"status\": \"Running\", \"ttl\": \"2h 30m\"}\n ]\nThe \"status\" field is \"Running\", \"Stopped\", or \"Unknown\" (see the STATUS column).\nThe \"ttl\" field is null when no TTL is set and \"EXPIRED\" once the TTL has elapsed.\n\nExamples:\n # List all clusters\n ksail cluster list\n\n # List only Docker-based clusters\n ksail cluster list --provider Docker\n\n # List only Hetzner clusters\n ksail cluster list --provider Hetzner\n\n # List only Omni clusters\n ksail cluster list --provider Omni\n\n # Machine-readable JSON (name/provider/distribution/ttl)\n ksail cluster list --output json\n\nUsage:\n ksail cluster list [flags]\n\nFlags:\n --output string Output format: text or json. Use json for machine-readable structured output (array of {name, provider, distribution, status, ttl}). (default \"text\")\n -p, --provider Provider Filter by provider (Docker, Hetzner, Omni, AWS, GCP, Kubernetes). If not specified, lists all providers.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Oidc Get Token\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nGet an OIDC token for Kubernetes authentication.\n\nThis command implements the client.authentication.k8s.io/v1 ExecCredential protocol.\nIt is intended to be used as a kubeconfig exec credential plugin, not called directly.\n\nThe token acquisition flow:\n 1. Check the local cache for a valid token\n 2. If expired, attempt to refresh using the stored refresh token\n 3. If no valid token, start the browser-based authorization code flow with PKCE\n 4. Output the ExecCredential JSON to stdout\n\nUsage:\n ksail cluster oidc get-token [flags]\n\nFlags:\n --ca-file string Path to CA certificate for self-signed OIDC providers\n --client-id string OIDC client ID (required)\n --extra-scope strings Additional OIDC scopes\n --issuer-url string OIDC provider issuer URL (required)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Oidc Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nOIDC authentication utilities for Kubernetes clusters.\n\nProvides an exec credential plugin that can be used in kubeconfig\nto authenticate with OIDC providers (e.g., Dex, Keycloak).\n\nUsage:\n ksail cluster oidc [command]\n\nAvailable Commands:\n get-token Get an OIDC token (exec credential plugin)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail cluster oidc [command] --help\" for more information about a command.\n\n```\n\n### Cluster Repair\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDetect and repair known corruption patterns in local state files.\n\nCurrently supported repairs:\n - talosconfig-ca: fixes a single-byte BasicConstraints corruption in\n the Talos talosconfig CA that prevents 'cluster update' from\n establishing a Talos client.\n\nEach repair is idempotent and writes a timestamped backup of any file\nit modifies.\n\nUsage:\n ksail cluster repair [flags]\n\nFlags:\n --talosconfig string path to talosconfig (default: ~/.talos/config)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Restore\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRestores Kubernetes resources from a backup archive to the target cluster.\n\nResources are restored in the correct order (CRDs first, then namespaces, storage, workloads).\nExisting resources can be skipped or updated based on the policy.\n\nExample:\n ksail cluster restore ./my-backup.tar.gz\n ksail cluster restore ./backup.tar.gz --existing-resource-policy update\n ksail cluster restore ./backup.tar.gz --dry-run\n\nUsage:\n ksail cluster restore [] [flags]\n\nFlags:\n --dry-run Print what would be restored without applying\n --existing-resource-policy string Policy for existing resources: none (skip) or update (patch) (default \"none\")\n --name string Name of the cluster to restore into (resolves the kubeconfig like the other cluster commands; defaults to the current kubeconfig context when unset)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nManage lifecycle operations for local Kubernetes clusters, including provisioning, teardown, and status.\n\nUsage:\n ksail cluster [flags]\n ksail cluster [command]\n\nAvailable Commands:\n backup Backup cluster resources\n connect Connect to cluster with k9s\n create Create a cluster\n delete Destroy a cluster\n diagnose Diagnose failing cluster resources\n diff Show configuration drift between ksail.yaml and live cluster\n info Display cluster information\n list List clusters\n oidc OIDC authentication utilities\n repair Repair local KSail/Talos state files\n restore Restore cluster resources from backup\n start Start a stopped cluster\n stop Stop a running cluster\n switch Switch active cluster context\n update Update a cluster configuration\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail cluster [command] --help\" for more information about a command.\n\n```\n\n### Cluster Start\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nStart a previously stopped Kubernetes cluster.\n\nThe cluster is resolved in the following priority order:\n 1. From --name flag\n 2. From ksail.yaml config file (if present)\n 3. From current kubeconfig context\n\nThe provider is resolved in the following priority order:\n 1. From --provider flag\n 2. From ksail.yaml config file (if present)\n 3. Defaults to Docker\n\nSupported distributions are automatically detected from existing clusters.\n\nUsage:\n ksail cluster start [flags]\n\nFlags:\n -n, --name string Name of the cluster to target\n -p, --provider Provider Provider to use (Docker, Hetzner, Omni, AWS, GCP, Kubernetes)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Stop\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nStop a running Kubernetes cluster.\n\nThe cluster is resolved in the following priority order:\n 1. From --name flag\n 2. From ksail.yaml config file (if present)\n 3. From current kubeconfig context\n\nThe provider is resolved in the following priority order:\n 1. From --provider flag\n 2. From ksail.yaml config file (if present)\n 3. Defaults to Docker\n\nSupported distributions are automatically detected from existing clusters.\n\nUsage:\n ksail cluster stop [flags]\n\nFlags:\n -n, --name string Name of the cluster to target\n -p, --provider Provider Provider to use (Docker, Hetzner, Omni, AWS, GCP, Kubernetes)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Switch\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nSwitch the active kubeconfig context to the named cluster.\n\nThis command accepts a cluster name and automatically resolves it to the\ncorrect kubeconfig context by checking all supported distribution prefixes\n(kind-, k3d-, k3k-, admin@, vcluster-docker_, kwok-). The k3k- prefix matches\nnested K3s clusters on the Kubernetes provider, and kwok- matches KWOK clusters.\n\nIf multiple distributions have contexts for the same cluster name, the\ncommand returns an error listing the matching contexts.\n\nThe kubeconfig is resolved in the following priority order:\n 1. From KUBECONFIG environment variable\n 2. From ksail.yaml config file (if present)\n 3. Defaults to ~/.kube/config\n\nWhen called without arguments, an interactive picker is shown\nto select from available clusters. Recently-switched clusters\nappear at the top of the list (up to the last 5), followed by\nthe remaining clusters in alphabetical order. The history is\npersisted to ~/.ksail/switch-history.json.\n\nIn the picker, press '/' to enter filter mode and type to narrow\nthe list by keyword (case-insensitive). Press Esc to exit filter mode.\n\nExamples:\n # Switch to a Vanilla (Kind) cluster named \"dev\"\n ksail cluster switch dev\n\n # Switch to a cluster named \"staging\"\n ksail cluster switch staging\n\n # Select a cluster interactively (recent clusters shown first)\n ksail cluster switch\n\nUsage:\n ksail cluster switch [cluster-name] [flags]\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Update\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nUpdate a Kubernetes cluster to match the current configuration.\n\nThis command applies changes from your ksail.yaml configuration to a running cluster.\n\nFor Talos clusters, many configuration changes can be applied in-place without\ncluster recreation (e.g., network settings, kubelet config, registry mirrors).\n\nFor Kind/K3d clusters, in-place updates are more limited. Worker node scaling\nis supported for K3d, but most other changes require cluster recreation.\n\nChanges are classified into the following categories:\n - In-Place: Applied without disruption\n - Reboot-Required: Applied but may require node reboots\n - Wipe-Required: Requires wiping node partitions (e.g. disk encryption\n migration); requires --force-drain\n - Rolling-Recreate: Nodes are replaced one at a time (e.g. a Talos × Hetzner\n server-type change); requires confirmation (or --yes to skip the prompt)\n - Recreate-Required: Require full cluster recreation\n\nConfirmation vs. disruption are two separate flags:\n - --yes (-y) skips KSail's interactive confirmation prompts only.\n - --force-drain additionally lets node drains delete pods directly (bypassing\n PodDisruptionBudgets) and authorizes partition wipes — use it when a budget\n would otherwise block a rolling reboot/recreate (may cause workload\n disruption or data loss).\n\nUse --dry-run to preview changes without applying them.\nUse --output json to emit a machine-readable diff for CI/MCP consumption.\n\nUsage:\n ksail cluster update [flags]\n\nFlags:\n --allowed-cidrs strings CIDR blocks allowed to access the Kubernetes API and Talos API on control-plane nodes. When empty, both APIs are open to 0.0.0.0/0 and ::/0 (all IPv4 and IPv6). Example: --allowed-cidrs 203.0.113.0/24 --allowed-cidrs 198.51.100.0/24\n --cdi CDI Container Device Interface (Default: use distribution, Enabled: enable CDI, Disabled: disable CDI)\n --cert-manager CertManager Cert-Manager configuration (Enabled: install, Disabled: skip)\n --cni CNI Container Network Interface (CNI) to use\n -c, --context string Kubernetes context of cluster\n --control-planes int32 Number of control-plane nodes (default 1)\n --csi CSI Container Storage Interface (Default: use distribution, Enabled: install CSI, Disabled: skip CSI)\n -d, --distribution Distribution Kubernetes distribution to use\n --distribution-config string Configuration file for the distribution\n --distribution-version string Distribution version to deploy and reconcile toward (Talos OS version). When unset KSail follows the latest supported version; set it to pin a specific version. Other distributions carry their version in the distribution config.\n --drain-timeout duration Per-node pod-eviction budget for rolling node drains during cluster update (default 10m when unset). Increase it for stateful workloads that need longer to evict gracefully (e.g. Longhorn rebuilds, database failovers). On timeout the update aborts; re-run with --force-drain to delete pods bypassing PodDisruptionBudgets. Talos only.\n --dry-run Preview changes without applying them\n --force-drain Make node drains delete pods directly, bypassing PodDisruptionBudgets, so a rolling reboot/recreate completes even when a budget would block graceful eviction; also authorizes partition wipes (may cause workload disruption or data loss). This is the destructive behavior the old --force implied.\n -g, --gitops-engine GitOpsEngine GitOps engine to use (None disables GitOps, Flux installs Flux controllers, ArgoCD installs Argo CD) (default None)\n --import-images string Path to tar archive with container images to import after cluster creation but before component installation\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n --kubernetes-version string Kubernetes version to deploy and reconcile toward. When unset KSail follows the latest supported version; set it to pin a specific version. Honored by the Talos distribution; Kind/K3d/EKS carry the version in their distribution config instead.\n --load-balancer LoadBalancer LoadBalancer support (Default: use distribution × provider, Enabled: install, Disabled: uninstall)\n --local-registry string Local registry specification: [user:pass@]host[:port][/path] (e.g., localhost:5050, ghcr.io/myorg, ${USER}:${PASS}@ghcr.io:443/org)\n --metrics-server MetricsServer Metrics Server (Default: use distribution, Enabled: install, Disabled: uninstall)\n --mirror-registry strings Configure mirror registries with optional authentication. Format: [user:pass@]host[=upstream]. Credentials support environment variables using ${VAR} syntax (quote placeholders so KSail can expand them). Examples: docker.io=https://registry-1.docker.io, '${USER}:${TOKEN}@ghcr.io=https://ghcr.io'\n -n, --name string Cluster name used for container names, registry names, and kubeconfig context\n --node-autoscaler-enabled NodeAutoscalerEnabled[=Enabled] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --node-autoscaling NodeAutoscaling [Deprecated: use autoscaler.node.enabled instead] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --oidc-ca-file string Path to CA certificate for self-signed OIDC providers\n --oidc-client-id string OIDC client ID for kubectl authentication\n --oidc-extra-scope strings Additional OIDC scopes beyond openid (repeatable)\n --oidc-groups-claim string JWT claim for Kubernetes groups (default \"groups\")\n --oidc-groups-prefix string Prefix for OIDC groups in Kubernetes (default \"oidc:\")\n --oidc-issuer-url string OIDC provider issuer URL (e.g. https://dex.example.com)\n --oidc-username-claim string JWT claim for Kubernetes username (default \"email\")\n --oidc-username-prefix string Prefix for OIDC usernames in Kubernetes (default \"oidc:\")\n --output string Output format: text (default) or json (machine-readable, for CI/MCP) (default \"text\")\n --policy-engine PolicyEngine Policy engine (None: skip, Kyverno: install Kyverno, Gatekeeper: install Gatekeeper)\n -p, --provider Provider Infrastructure provider backend (e.g., Docker)\n --workers int32 Number of worker nodes\n -y, --yes Skip KSail's interactive confirmation prompts (does NOT bypass PodDisruptionBudgets — use --force-drain for that)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Open Chat\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nStart an interactive AI chat session powered by GitHub Copilot.\n\nThe assistant understands KSail's CLI, configuration schemas, and can help with:\n - Guided cluster configuration and setup\n - Troubleshooting cluster issues\n - Explaining KSail concepts and features\n - Running KSail commands with your approval\n\nPrerequisites:\n - An active GitHub Copilot subscription\n\nWrite operations require explicit confirmation before execution.\n\nUsage:\n ksail open chat [flags]\n\nFlags:\n -m, --model string Model to use (e.g., gpt-5, claude-sonnet-4)\n -r, --reasoning-effort string Reasoning effort level for models that support it (low, medium, high)\n -s, --streaming Enable streaming responses (default true)\n -t, --timeout duration Response timeout duration (default 5m0s)\n --tui Use interactive TUI mode with markdown rendering (default true)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Open Desktop\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nOpen the KSail desktop application.\n\nThe desktop app is a native window that runs the KSail web UI locally, letting you provision and\nmanage clusters without a browser. It ships as a separate download (or build it from source with\n`make desktop`).\n\nThis command launches the desktop app from, in order: a \"ksail-desktop\" binary next to the ksail\nexecutable, the same binary on your PATH, or (on macOS) an installed \"KSail\" app.\n\nUsage:\n ksail open desktop [flags]\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Open Mcp\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nStart an MCP server that exposes KSail commands as tools.\n\nThe MCP server uses stdio for communication and is designed to be\nconsumed by MCP clients such as AI assistants and automation tools.\n\nExample usage with an MCP client:\n claude desktop or other MCP-compatible client can connect to:\n ksail open mcp\n\nThe server will run until the client disconnects or the process is terminated.\n\nUsage:\n ksail open mcp [flags]\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Open Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nOpen an interface to KSail for provisioning and managing clusters on your machine.\n\nKSail surfaces the same functionality in several ways: a web UI in your browser, a native\ndesktop app, an interactive AI chat assistant, and an MCP server for external AI tools. Pick\nwhichever fits how you work — run a subcommand below to get started.\n\nUsage:\n ksail open [command]\n\nAvailable Commands:\n chat Start an AI-assisted chat session\n desktop Open the KSail desktop application\n mcp Start an MCP server\n web Open the KSail web UI to manage local clusters\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail open [command] --help\" for more information about a command.\n\n```\n\n### Open Web\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nOpen the KSail web UI to provision and manage clusters on your machine.\n\nThis starts a small local web server (bound to 127.0.0.1 only) that serves the KSail web UI and a\nREST API backed by your local cluster lifecycle, then opens it in your browser. It is the same UI\nthe KSail operator serves in a cluster, but here it manages clusters locally via Docker.\n\nThe server runs until you press Ctrl+C.\n\nExamples:\n ksail open web\n ksail open web --port 8080\n ksail open web --no-browser\n\nUsage:\n ksail open web [flags]\n\nFlags:\n --no-browser Do not open the browser automatically\n --port int Port to serve the UI on (0 picks a free port)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Operator Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRun the KSail Kubernetes operator.\n\nThe operator runs inside a hub Kubernetes cluster, watches Cluster custom resources, and\ncontinuously reconciles them by creating, updating, and deleting the underlying clusters.\nIt is intended to be deployed via the KSail operator Helm chart rather than run directly.\n\nUsage:\n ksail operator [flags]\n\nFlags:\n --api-bind-address string Address the REST API binds to (empty disables it, e.g. \":8080\")\n --dev-logging Emit human-readable console logs instead of structured JSON (for local development)\n --health-probe-bind-address string Address the health and readiness probes bind to (default \":8081\")\n --host-cluster Register the cluster the operator runs on as a Cluster resource (named \"host\") so it appears in the cluster list (default true)\n --leader-elect Enable leader election to ensure only one active operator instance\n --metrics-bind-address string Address the metrics endpoint binds to (\"0\" disables it) (default \"0\")\n --oidc-client-id string OIDC client ID (the client secret is read from KSAIL_OPERATOR_OIDC_CLIENT_SECRET)\n --oidc-issuer-url string OIDC issuer URL; enables app-driven OIDC authentication on the REST API when set\n --oidc-redirect-url string OIDC callback URL reachable by the browser (e.g. https://host/api/v1/auth/callback)\n --oidc-scopes string OIDC scopes, space- or comma-separated (openid is always included) (default \"openid email profile\")\n --read-only Run the REST API in read-only mode, rejecting all mutating requests\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Project Add Environment\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nClone an existing cluster environment into a new one.\n\nCopies the source environment's overlay (/clusters//) and\nits root config (ksail..yaml) into a new environment , repointing the\nstructured identity along the way: the cluster-meta cluster_name, the\nclusters/ path segment and content references, the root config's metadata\nname, the connection context (distribution-aware), and — when --provider is given\n— the provider. Every other byte is preserved, so the kustomize replacements block,\nbase wiring, version pins and comments survive intact.\n\nSOPS-encrypted files (*.enc.yaml) are copied verbatim with only their path\nrepointed; re-encrypt them to the new environment's recipients afterwards with\n`ksail cipher` if the environments use different keys.\n\nExamples:\n # Clone the \"prod\" environment into a new \"staging\" environment\n ksail project add-environment staging --from prod\n\n # Clone \"prod\" into \"dev\" on a different provider, overwriting any existing files\n ksail project add-environment dev --from prod --provider Docker --force\n\nUsage:\n ksail project add-environment [flags]\n\nFlags:\n --force Overwrite existing destination files\n -f, --from string Source environment to clone from (required)\n -p, --provider string Provider for the new environment (defaults to the source provider)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Project Init\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nInitialize a new project in the specified directory (or current directory if none specified).\n\nUsage:\n ksail project init [flags]\n\nFlags:\n --allowed-cidrs strings CIDR blocks allowed to access the Kubernetes API and Talos API on control-plane nodes. When empty, both APIs are open to 0.0.0.0/0 and ::/0 (all IPv4 and IPv6). Example: --allowed-cidrs 203.0.113.0/24 --allowed-cidrs 198.51.100.0/24\n --cdi CDI Container Device Interface (Default: use distribution, Enabled: enable CDI, Disabled: disable CDI)\n --cert-manager CertManager Cert-Manager configuration (Enabled: install, Disabled: skip)\n --cni CNI Container Network Interface (CNI) to use\n -c, --context string Kubernetes context of cluster\n --control-planes int32 Number of control-plane nodes (default 1)\n --csi CSI Container Storage Interface (Default: use distribution, Enabled: install CSI, Disabled: skip CSI)\n -d, --distribution Distribution Kubernetes distribution to use\n --distribution-config string Configuration file for the distribution\n --distribution-version string Distribution version to deploy and reconcile toward (Talos OS version). When unset KSail follows the latest supported version; set it to pin a specific version. Other distributions carry their version in the distribution config.\n -f, --force Overwrite existing files\n -g, --gitops-engine GitOpsEngine GitOps engine to use (None disables GitOps, Flux installs Flux controllers, ArgoCD installs Argo CD) (default None)\n --image-verification ImageVerification Image verification (Talos: scaffold ImageVerificationConfig template; Vanilla/Kind: inject containerd verifier plugin patch; requires verifier binaries and typically policy to be present in the node image bin_dir; K3s/K3d: scaffold containerd config template with image verifier plugin and mount into node containers; requires verifier binaries and typically policy to be present in the node image bin_dir; Disabled: skip)\n --import-images string Path to tar archive with container images to import after cluster creation but before component installation\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n --kubernetes-version string Kubernetes version to deploy and reconcile toward. When unset KSail follows the latest supported version; set it to pin a specific version. Honored by the Talos distribution; Kind/K3d/EKS carry the version in their distribution config instead.\n --kustomization-file string Relative directory within sourceDirectory used as the kustomize entry point (e.g., clusters/local)\n --load-balancer LoadBalancer LoadBalancer support (Default: use distribution × provider, Enabled: install, Disabled: uninstall)\n --local-registry string Local registry specification: [user:pass@]host[:port][/path] (e.g., localhost:5050, ghcr.io/myorg, ${USER}:${PASS}@ghcr.io:443/org)\n --metrics-server MetricsServer Metrics Server (Default: use distribution, Enabled: install, Disabled: uninstall)\n --mirror-registry strings Configure mirror registries with optional authentication. Format: [user:pass@]host[=upstream]. Credentials support environment variables using ${VAR} syntax (quote placeholders so KSail can expand them). Examples: docker.io=https://registry-1.docker.io, '${USER}:${TOKEN}@ghcr.io=https://ghcr.io'\n --multi-cluster string Scaffold a multi-cluster source layout (clusters/base/ + clusters//) with the given initial environment name; the generated ksail.yaml points its kustomizationFile at the environment overlay\n -n, --name string Cluster name used for container names, registry names, and kubeconfig context\n --no-devcontainer Skip scaffolding .devcontainer/devcontainer.json\n --node-autoscaler-enabled NodeAutoscalerEnabled[=Enabled] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --node-autoscaling NodeAutoscaling [Deprecated: use autoscaler.node.enabled instead] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --oidc-ca-file string Path to CA certificate for self-signed OIDC providers\n --oidc-client-id string OIDC client ID for kubectl authentication\n --oidc-extra-scope strings Additional OIDC scopes beyond openid (repeatable)\n --oidc-groups-claim string JWT claim for Kubernetes groups (default \"groups\")\n --oidc-groups-prefix string Prefix for OIDC groups in Kubernetes (default \"oidc:\")\n --oidc-issuer-url string OIDC provider issuer URL (e.g. https://dex.example.com)\n --oidc-username-claim string JWT claim for Kubernetes username (default \"email\")\n --oidc-username-prefix string Prefix for OIDC usernames in Kubernetes (default \"oidc:\")\n -o, --output string Output directory for the project\n --policy-engine PolicyEngine Policy engine (None: skip, Kyverno: install Kyverno, Gatekeeper: install Gatekeeper)\n --provider Provider Infrastructure provider backend (e.g., Docker)\n -s, --source-directory string Directory containing workloads to deploy (default \"k8s\")\n --workers int32 Number of worker nodes\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Project Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nManage the GitOps project files (the on-disk project structure) without contacting a live cluster. These commands scaffold and transform the project — e.g. initializing a new project and cloning environments — as opposed to the cluster commands that operate on a running cluster.\n\nUsage:\n ksail project [flags]\n ksail project [command]\n\nAvailable Commands:\n add-environment Clone an existing cluster environment into a new one\n init Initialize a new project\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail project [command] --help\" for more information about a command.\n\n```\n\n### Tenant Create\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nGenerate RBAC isolation manifests and GitOps sync resources for a new tenant.\n\nUsage:\n ksail tenant create [flags]\n\nFlags:\n --cluster-role strings ClusterRole(s) to bind to the tenant ServiceAccount (repeatable) (default [edit])\n --delivery string How to deliver platform changes: commit or pr (default \"commit\")\n --disable-token-automount Set automountServiceAccountToken: false on the tenant ServiceAccount\n --flux-decryption (Flux) Add a SOPS decryption block referencing the sops-age secret\n --flux-retry-interval string (Flux) Flux Kustomization retryInterval\n --flux-timeout string (Flux) Flux Kustomization timeout; setting it implies --flux-wait (default 5m when waiting)\n --flux-wait (Flux) Set wait: true and timeout on the Flux Kustomization\n --force Overwrite existing tenant directory\n --git-provider string Git provider for manifest URLs: github, gitlab, gitea (repo scaffolding requires github)\n --git-token string GitHub API token for repo scaffolding (--git-provider=github)\n --image-pull-secret strings imagePullSecret to add to the tenant ServiceAccount (repeatable)\n --kustomization-path string Path to kustomization.yaml (fallback: auto-discover)\n --limit-default-cpu string Default container CPU limit (default \"500m\")\n --limit-default-memory string Default container memory limit (default \"512Mi\")\n --limit-request-cpu string Default container CPU request (default \"100m\")\n --limit-request-memory string Default container memory request (default \"128Mi\")\n -n, --namespace strings Namespaces to create (repeatable, default: tenant-name)\n --oci-path string Path suffix appended to OCI registry URL to avoid tag collisions (e.g., 'manifests' produces oci://registry/owner/repo/manifests)\n -o, --output string Output directory for platform manifests (default \".\")\n --platform-repo string Platform repo as owner/repo-name for PR delivery (default: auto-detect from git remote)\n --pod-security string Pod Security Standards level for namespaces: restricted, baseline, or privileged\n --production Enable the recommended production baseline (PSS baseline, default-deny NetworkPolicy, ResourceQuota, LimitRange, hardened ServiceAccount and Flux sync)\n --quota-cpu string CPU quota (sets requests.cpu and limits.cpu) (default \"4\")\n --quota-memory string Memory quota (sets requests.memory and limits.memory) (default \"8Gi\")\n --register Register tenant in kustomization.yaml\n --registry string OCI registry URL for Flux OCI source (e.g., oci://ghcr.io)\n --repo-visibility string Repo visibility: Private, Internal, or Public (default \"Private\")\n --source-directory string Directory name for tenant manifests in the tenant repo (default \"k8s\")\n --sync-source string Flux source type: oci or git (default \"oci\")\n --target-branch string PR target branch (default: repo's default branch)\n --tenant-repo string Tenant repo as owner/repo-name\n -t, --type string Tenant type: flux, argocd, or kubectl (default: auto-detect from ksail.yaml gitOpsEngine)\n --with-limit-range Generate a LimitRange with default container requests/limits\n --with-network-policy Generate default-deny NetworkPolicy plus DNS and intra-namespace allow rules\n --with-quota Generate a ResourceQuota for each namespace\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Tenant Delete\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRemove tenant manifests, unregister from kustomization.yaml, and optionally delete the tenant Git repository.\n\nUsage:\n ksail tenant delete [flags]\n\nFlags:\n --delete-repo Also delete the tenant Git repository\n -f, --force Skip all confirmation prompts\n --git-provider string Git provider (required with --delete-repo)\n --git-token string Git provider API token\n --kustomization-path string Path to kustomization.yaml\n -o, --output string Directory containing tenant manifests (default \".\")\n --tenant-repo string Tenant repo as owner/repo-name (required with --delete-repo)\n --unregister Remove tenant from kustomization.yaml (default true)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Tenant Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nManage multi-tenancy onboarding for Kubernetes clusters, including RBAC isolation, GitOps sync resources, and tenant repository scaffolding.\n\nUsage:\n ksail tenant [flags]\n ksail tenant [command]\n\nAvailable Commands:\n create Create a new tenant\n delete Delete a tenant\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail tenant [command] --help\" for more information about a command.\n\n```\n\n### Workload Apply Edit Last Applied\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nEdit the latest last-applied-configuration annotations of resources from the default editor.\n\n The edit-last-applied command allows you to directly edit any API resource you can retrieve via the command-line tools. It will open the editor defined by your KUBE_EDITOR, or EDITOR environment variables, or fall back to 'vi' for Linux or 'notepad' for Windows. You can edit multiple objects, although changes are applied one at a time. The command accepts file names as well as command-line arguments, although the files you point to must be previously saved versions of resources.\n\n The default format is YAML. To edit in JSON, specify \"-o json\".\n\n The flag --windows-line-endings can be used to force Windows line endings, otherwise the default for your operating system will be used.\n\n In the event an error occurs while updating, a temporary file will be created on disk that contains your unapplied changes. The most common error when updating a resource is another editor changing the resource on the server. When this occurs, you will have to apply your changes to the newer version of the resource, or update your temporary saved copy to include the latest resource version.\n\nUsage:\n ksail workload apply edit-last-applied (RESOURCE/NAME | -f FILENAME)\n\nExamples:\n # Edit the last-applied-configuration annotations by type/name in YAML\n kubectl apply edit-last-applied deployment/nginx\n \n # Edit the last-applied-configuration annotations by file in JSON\n kubectl apply edit-last-applied -f deploy.yaml -o json\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-client-side-apply\")\n -f, --filename strings Filename, directory, or URL to files to use to edit the resource\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --windows-line-endings Defaults to the line ending native to your platform.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Apply Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nApply local Kubernetes manifests to your cluster.\n\nUsage:\n ksail workload apply\n ksail workload apply [command]\n\nExamples:\n # Apply the configuration in pod.json to a pod\n ksail workload apply -f ./pod.json\n \n # Apply resources from a directory containing kustomization.yaml - e.g. dir/kustomization.yaml\n ksail workload apply -k dir/\n \n # Apply the JSON passed into stdin to a pod\n cat pod.json | ksail workload apply -f -\n \n # Apply the configuration from all files that end with '.json'\n ksail workload apply -f '*.json'\n \n # Note: --prune is still in Alpha\n # Apply the configuration in manifest.yaml that matches label app=nginx and delete all other resources that are not in the file and match label app=nginx\n ksail workload apply --prune -f manifest.yaml -l app=nginx\n \n # Apply the configuration in manifest.yaml and delete all the other config maps that are not in the file\n ksail workload apply --prune -f manifest.yaml --all --prune-allowlist=core/v1/ConfigMap\n\nAvailable Commands:\n edit-last-applied Edit latest last-applied-configuration annotations of a resource/object\n set-last-applied Set the last-applied-configuration annotation on a live object to match the contents of a file\n view-last-applied View the latest last-applied-configuration annotations of a resource/object\n\nFlags:\n --all Select all resources in the namespace of the specified resource types.\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --cascade string[=\"background\"] Must be \"background\", \"orphan\", or \"foreground\". Selects the deletion cascading strategy for the dependents (e.g. Pods created by a ReplicationController). Defaults to background. (default \"background\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-client-side-apply\")\n -f, --filename strings The files that contain the configurations to apply.\n --force If true, immediately remove resources from API and bypass graceful deletion. Note that immediate deletion of some resources may result in inconsistency or data loss and requires confirmation.\n --force-conflicts If true, server-side apply will force the changes against conflicts.\n --grace-period int Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. Set to 1 for immediate shutdown. Can only be set to 0 when --force is true (force deletion). (default -1)\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process a kustomization directory. This flag can't be used together with -f or -R.\n -n, --namespace string If present, the namespace scope for this CLI request\n --openapi-patch If true, use openapi to calculate diff when the openapi presents and the resource can be found in the openapi spec. Otherwise, fall back to use baked-in types. (default true)\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --overwrite Automatically resolve conflicts between the modified and live configuration by using values from the modified configuration (default true)\n --prune Automatically delete resource objects, that do not appear in the configs and are created by either apply or create --save-config. Should be used with either -l or --all.\n --prune-allowlist stringArray Overwrite the default allowlist with for --prune\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --server-side If true, apply runs in the server instead of the client.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --subresource string If specified, apply will operate on the subresource of the requested object. Only allowed when using --server-side.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --timeout duration The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --wait If true, wait for resources to be gone before returning. This waits for finalizers.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload apply [command] --help\" for more information about a command.\n\n```\n\n### Workload Apply Set Last Applied\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nSet the latest last-applied-configuration annotations by setting it to match the contents of a file. This results in the last-applied-configuration being updated as though 'kubectl apply -f ' was run, without updating any other parts of the object.\n\nUsage:\n ksail workload apply set-last-applied -f FILENAME\n\nExamples:\n # Set the last-applied-configuration of a resource to match the contents of a file\n kubectl apply set-last-applied -f deploy.yaml\n \n # Execute set-last-applied against each configuration file in a directory\n kubectl apply set-last-applied -f path/\n \n # Set the last-applied-configuration of a resource to match the contents of a file; will create the annotation if it does not already exist\n kubectl apply set-last-applied -f deploy.yaml --create-annotation=true\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --create-annotation Will create 'last-applied-configuration' annotations if current objects doesn't have one\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n -f, --filename strings Filename, directory, or URL to files that contains the last-applied-configuration annotations\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Apply View Last Applied\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nView the latest last-applied-configuration annotations by type/name or file.\n\n The default output will be printed to stdout in YAML format. You can use the -o option to change the output format.\n\nUsage:\n ksail workload apply view-last-applied (TYPE [NAME | -l label] | TYPE/NAME | -f FILENAME)\n\nExamples:\n # View the last-applied-configuration annotations by type/name in YAML\n kubectl apply view-last-applied deployment/nginx\n \n # View the last-applied-configuration annotations by file in JSON\n kubectl apply view-last-applied -f deploy.yaml -o json\n\nFlags:\n --all Select all resources in the namespace of the specified resource types\n -f, --filename strings Filename, directory, or URL to files that contains the last-applied-configuration annotations\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. Must be one of (yaml, json) (default \"yaml\")\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Cipher Decrypt\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDecrypt a file using SOPS (Secrets OPerationS).\n\nIf no file is given, input is read from stdin.\n\nSOPS supports multiple key management systems:\n - age recipients\n - PGP fingerprints\n - AWS KMS\n - GCP KMS\n - Azure Key Vault\n - HashiCorp Vault\n\nExample:\n ksail workload cipher decrypt secrets.yaml\n ksail workload cipher decrypt secrets.yaml --extract '[\"data\"][\"password\"]'\n ksail workload cipher decrypt secrets.yaml --output plaintext.yaml\n ksail workload cipher decrypt secrets.yaml --ignore-mac\n cat secrets.enc.yaml | ksail workload cipher decrypt\n\nUsage:\n ksail workload cipher decrypt [file] [flags]\n\nFlags:\n -e, --extract string extract a specific key from the decrypted file (JSONPath format)\n --ignore-mac ignore Message Authentication Code (MAC) check\n -o, --output string output file path (default: stdout)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Cipher Edit\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nEdit an encrypted file using SOPS (Secrets OPerationS).\n\nIf the file exists and is encrypted, it will be decrypted for editing.\nIf the file does not exist, an example file will be created.\n\nThe editor is determined by (in order of precedence):\n 1. --editor flag\n 2. spec.editor from ksail.yaml config\n 3. SOPS_EDITOR or EDITOR environment variables\n 4. Fallback to vim, nano, or vi\n\nSOPS supports multiple key management systems:\n - age recipients\n - PGP fingerprints\n - AWS KMS\n - GCP KMS\n - Azure Key Vault\n - HashiCorp Vault\n\nExample:\n ksail workload cipher edit secrets.yaml\n ksail workload cipher edit --editor \"code --wait\" secrets.yaml\n SOPS_EDITOR=\"code --wait\" ksail workload cipher edit secrets.yaml\n\nUsage:\n ksail workload cipher edit [flags]\n\nFlags:\n --editor string editor command to use (e.g., 'code --wait', 'vim', 'nano')\n --ignore-mac ignore Message Authentication Code during decryption\n --show-master-keys show master keys in the editor\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Cipher Encrypt\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nEncrypt a file using SOPS (Secrets OPerationS).\n\nSOPS supports multiple key management systems:\n - age recipients\n - PGP fingerprints\n - AWS KMS\n - GCP KMS\n - Azure Key Vault\n - HashiCorp Vault\n\nExample:\n ksail workload cipher encrypt secrets.yaml\n\nUsage:\n ksail workload cipher encrypt [flags]\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Cipher Import\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nImport an age private key to the system's default SOPS age key location.\n\nThe private key must be provided as a command argument and must include the full\nkey with the AGE-SECRET-KEY- prefix.\n\nThe public key will be automatically derived from the private key.\n\nThe command will automatically add metadata including:\n - Creation timestamp\n - Public key (derived from private key)\n\nKey file location (checked in order):\n 1. SOPS_AGE_KEY_FILE environment variable\n 2. $XDG_CONFIG_HOME/sops/age/keys.txt (if XDG_CONFIG_HOME is set)\n 3. Platform-specific defaults:\n Linux: $HOME/.config/sops/age/keys.txt\n macOS: $HOME/Library/Application Support/sops/age/keys.txt\n Windows: %AppData%\\sops\\age\\keys.txt\n\nThe private key must be in age format (starting with \"AGE-SECRET-KEY-\").\n\nExamples:\n # Import a private key (public key will be derived automatically)\n ksail workload cipher import AGE-SECRET-KEY-1ABCDEF...\n\nUsage:\n ksail workload cipher import PRIVATE_KEY [flags]\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Cipher Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCipher command provides access to SOPS (Secrets OPerationS) functionality\nfor encrypting and decrypting files.\n\nSOPS supports multiple key management systems:\n - age recipients\n - PGP fingerprints\n - AWS KMS\n - GCP KMS\n - Azure Key Vault\n - HashiCorp Vault\n\nUsage:\n ksail workload cipher [command]\n\nAvailable Commands:\n decrypt Decrypt a file with SOPS\n edit Edit an encrypted file with SOPS\n encrypt Encrypt a file with SOPS\n import Import an age key to the system's SOPS key location\n rotate Rotate data keys for SOPS-encrypted files\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload cipher [command] --help\" for more information about a command.\n\n```\n\n### Workload Cipher Rotate\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRotate data keys for SOPS-encrypted files.\n\nThis command generates a new data encryption key and re-encrypts all values\nin the target file(s). This is the same behavior as the native 'sops rotate'\ncommand, extended with batch directory support.\n\nWhen the target is a file, only that file is rotated. When the target is a\nfolder, all SOPS-encrypted YAML and JSON files in the folder are rotated.\nUse --recursive to include subdirectories.\n\nOptionally, master key recipients can be added or removed during rotation:\n --add-key adds a new master key recipient\n --remove-key removes an existing master key recipient\n\nBy default, the command shows which files will be affected and prompts for\nconfirmation. Use --force to skip the confirmation prompt. In non-interactive\nenvironments (no TTY), the prompt is automatically skipped.\n\nUse --dry-run to preview which files would be rotated without making changes.\n\nKey type is auto-detected from the key format:\n - Age keys (age1...)\n\nExamples:\n # Rotate all encrypted files in a folder (with confirmation)\n ksail workload cipher rotate ./k8s\n\n # Rotate without confirmation prompt\n ksail workload cipher rotate ./k8s --force\n\n # Rotate recursively through subdirectories\n ksail workload cipher rotate ./k8s --recursive\n\n # Rotate a single file\n ksail workload cipher rotate secrets.yaml\n\n # Add a new age recipient during rotation\n ksail workload cipher rotate ./k8s --add-key age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p\n\n # Remove an old age recipient during rotation\n ksail workload cipher rotate ./k8s --remove-key age1oldkey...\n\n # Replace a recipient (add new, remove old)\n ksail workload cipher rotate ./k8s --add-key age1newkey... --remove-key age1oldkey...\n\n # Re-seal every file to a completely new recipient set (e.g. after a key is\n # retired or compromised) — declare the full set, no need to enumerate old keys\n ksail workload cipher rotate ./k8s --set-key age1newkey1... --set-key age1newkey2... --recursive\n\n # Preview which files would be rotated without making changes\n ksail workload cipher rotate ./k8s --dry-run\n\nUsage:\n ksail workload cipher rotate [flags]\n\nFlags:\n --add-key string public key to add as a master key recipient\n --dry-run show which files would be rotated without making changes\n -f, --force skip confirmation prompt and rotate immediately\n -r, --recursive scan subdirectories when target is a folder\n --remove-key string public key to remove from master key recipients\n --set-key stringArray public key for the complete new recipient set (repeatable); replaces all recipients and re-seals to a fresh data key — mutually exclusive with --add-key/--remove-key\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Clusterrole\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cluster role.\n\nUsage:\n ksail workload create clusterrole NAME --verb=verb --resource=resource.group [--resource-name=resourcename] [--dry-run=server|client|none]\n\nExamples:\n # Create a cluster role named \"pod-reader\" that allows user to perform \"get\", \"watch\" and \"list\" on pods\n kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods\n \n # Create a cluster role named \"pod-reader\" with ResourceName specified\n kubectl create clusterrole pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod\n \n # Create a cluster role named \"foo\" with API Group specified\n kubectl create clusterrole foo --verb=get,list,watch --resource=rs.apps\n \n # Create a cluster role named \"foo\" with SubResource specified\n kubectl create clusterrole foo --verb=get,list,watch --resource=pods,pods/status\n \n # Create a cluster role name \"foo\" with NonResourceURL specified\n kubectl create clusterrole \"foo\" --verb=get --non-resource-url=/logs/*\n \n # Create a cluster role name \"monitoring\" with AggregationRule specified\n kubectl create clusterrole monitoring --aggregation-rule=\"rbac.example.com/aggregate-to-monitoring=true\"\n\nFlags:\n --aggregation-rule mapStringString An aggregation label selector for combining ClusterRoles.\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --non-resource-url strings A partial url that user should have access to.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --resource strings Resource that the rule applies to\n --resource-name stringArray Resource in the white list that the rule applies to, repeat this flag for multiple items\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --verb strings Verb that applies to the resources contained in the rule\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Clusterrolebinding\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cluster role binding for a particular cluster role.\n\nUsage:\n ksail workload create clusterrolebinding NAME --clusterrole=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none]\n\nExamples:\n # Create a cluster role binding for user1, user2, and group1 using the cluster-admin cluster role\n kubectl create clusterrolebinding cluster-admin --clusterrole=cluster-admin --user=user1 --user=user2 --group=group1\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterrole string ClusterRole this ClusterRoleBinding should reference\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --group stringArray Groups to bind to the clusterrole. The flag can be repeated to add multiple groups.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --serviceaccount stringArray Service accounts to bind to the clusterrole, in the format :. The flag can be repeated to add multiple service accounts.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --user stringArray Usernames to bind to the clusterrole. The flag can be repeated to add multiple users.\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Configmap\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a config map based on a file, directory, or specified literal value.\n\n A single config map may package one or more key/value pairs.\n\n When creating a config map based on a file, the key will default to the basename of the file, and the value will default to the file content. If the basename is an invalid key, you may specify an alternate key.\n\n When creating a config map based on a directory, each file whose basename is a valid key in the directory will be packaged into the config map. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).\n\nUsage:\n ksail workload create configmap NAME [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none]\n\nAliases:\n configmap, cm\n\nExamples:\n # Create a new config map named my-config based on folder bar\n kubectl create configmap my-config --from-file=path/to/bar\n \n # Create a new config map named my-config with specified keys instead of file basenames on disk\n kubectl create configmap my-config --from-file=key1=/path/to/bar/file1.txt --from-file=key2=/path/to/bar/file2.txt\n \n # Create a new config map named my-config with key1=config1 and key2=config2\n kubectl create configmap my-config --from-literal=key1=config1 --from-literal=key2=config2\n \n # Create a new config map named my-config with key=value pairs from an env file\n kubectl create configmap my-config --from-env-file=path/to/bar.env\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the configmap to its name.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-env-file strings Specify the path to a file to read lines of key=val pairs to create a configmap.\n --from-file strings Key file can be specified using its file path, in which case file basename will be used as configmap key, or optionally with a key and file path, in which case the given key will be used. Specifying a directory will iterate each named file in the directory whose basename is a valid configmap key.\n --from-literal stringArray Specify a key and literal value to insert in configmap (i.e. mykey=somevalue)\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Cronjob\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cron job with the specified name.\n\nUsage:\n ksail workload create cronjob NAME --image=image --schedule='0/5 * * * ?' -- [COMMAND] [args...] [flags]\n\nAliases:\n cronjob, cj\n\nExamples:\n # Create a cron job\n kubectl create cronjob my-job --image=busybox --schedule=\"*/1 * * * *\"\n \n # Create a cron job with a command\n kubectl create cronjob my-job --image=busybox --schedule=\"*/1 * * * *\" -- date\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --image string Image name to run.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --restart string job's restart policy. supported values: OnFailure, Never\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --schedule string A schedule in the Cron format the job should be run with.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Deployment\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a deployment with the specified name.\n\nUsage:\n ksail workload create deployment NAME --image=image -- [COMMAND] [args...]\n\nAliases:\n deployment, deploy\n\nExamples:\n # Create a deployment named my-dep that runs the busybox image\n kubectl create deployment my-dep --image=busybox\n \n # Create a deployment with a command\n kubectl create deployment my-dep --image=busybox -- date\n \n # Create a deployment named my-dep that runs the nginx image with 3 replicas\n kubectl create deployment my-dep --image=nginx --replicas=3\n \n # Create a deployment named my-dep that runs the busybox image and expose port 5701\n kubectl create deployment my-dep --image=busybox --port=5701\n \n # Create a deployment named my-dep that runs multiple containers\n kubectl create deployment my-dep --image=busybox:latest --image=ubuntu:latest --image=nginx\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --image strings Image names to run. A deployment can have multiple images set for multi-container pod.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --port int32 The containerPort that this deployment exposes. (default -1)\n -r, --replicas int32 Number of replicas to create. Default is 1. (default 1)\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Helmrelease\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update a HelmRelease resource using Flux APIs\n\nUsage:\n ksail workload create helmrelease [name] [flags]\n\nAliases:\n helmrelease, hr\n\nExamples:\n # Create a HelmRelease with a chart from a HelmRepository source\n ksail workload create helmrelease podinfo \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --chart-version=6.6.2 \\\n --namespace=flux-system\n\n # Create a HelmRelease targeting a different namespace\n ksail workload create helmrelease podinfo \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --target-namespace=production \\\n --create-target-namespace=true\n\nFlags:\n --chart string Helm chart name or path\n --chart-version string Helm chart version\n --create-target-namespace create the target namespace if it doesn't exist\n --depends-on strings HelmRelease that must be ready before this one\n --export export in YAML format to stdout\n --interval duration reconciliation interval (default 1m0s)\n --source string source name in format 'Kind/name' or 'Kind/name.namespace'\n --source-kind string source kind (HelmRepository, GitRepository, Bucket) (default \"HelmRepository\")\n --target-namespace string namespace to install the Helm release\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Ingress\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate an ingress with the specified name.\n\nUsage:\n ksail workload create ingress NAME --rule=host/path=service:port[,tls[=secret]] \n\nAliases:\n ingress, ing\n\nExamples:\n # Create a single ingress called 'simple' that directs requests to foo.com/bar to svc\n # svc1:8080 with a TLS secret \"my-cert\"\n kubectl create ingress simple --rule=\"foo.com/bar=svc1:8080,tls=my-cert\"\n \n # Create a catch all ingress of \"/path\" pointing to service svc:port and Ingress Class as \"otheringress\"\n kubectl create ingress catch-all --class=otheringress --rule=\"/path=svc:port\"\n \n # Create an ingress with two annotations: ingress.annotation1 and ingress.annotations2\n kubectl create ingress annotated --class=default --rule=\"foo.com/bar=svc:port\" \\\n --annotation ingress.annotation1=foo \\\n --annotation ingress.annotation2=bla\n \n # Create an ingress with the same host and multiple paths\n kubectl create ingress multipath --class=default \\\n --rule=\"foo.com/=svc:port\" \\\n --rule=\"foo.com/admin/=svcadmin:portadmin\"\n \n # Create an ingress with multiple hosts and the pathType as Prefix\n kubectl create ingress ingress1 --class=default \\\n --rule=\"foo.com/path*=svc:8080\" \\\n --rule=\"bar.com/admin*=svc2:http\"\n \n # Create an ingress with TLS enabled using the default ingress certificate and different path types\n kubectl create ingress ingtls --class=default \\\n --rule=\"foo.com/=svc:https,tls\" \\\n --rule=\"foo.com/path/subpath*=othersvc:8080\"\n \n # Create an ingress with TLS enabled using a specific secret and pathType as Prefix\n kubectl create ingress ingsecret --class=default \\\n --rule=\"foo.com/*=svc:8080,tls=secret1\"\n \n # Create an ingress with a default backend\n kubectl create ingress ingdefault --class=default \\\n --default-backend=defaultsvc:http \\\n --rule=\"foo.com/*=svc:8080,tls=secret1\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --annotation stringArray Annotation to insert in the ingress object, in the format annotation=value\n --class string Ingress Class to be used\n --default-backend string Default service for backend, in format of svcname:port\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --rule stringArray Rule in format host/path=service:port[,tls=secretname]. Paths containing the leading character '*' are considered pathType=Prefix. tls argument is optional.\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Job\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a job with the specified name.\n\nUsage:\n ksail workload create job NAME --image=image [--from=cronjob/name] -- [COMMAND] [args...]\n\nExamples:\n # Create a job\n kubectl create job my-job --image=busybox\n \n # Create a job with a command\n kubectl create job my-job --image=busybox -- date\n \n # Create a job from a cron job named \"a-cronjob\"\n kubectl create job test-job --from=cronjob/a-cronjob\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from string The name of the resource to create a Job from (only CronJob is supported).\n --image string Image name to run.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Kustomization\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update a Kustomization resource using Flux APIs\n\nUsage:\n ksail workload create kustomization [name] [flags]\n\nExamples:\n # Create a Kustomization from a GitRepository source\n ksail workload create kustomization podinfo \\\n --source=GitRepository/podinfo \\\n --path=\"./kustomize\" \\\n --prune=true \\\n --interval=5m\n\n # Create a Kustomization with a target namespace\n ksail workload create kustomization podinfo \\\n --source=GitRepository/podinfo \\\n --path=\"./kustomize\" \\\n --target-namespace=default \\\n --prune=true\n\nFlags:\n --depends-on strings Kustomization that must be ready before this one\n --export export in YAML format to stdout\n --interval duration reconciliation interval (default 1m0s)\n --path string path to the directory containing a kustomization.yaml file (default \"./\")\n --prune enable garbage collection\n --source string source name in format 'Kind/name' or 'Kind/name.namespace'\n --source-kind string source kind (GitRepository, OCIRepository, Bucket) (default \"GitRepository\")\n --target-namespace string overrides the namespace of all Kustomization objects\n --wait enable health checking\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Namespace\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a namespace with the specified name.\n\nUsage:\n ksail workload create namespace NAME [--dry-run=server|client|none]\n\nAliases:\n namespace, ns\n\nExamples:\n # Create a new namespace named my-namespace\n kubectl create namespace my-namespace\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Poddisruptionbudget\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a pod disruption budget with the specified name, selector, and desired minimum available pods.\n\nUsage:\n ksail workload create poddisruptionbudget NAME --selector=SELECTOR --min-available=N [--dry-run=server|client|none]\n\nAliases:\n poddisruptionbudget, pdb\n\nExamples:\n # Create a pod disruption budget named my-pdb that will select all pods with the app=rails label\n # and require at least one of them being available at any point in time\n kubectl create poddisruptionbudget my-pdb --selector=app=rails --min-available=1\n \n # Create a pod disruption budget named my-pdb that will select all pods with the app=nginx label\n # and require at least half of the pods selected to be available at any point in time\n kubectl create pdb my-pdb --selector=app=nginx --min-available=50%\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --max-unavailable string The maximum number or percentage of unavailable pods this budget requires.\n --min-available string The minimum number or percentage of available pods this budget requires.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --selector string A label selector to use for this budget. Only equality-based selector requirements are supported.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Priorityclass\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a priority class with the specified name, value, globalDefault and description.\n\nUsage:\n ksail workload create priorityclass NAME --value=VALUE --global-default=BOOL [--dry-run=server|client|none]\n\nAliases:\n priorityclass, pc\n\nExamples:\n # Create a priority class named high-priority\n kubectl create priorityclass high-priority --value=1000 --description=\"high priority\"\n \n # Create a priority class named default-priority that is considered as the global default priority\n kubectl create priorityclass default-priority --value=1000 --global-default=true --description=\"default priority\"\n \n # Create a priority class named high-priority that cannot preempt pods with lower priority\n kubectl create priorityclass high-priority --value=1000 --description=\"high priority\" --preemption-policy=\"Never\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --description string description is an arbitrary string that usually provides guidelines on when this priority class should be used.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --global-default global-default specifies whether this PriorityClass should be considered as the default priority.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --preemption-policy string preemption-policy is the policy for preempting pods with lower priority. (default \"PreemptLowerPriority\")\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --value int32 the value of this priority class.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Quota\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a resource quota with the specified name, hard limits, and optional scopes.\n\nUsage:\n ksail workload create quota NAME [--hard=key1=value1,key2=value2] [--scopes=Scope1,Scope2] [--dry-run=server|client|none]\n\nAliases:\n quota, resourcequota\n\nExamples:\n # Create a new resource quota named my-quota\n kubectl create quota my-quota --hard=cpu=1,memory=1G,pods=2,services=3,replicationcontrollers=2,resourcequotas=1,secrets=5,persistentvolumeclaims=10\n \n # Create a new resource quota named best-effort\n kubectl create quota best-effort --hard=pods=100 --scopes=BestEffort\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --hard string A comma-delimited set of resource=quantity pairs that define a hard limit.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --scopes string A comma-delimited set of quota scopes that must all match each object tracked by the quota.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Role\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a role with single rule.\n\nUsage:\n ksail workload create role NAME --verb=verb --resource=resource.group/subresource [--resource-name=resourcename] [--dry-run=server|client|none]\n\nExamples:\n # Create a role named \"pod-reader\" that allows user to perform \"get\", \"watch\" and \"list\" on pods\n kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods\n \n # Create a role named \"pod-reader\" with ResourceName specified\n kubectl create role pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod\n \n # Create a role named \"foo\" with API Group specified\n kubectl create role foo --verb=get,list,watch --resource=rs.apps\n \n # Create a role named \"foo\" with SubResource specified\n kubectl create role foo --verb=get,list,watch --resource=pods,pods/status\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --resource strings Resource that the rule applies to\n --resource-name stringArray Resource in the white list that the rule applies to, repeat this flag for multiple items\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --verb strings Verb that applies to the resources contained in the rule\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Rolebinding\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a role binding for a particular role or cluster role.\n\nUsage:\n ksail workload create rolebinding NAME --clusterrole=NAME|--role=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none]\n\nExamples:\n # Create a role binding for user1, user2, and group1 using the admin cluster role\n kubectl create rolebinding admin --clusterrole=admin --user=user1 --user=user2 --group=group1\n \n # Create a role binding for service account monitoring:sa-dev using the admin role\n kubectl create rolebinding admin-binding --role=admin --serviceaccount=monitoring:sa-dev\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterrole string ClusterRole this RoleBinding should reference\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --group stringArray Groups to bind to the role. The flag can be repeated to add multiple groups.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --role string Role this RoleBinding should reference\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --serviceaccount stringArray Service accounts to bind to the role, in the format :. The flag can be repeated to add multiple service accounts.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --user stringArray Usernames to bind to the role. The flag can be repeated to add multiple users.\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate Kubernetes resources from files or stdin.\n\nUsage:\n ksail workload create\n ksail workload create [command]\n\nExamples:\n # Create a pod using the data in pod.json\n ksail workload create -f ./pod.json\n \n # Create a pod based on the JSON passed into stdin\n cat pod.json | ksail workload create -f -\n \n # Edit the data in registry.yaml in JSON then create the resource using the edited data\n ksail workload create -f registry.yaml --edit -o json\n\nAvailable Commands:\n clusterrole Create a cluster role\n clusterrolebinding Create a cluster role binding for a particular cluster role\n configmap Create a config map from a local file, directory or literal value\n cronjob Create a cron job with the specified name\n deployment Create a deployment with the specified name\n helmrelease Create or update a HelmRelease resource\n ingress Create an ingress with the specified name\n job Create a job with the specified name\n kustomization Create or update a Kustomization resource\n namespace Create a namespace with the specified name\n poddisruptionbudget Create a pod disruption budget with the specified name\n priorityclass Create a priority class with the specified name\n quota Create a quota with the specified name\n role Create a role with single rule\n rolebinding Create a role binding for a particular role or cluster role\n secret Create a secret using a specified subcommand\n service Create a service using a specified subcommand\n serviceaccount Create a service account with the specified name\n source Create or update Flux sources\n token Request a service account token\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --edit Edit the API resource before creating\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -f, --filename strings Filename, directory, or URL to files to use to create the resource\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -n, --namespace string If present, the namespace scope for this CLI request\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --raw string Raw URI to POST to the server. Uses the transport specified by the kubeconfig file.\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --windows-line-endings Only relevant if --edit=true. Defaults to the line ending native to your platform.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload create [command] --help\" for more information about a command.\n\n```\n\n### Workload Create Secret Docker Registry\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a new secret for use with Docker registries.\n \n Dockercfg secrets are used to authenticate against Docker registries.\n \n When using the Docker command line to push images, you can authenticate to a given registry by running:\n '$ docker login DOCKER_REGISTRY_SERVER --username=DOCKER_USER --password=DOCKER_PASSWORD --email=DOCKER_EMAIL'.\n \n That produces a ~/.dockercfg file that is used by subsequent 'docker push' and 'docker pull' commands to authenticate to the registry. The email address is optional.\n\n When creating applications, you may have a Docker registry that requires authentication. In order for the\n nodes to pull images on your behalf, they must have the credentials. You can provide this information\n by creating a dockercfg secret and attaching it to your service account.\n\nUsage:\n ksail workload create secret docker-registry NAME --docker-username=user --docker-password=password --docker-email=email [--docker-server=string] [--from-file=[key=]source] [--dry-run=server|client|none]\n\nExamples:\n # If you do not already have a .dockercfg file, create a dockercfg secret directly\n kubectl create secret docker-registry my-secret --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER --docker-password=DOCKER_PASSWORD --docker-email=DOCKER_EMAIL\n \n # Create a new secret named my-secret from ~/.docker/config.json\n kubectl create secret docker-registry my-secret --from-file=path/to/.docker/config.json\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --docker-email string Email for Docker registry\n --docker-password string Password for Docker registry authentication\n --docker-server string Server location for Docker registry (default \"https://index.docker.io/v1/\")\n --docker-username string Username for Docker registry authentication\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-file strings Key files can be specified using their file path, in which case a default name of .dockerconfigjson will be given to them, or optionally with a name and file path, in which case the given name will be used. Specifying a directory will iterate each named file in the directory that is a valid secret key. For this command, the key should always be .dockerconfigjson.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Secret Generic\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a secret based on a file, directory, or specified literal value.\n\n A single secret may package one or more key/value pairs.\n\n When creating a secret based on a file, the key will default to the basename of the file, and the value will default to the file content. If the basename is an invalid key or you wish to chose your own, you may specify an alternate key.\n\n When creating a secret based on a directory, each file whose basename is a valid key in the directory will be packaged into the secret. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).\n\nUsage:\n ksail workload create secret generic NAME [--type=string] [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none]\n\nExamples:\n # Create a new secret named my-secret with keys for each file in folder bar\n kubectl create secret generic my-secret --from-file=path/to/bar\n \n # Create a new secret named my-secret with specified keys instead of names on disk\n kubectl create secret generic my-secret --from-file=ssh-privatekey=path/to/id_rsa --from-file=ssh-publickey=path/to/id_rsa.pub\n \n # Create a new secret named my-secret with key1=supersecret and key2=topsecret\n kubectl create secret generic my-secret --from-literal=key1=supersecret --from-literal=key2=topsecret\n \n # Create a new secret named my-secret using a combination of a file and a literal\n kubectl create secret generic my-secret --from-file=ssh-privatekey=path/to/id_rsa --from-literal=passphrase=topsecret\n \n # Create a new secret named my-secret from env files\n kubectl create secret generic my-secret --from-env-file=path/to/foo.env --from-env-file=path/to/bar.env\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-env-file strings Specify the path to a file to read lines of key=val pairs to create a secret.\n --from-file strings Key files can be specified using their file path, in which case a default name will be given to them, or optionally with a name and file path, in which case the given name will be used. Specifying a directory will iterate each named file in the directory that is a valid secret key.\n --from-literal stringArray Specify a key and literal value to insert in secret (i.e. mykey=somevalue)\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --type string The type of secret to create\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Secret Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a secret with specified type.\n\n A docker-registry type secret is for accessing a container registry.\n\n A generic type secret indicate an Opaque secret type.\n\n A tls type secret holds TLS certificate and its associated key.\n\nUsage:\n ksail workload create secret (docker-registry | generic | tls)\n ksail workload create secret [command]\n\nAvailable Commands:\n docker-registry Create a secret for use with a Docker registry\n generic Create a secret from a local file, directory, or literal value\n tls Create a TLS secret\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload create secret [command] --help\" for more information about a command.\n\n```\n\n### Workload Create Secret Tls\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a TLS secret from the given public/private key pair.\n\n The public/private key pair must exist beforehand. The public key certificate must be .PEM encoded and match the given private key.\n\nUsage:\n ksail workload create secret tls NAME --cert=path/to/cert/file --key=path/to/key/file [--dry-run=server|client|none]\n\nExamples:\n # Create a new TLS secret named tls-secret with the given key pair\n kubectl create secret tls tls-secret --cert=path/to/tls.crt --key=path/to/tls.key\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --cert string Path to PEM encoded public key certificate.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --key string Path to private key associated with given certificate.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Service Clusterip\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a ClusterIP service with the specified name.\n\nUsage:\n ksail workload create service clusterip NAME [--tcp=:] [--dry-run=server|client|none]\n\nExamples:\n # Create a new ClusterIP service named my-cs\n kubectl create service clusterip my-cs --tcp=5678:8080\n \n # Create a new ClusterIP service named my-cs (in headless mode)\n kubectl create service clusterip my-cs --clusterip=\"None\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterip string Assign your own ClusterIP or set to 'None' for a 'headless' service (no loadbalancing).\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Service Externalname\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate an ExternalName service with the specified name.\n\n ExternalName service references to an external DNS address instead of only pods, which will allow application authors to reference services that exist off platform, on other clusters, or locally.\n\nUsage:\n ksail workload create service externalname NAME --external-name external.name [--dry-run=server|client|none]\n\nExamples:\n # Create a new ExternalName service named my-ns\n kubectl create service externalname my-ns --external-name bar.com\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --external-name string External name of service\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Service Loadbalancer\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a LoadBalancer service with the specified name.\n\nUsage:\n ksail workload create service loadbalancer NAME [--tcp=port:targetPort] [--dry-run=server|client|none]\n\nExamples:\n # Create a new LoadBalancer service named my-lbs\n kubectl create service loadbalancer my-lbs --tcp=5678:8080\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Service Nodeport\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a NodePort service with the specified name.\n\nUsage:\n ksail workload create service nodeport NAME [--tcp=port:targetPort] [--dry-run=server|client|none]\n\nExamples:\n # Create a new NodePort service named my-ns\n kubectl create service nodeport my-ns --tcp=5678:8080\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --node-port int Port used to expose the service on each node in a cluster.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Service Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a service using a specified subcommand.\n\nUsage:\n ksail workload create service [flags]\n ksail workload create service [command]\n\nAliases:\n service, svc\n\nAvailable Commands:\n clusterip Create a ClusterIP service\n externalname Create an ExternalName service\n loadbalancer Create a LoadBalancer service\n nodeport Create a NodePort service\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload create service [command] --help\" for more information about a command.\n\n```\n\n### Workload Create Serviceaccount\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a service account with the specified name.\n\nUsage:\n ksail workload create serviceaccount NAME [--dry-run=server|client|none]\n\nAliases:\n serviceaccount, sa\n\nExamples:\n # Create a new service account named my-service-account\n kubectl create serviceaccount my-service-account\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Source Git\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update a GitRepository source using Flux APIs\n\nUsage:\n ksail workload create source git [name] [flags]\n\nExamples:\n # Create a source from a public Git repository master branch\n ksail workload create source git podinfo \\\n --url=https://github.com/stefanprodan/podinfo \\\n --branch=master\n\n # Create a source for a Git repository pinned to specific git tag\n ksail workload create source git podinfo \\\n --url=https://github.com/stefanprodan/podinfo \\\n --tag=\"3.2.3\"\n\n # Create a source from a Git repository using SSH authentication\n ksail workload create source git podinfo \\\n --url=ssh://git@github.com/stefanprodan/podinfo \\\n --branch=master \\\n --secret-ref=git-credentials\n\nFlags:\n --branch string git branch\n --commit string git commit\n --export export in YAML format to stdout\n --interval duration source sync interval (default 1m0s)\n --secret-ref string the name of an existing secret containing SSH or basic credentials\n --tag string git tag\n --tag-semver string git tag semver range\n --url string git address, e.g. ssh://git@host/org/repository\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Source Helm\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update a HelmRepository source using Flux APIs\n\nUsage:\n ksail workload create source helm [name] [flags]\n\nExamples:\n # Create a source from an HTTPS Helm repository\n ksail workload create source helm podinfo \\\n --url=https://stefanprodan.github.io/podinfo\n\n # Create a source for an OCI Helm repository\n ksail workload create source helm podinfo \\\n --url=oci://ghcr.io/stefanprodan/charts/podinfo \\\n --secret-ref=docker-config\n\nFlags:\n --export export in YAML format to stdout\n --interval duration source sync interval (default 1m0s)\n --oci-provider string OCI provider for authentication\n --pass-credentials pass credentials to all domains\n --secret-ref string the name of an existing secret containing credentials\n --url string Helm repository address\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Source Oci\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update an OCIRepository source using Flux APIs\n\nUsage:\n ksail workload create source oci [name] [flags]\n\nExamples:\n # Create a source for an OCI artifact\n ksail workload create source oci podinfo \\\n --url=oci://ghcr.io/stefanprodan/manifests/podinfo \\\n --tag=6.6.2 \\\n --namespace=flux-system\n\n # Create a source with semver range\n ksail workload create source oci podinfo \\\n --url=oci://ghcr.io/stefanprodan/manifests/podinfo \\\n --tag-semver=\">=6.6.0 <7.0.0\"\n\nFlags:\n --digest string OCI artifact digest\n --export export in YAML format to stdout\n --insecure allow insecure connections\n --interval duration source sync interval (default 1m0s)\n --provider string OCI provider (default \"generic\")\n --secret-ref string the name of an existing secret containing credentials\n --tag string OCI artifact tag\n --tag-semver string OCI artifact tag semver range\n --url string OCI repository URL\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Source Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update Flux sources\n\nUsage:\n ksail workload create source [command]\n\nAvailable Commands:\n git Create or update a GitRepository source\n helm Create or update a HelmRepository source\n oci Create or update an OCIRepository source\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload create source [command] --help\" for more information about a command.\n\n```\n\n### Workload Create Token\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRequest a service account token.\n\nUsage:\n ksail workload create token SERVICE_ACCOUNT_NAME\n\nExamples:\n # Request a token to authenticate to the kube-apiserver as the service account \"myapp\" in the current namespace\n kubectl create token myapp\n \n # Request a token for a service account in a custom namespace\n kubectl create token myapp --namespace myns\n \n # Request a token with a custom expiration\n kubectl create token myapp --duration 10m\n \n # Request a token with a custom audience\n kubectl create token myapp --audience https://example.com\n \n # Request a token bound to an instance of a Secret object\n kubectl create token myapp --bound-object-kind Secret --bound-object-name mysecret\n \n # Request a token bound to an instance of a Secret object with a specific UID\n kubectl create token myapp --bound-object-kind Secret --bound-object-name mysecret --bound-object-uid 0d4691ed-659b-4935-a832-355f77ee47cc\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --audience stringArray Audience of the requested token. If unset, defaults to requesting a token for use with the Kubernetes API server. May be repeated to request a token valid for multiple audiences.\n --bound-object-kind string Kind of an object to bind the token to. Supported kinds are Node, Pod, Secret. If set, --bound-object-name must be provided.\n --bound-object-name string Name of an object to bind the token to. The token will expire when the object is deleted. Requires --bound-object-kind.\n --bound-object-uid string UID of an object to bind the token to. Requires --bound-object-kind and --bound-object-name. If unset, the UID of the existing object is used.\n --duration duration Requested lifetime of the issued token. If not set or if set to 0, the lifetime will be determined by the server automatically. The server may return a token with a longer or shorter lifetime.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Debug\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate debugging sessions for troubleshooting workloads and nodes.\n\nDebug containers allow you to interactively troubleshoot running pods, create copies of pods with modified configuration, or attach a debug container to a node.\n\nUsage:\n ksail workload debug\n\nExamples:\n # Create an interactive debugging session in pod mypod and immediately attach to it.\n ksail workload debug mypod -it --image=busybox\n \n # Create an interactive debugging session for the pod in the file pod.yaml and immediately attach to it.\n # (requires the EphemeralContainers feature to be enabled in the cluster)\n ksail workload debug -f pod.yaml -it --image=busybox\n \n # Create a debug container named debugger using a custom automated debugging image.\n ksail workload debug --image=myproj/debug-tools -c debugger mypod\n \n # Create a copy of mypod adding a debug container and attach to it\n ksail workload debug mypod -it --image=busybox --copy-to=my-debugger\n \n # Create a copy of mypod changing the command of mycontainer\n ksail workload debug mypod -it --copy-to=my-debugger --container=mycontainer -- sh\n \n # Create a copy of mypod changing all container images to busybox\n ksail workload debug mypod --copy-to=my-debugger --set-image=*=busybox\n \n # Create a copy of mypod adding a debug container and changing container images\n ksail workload debug mypod -it --copy-to=my-debugger --image=debian --set-image=app=app:debug,sidecar=sidecar:debug\n \n # Create an interactive debugging session on a node and immediately attach to it.\n # The container will run in the host namespaces and the host's filesystem will be mounted at /host\n ksail workload debug node/mynode -it --image=busybox\n\nFlags:\n --arguments-only If specified, everything after -- will be passed to the new container as Args instead of Command.\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --attach If true, wait for the container to start running, and then attach as if 'kubectl attach ...' were called. Default false, unless '-i/--stdin' is set, in which case the default is true.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n -c, --container string Container name to use for debug container.\n --context string The name of the kubeconfig context to use\n --copy-to string Create a copy of the target Pod with this name.\n --custom string Path to a JSON or YAML file containing a partial container spec to customize built-in debug profiles.\n --disable-compression If true, opt-out of response compression for all requests to the server\n --env stringToString Environment variables to set in the container. (default [])\n -f, --filename strings identifying the resource to debug\n --host string Node name for host-level debugging (bypasses Kubernetes, targets the infrastructure node directly)\n --image string Container image to use for debug container.\n --image-pull-policy string The image pull policy for the container. If left empty, this value will not be specified by the client and defaulted by the server.\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --keep-annotations If true, keep the original pod annotations.(This flag only works when used with '--copy-to')\n --keep-init-containers Run the init containers for the pod. Defaults to true.(This flag only works when used with '--copy-to') (default true)\n --keep-labels If true, keep the original pod labels.(This flag only works when used with '--copy-to')\n --keep-liveness If true, keep the original pod liveness probes.(This flag only works when used with '--copy-to')\n --keep-readiness If true, keep the original pod readiness probes.(This flag only works when used with '--copy-to')\n --keep-startup If true, keep the original startup probes.(This flag only works when used with '--copy-to')\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -n, --namespace string If present, the namespace scope for this CLI request\n --profile string Options are \"general\", \"baseline\", \"restricted\", \"netadmin\" or \"sysadmin\". Defaults to \"general\" (default \"general\")\n -q, --quiet If true, suppress informational messages.\n --replace When used with '--copy-to', delete the original Pod.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n --same-node When used with '--copy-to', schedule the copy of target Pod on the same node.\n -s, --server string The address and port of the Kubernetes API server\n --set-image stringToString When used with '--copy-to', a list of name=image pairs for changing container images, similar to how 'kubectl set image' works. (default [])\n --share-processes When used with '--copy-to', enable process namespace sharing in the copy. (default true)\n -i, --stdin Keep stdin open on the container(s) in the pod, even if nothing is attached.\n --target string When using an ephemeral container, target processes in this container name.\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n -t, --tty Allocate a TTY for the debugging container.\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Delete\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDelete Kubernetes resources by file names, stdin, resources and names, or by resources and label selector.\n\nUsage:\n ksail workload delete\n\nExamples:\n # Delete a pod using the type and name specified in pod.json\n ksail workload delete -f ./pod.json\n \n # Delete resources from a directory containing kustomization.yaml - e.g. dir/kustomization.yaml\n ksail workload delete -k dir\n \n # Delete resources from all files that end with '.json'\n ksail workload delete -f '*.json'\n \n # Delete a pod based on the type and name in the JSON passed into stdin\n cat pod.json | ksail workload delete -f -\n \n # Delete pods and services with same names \"baz\" and \"foo\"\n ksail workload delete pod,service baz foo\n \n # Delete pods and services with label name=myLabel\n ksail workload delete pods,services -l name=myLabel\n \n # Delete a pod with minimal delay\n ksail workload delete pod foo --now\n \n # Force delete a pod on a dead node\n ksail workload delete pod foo --force\n \n # Delete all pods\n ksail workload delete pods --all\n \n # Delete all pods only if the user confirms the deletion\n ksail workload delete pods --all --interactive\n\nFlags:\n --all Delete all resources, in the namespace of the specified resource types.\n -A, --all-namespaces If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --cascade string[=\"background\"] Must be \"background\", \"orphan\", or \"foreground\". Selects the deletion cascading strategy for the dependents (e.g. Pods created by a ReplicationController). Defaults to background. (default \"background\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-selector string Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.\n -f, --filename strings containing the resource to delete.\n --force If true, immediately remove resources from API and bypass graceful deletion. Note that immediate deletion of some resources may result in inconsistency or data loss and requires confirmation.\n --grace-period int Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. Set to 1 for immediate shutdown. Can only be set to 0 when --force is true (force deletion). (default -1)\n --ignore-not-found Treat \"resource not found\" as a successful delete. Defaults to \"true\" when --all is specified.\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n -i, --interactive If true, delete resource only when user confirms.\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process a kustomization directory. This flag can't be used together with -f or -R.\n -n, --namespace string If present, the namespace scope for this CLI request\n --now If true, resources are signaled for immediate shutdown (same as --grace-period=1).\n -o, --output string Output mode. Use \"-o name\" for shorter output (resource/name).\n --raw string Raw URI to DELETE to the server. Uses the transport specified by the kubeconfig file.\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --timeout duration The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n --wait If true, wait for resources to be gone before returning. This waits for finalizers. (default true)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Describe\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nShow details of a specific resource or group of resources, including metadata, status conditions, events, and container info. Useful for diagnosing why a resource is not ready — check the Events and Conditions sections. For Flux resources (kustomization, helmrelease), shows reconciliation status and last error. For ArgoCD resources (application), shows sync status and health.\n\nUsage:\n ksail workload describe\n\nExamples:\n # Describe a node\n ksail workload describe nodes kubernetes-node-emt8.c.myproject.internal\n \n # Describe a pod\n ksail workload describe pods/nginx\n \n # Describe a pod identified by type and name in \"pod.json\"\n ksail workload describe -f pod.json\n \n # Describe all pods\n ksail workload describe pods\n \n # Describe pods by label name=myLabel\n ksail workload describe pods -l name=myLabel\n \n # Describe all pods managed by the 'frontend' replication controller\n # (rc-created pods get the name of the rc as a prefix in the pod name)\n ksail workload describe pods frontend\n\nFlags:\n -A, --all-namespaces If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --chunk-size int Return large lists in chunks rather than all at once. Pass 0 to disable. (default 500)\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n -f, --filename strings Filename, directory, or URL to files containing the resource to describe\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -n, --namespace string If present, the namespace scope for this CLI request\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --show-events If true, display events related to the described object. Defaults to true for a single object, false for multiple objects and prefix matching. (default true)\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Edit\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nEdit a Kubernetes resource from the default editor.\n\nThe editor is determined by (in order of precedence):\n 1. --editor flag\n 2. spec.editor from ksail.yaml config\n 3. KUBE_EDITOR, EDITOR, or VISUAL environment variables\n 4. Fallback to vim, nano, or vi\n\nExample:\n ksail workload edit deployment/my-deployment\n ksail workload edit --editor \"code --wait\" deployment/my-deployment\n\nUsage:\n ksail workload edit [flags]\n\nFlags:\n --editor string editor command to use (e.g., 'code --wait', 'vim', 'nano')\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Exec\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nExecute a command in a container in a pod.\n\nUsage:\n ksail workload exec\n\nExamples:\n # Get output from running the 'date' command from pod mypod, using the first container by default\n ksail workload exec mypod -- date\n \n # Get output from running the 'date' command in ruby-container from pod mypod\n ksail workload exec mypod -c ruby-container -- date\n \n # Switch to raw terminal mode; sends stdin to 'bash' in ruby-container from pod mypod\n # and sends stdout/stderr from 'bash' back to the client\n ksail workload exec mypod -c ruby-container -i -t -- bash -il\n \n # List contents of /usr from the first container of pod mypod and sort by modification time\n # If the command you want to execute in the pod has any flags in common (e.g. -i),\n # you must use two dashes (--) to separate your command's flags/arguments\n # Also note, do not surround your command and its flags/arguments with quotes\n # unless that is how you would execute it normally (i.e., do ls -t /usr, not \"ls -t /usr\")\n ksail workload exec mypod -i -t -- ls -t /usr\n \n # Get output from running 'date' command from the first pod of the deployment mydeployment, using the first container by default\n ksail workload exec deploy/mydeployment -- date\n \n # Get output from running 'date' command from the first pod of the service myservice, using the first container by default\n ksail workload exec svc/myservice -- date\n\nFlags:\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n -c, --container string Container name. If omitted, use the kubectl.kubernetes.io/default-container annotation for selecting the container to be attached or the first container in the pod will be chosen\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n -f, --filename strings to use to exec into the resource\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -n, --namespace string If present, the namespace scope for this CLI request\n --pod-running-timeout duration The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running (default 1m0s)\n -q, --quiet Only print output from the remote session\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -s, --server string The address and port of the Kubernetes API server\n -i, --stdin Pass stdin to the container\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n -t, --tty Stdin is a TTY\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Explain\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nGet documentation for Kubernetes resources, including field descriptions and structure.\n\nUsage:\n ksail workload explain\n\nExamples:\n # Get the documentation of the resource and its fields\n ksail workload explain pods\n \n # Get all the fields in the resource\n ksail workload explain pods --recursive\n \n # Get the explanation for deployment in supported api versions\n ksail workload explain deployments --api-version=apps/v1\n \n # Get the documentation of a specific field of a resource\n ksail workload explain pods.spec.containers\n \n # Get the documentation of resources in different format\n ksail workload explain deployment --output=plaintext-openapiv2\n\nFlags:\n --api-version string Get different explanations for particular API version (API group/version)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -n, --namespace string If present, the namespace scope for this CLI request\n -o, --output string Format in which to render the schema (plaintext, plaintext-openapiv2) (default \"plaintext\")\n -R, --recursive Print the fields of fields (Currently only 1 level deep)\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -s, --server string The address and port of the Kubernetes API server\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Export\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nExport container images from the cluster's containerd runtime to a tar archive.\n\nThe exported archive can be used to:\n - Share image sets between development machines\n - Pre-load images for offline development\n - Speed up cluster recreation by avoiding registry pulls\n\nExamples:\n # Export all images from cluster to images.tar (default)\n ksail workload export\n\n # Export all images to a specific file\n ksail workload export ./backups/my-images.tar\n\n # Export specific images from cluster\n ksail workload export --image=nginx:latest --image=redis:7\n\n # Export from a specific kubeconfig context\n ksail workload export --context=kind-dev --kubeconfig=~/.kube/config\n\nUsage:\n ksail workload export [] [flags]\n\nFlags:\n -c, --context string Kubernetes context of cluster\n --image stringArray Image(s) to export (repeatable); if not specified, all images are exported\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Expose\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nExpose a resource as a new Kubernetes service.\n\nUsage:\n ksail workload expose\n\nExamples:\n # Create a service for a replicated nginx, which serves on port 80 and connects to the containers on port 8000\n ksail workload expose rc nginx --port=80 --target-port=8000\n \n # Create a service for a replication controller identified by type and name specified in \"nginx-controller.yaml\", which serves on port 80 and connects to the containers on port 8000\n ksail workload expose -f nginx-controller.yaml --port=80 --target-port=8000\n \n # Create a service for a pod valid-pod, which serves on port 444 with the name \"frontend\"\n ksail workload expose pod valid-pod --port=444 --name=frontend\n \n # Create a second service based on the above service, exposing the container port 8443 as port 443 with the name \"nginx-https\"\n ksail workload expose service nginx --port=443 --target-port=8443 --name=nginx-https\n \n # Create a service for a replicated streaming application on port 4100 balancing UDP traffic and named 'video-stream'.\n ksail workload expose rc streamer --port=4100 --protocol=UDP --name=video-stream\n \n # Create a service for a replicated nginx using replica set, which serves on port 80 and connects to the containers on port 8000\n ksail workload expose rs nginx --port=80 --target-port=8000\n \n # Create a service for an nginx deployment, which serves on port 80 and connects to the containers on port 8000\n ksail workload expose deployment nginx --port=80 --target-port=8000\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --cluster-ip string ClusterIP to be assigned to the service. Leave empty to auto-allocate, or set to 'None' to create a headless service.\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --external-ip string Additional external IP address (not managed by Kubernetes) to accept for the service. If this IP is routed to a node, the service can be accessed by this IP in addition to its generated service IP.\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-expose\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to expose a service\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -l, --labels string Labels to apply to the service created by this call.\n --load-balancer-ip string IP to assign to the LoadBalancer. If empty, an ephemeral IP will be created and used (cloud-provider specific).\n --name string The name for the newly created object.\n -n, --namespace string If present, the namespace scope for this CLI request\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --override-type string The method used to override the generated object: json, merge, or strategic. (default \"merge\")\n --overrides string An inline JSON override for the generated object. If this is non-empty, it is used to override the generated object. Requires that the object supply a valid apiVersion field.\n --port string The port that the service should serve on. Copied from the resource being exposed, if unspecified\n --protocol string The network protocol for the service to be created. Default is 'TCP'.\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --selector string A label selector to use for this service. Only equality-based selector requirements are supported. If empty (the default) infer the selector from the resource being exposed.\n -s, --server string The address and port of the Kubernetes API server\n --session-affinity string If non-empty, set the session affinity for the service to this; legal values: 'None', 'ClientIP'\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --target-port string Name or number for the port on the container that the service should direct traffic to. Optional.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --type string Type for this service: ClusterIP, NodePort, LoadBalancer, or ExternalName. Default is 'ClusterIP'.\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Forward\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nForward one or more local ports to a pod.\n\nUse resource type/name such as deployment/mydeployment to select a pod. Resource type defaults to 'pod' if omitted.\n\nIf there are multiple pods matching the criteria, a pod will be selected automatically. The forwarding session ends when the selected pod terminates, and a rerun of the command is needed to resume forwarding.\n\nUsage:\n ksail workload forward\n\nExamples:\n # Listen on ports 5000 and 6000 locally, forwarding data to/from ports 5000 and 6000 in the pod\n ksail workload forward pod/mypod 5000 6000\n \n # Listen on ports 5000 and 6000 locally, forwarding data to/from ports 5000 and 6000 in a pod selected by the deployment\n ksail workload forward deployment/mydeployment 5000 6000\n \n # Listen on port 8443 locally, forwarding to the targetPort of the service's port named \"https\" in a pod selected by the service\n ksail workload forward service/myservice 8443:https\n \n # Listen on port 8888 locally, forwarding to 5000 in the pod\n ksail workload forward pod/mypod 8888:5000\n \n # Listen on port 8888 on all addresses, forwarding to 5000 in the pod\n ksail workload forward --address 0.0.0.0 pod/mypod 8888:5000\n \n # Listen on port 8888 on localhost and selected IP, forwarding to 5000 in the pod\n ksail workload forward --address localhost,10.19.21.23 pod/mypod 8888:5000\n \n # Listen on a random port locally, forwarding to 5000 in the pod\n ksail workload forward pod/mypod :5000\n\nFlags:\n --address strings Addresses to listen on (comma separated). Only accepts IP addresses or localhost as a value. When localhost is supplied, kubectl will try to bind on both 127.0.0.1 and ::1 and will fail if neither of these addresses are available to bind. (default [localhost])\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -n, --namespace string If present, the namespace scope for this CLI request\n --pod-running-timeout duration The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running (default 1m0s)\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -s, --server string The address and port of the Kubernetes API server\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Clusterrole\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cluster role.\n\nUsage:\n ksail workload gen clusterrole NAME --verb=verb --resource=resource.group [--resource-name=resourcename] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a cluster role named \"pod-reader\" that allows user to perform \"get\", \"watch\" and \"list\" on pods\n kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods\n \n # Create a cluster role named \"pod-reader\" with ResourceName specified\n kubectl create clusterrole pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod\n \n # Create a cluster role named \"foo\" with API Group specified\n kubectl create clusterrole foo --verb=get,list,watch --resource=rs.apps\n \n # Create a cluster role named \"foo\" with SubResource specified\n kubectl create clusterrole foo --verb=get,list,watch --resource=pods,pods/status\n \n # Create a cluster role name \"foo\" with NonResourceURL specified\n kubectl create clusterrole \"foo\" --verb=get --non-resource-url=/logs/*\n \n # Create a cluster role name \"monitoring\" with AggregationRule specified\n kubectl create clusterrole monitoring --aggregation-rule=\"rbac.example.com/aggregate-to-monitoring=true\"\n\nFlags:\n --aggregation-rule mapStringString An aggregation label selector for combining ClusterRoles.\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --non-resource-url strings A partial url that user should have access to.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --resource strings Resource that the rule applies to\n --resource-name stringArray Resource in the white list that the rule applies to, repeat this flag for multiple items\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --verb strings Verb that applies to the resources contained in the rule\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Clusterrolebinding\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cluster role binding for a particular cluster role.\n\nUsage:\n ksail workload gen clusterrolebinding NAME --clusterrole=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a cluster role binding for user1, user2, and group1 using the cluster-admin cluster role\n kubectl create clusterrolebinding cluster-admin --clusterrole=cluster-admin --user=user1 --user=user2 --group=group1\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterrole string ClusterRole this ClusterRoleBinding should reference\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --group stringArray Groups to bind to the clusterrole. The flag can be repeated to add multiple groups.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --serviceaccount stringArray Service accounts to bind to the clusterrole, in the format :. The flag can be repeated to add multiple service accounts.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --user stringArray Usernames to bind to the clusterrole. The flag can be repeated to add multiple users.\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Configmap\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a config map based on a file, directory, or specified literal value.\n\n A single config map may package one or more key/value pairs.\n\n When creating a config map based on a file, the key will default to the basename of the file, and the value will default to the file content. If the basename is an invalid key, you may specify an alternate key.\n\n When creating a config map based on a directory, each file whose basename is a valid key in the directory will be packaged into the config map. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).\n\nUsage:\n ksail workload gen configmap NAME [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none] [flags]\n\nAliases:\n configmap, cm\n\nExamples:\n # Create a new config map named my-config based on folder bar\n kubectl create configmap my-config --from-file=path/to/bar\n \n # Create a new config map named my-config with specified keys instead of file basenames on disk\n kubectl create configmap my-config --from-file=key1=/path/to/bar/file1.txt --from-file=key2=/path/to/bar/file2.txt\n \n # Create a new config map named my-config with key1=config1 and key2=config2\n kubectl create configmap my-config --from-literal=key1=config1 --from-literal=key2=config2\n \n # Create a new config map named my-config with key=value pairs from an env file\n kubectl create configmap my-config --from-env-file=path/to/bar.env\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the configmap to its name.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-env-file strings Specify the path to a file to read lines of key=val pairs to create a configmap.\n --from-file strings Key file can be specified using its file path, in which case file basename will be used as configmap key, or optionally with a key and file path, in which case the given key will be used. Specifying a directory will iterate each named file in the directory whose basename is a valid configmap key.\n --from-literal stringArray Specify a key and literal value to insert in configmap (i.e. mykey=somevalue)\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Cronjob\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cron job with the specified name.\n\nUsage:\n ksail workload gen cronjob NAME --image=image --schedule='0/5 * * * ?' -- [COMMAND] [args...] [flags]\n\nAliases:\n cronjob, cj\n\nExamples:\n # Create a cron job\n kubectl create cronjob my-job --image=busybox --schedule=\"*/1 * * * *\"\n \n # Create a cron job with a command\n kubectl create cronjob my-job --image=busybox --schedule=\"*/1 * * * *\" -- date\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --image string Image name to run.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --restart string job's restart policy. supported values: OnFailure, Never\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --schedule string A schedule in the Cron format the job should be run with.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Deployment\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a deployment with the specified name.\n\nUsage:\n ksail workload gen deployment NAME --image=image -- [COMMAND] [args...] [flags]\n\nAliases:\n deployment, deploy\n\nExamples:\n # Create a deployment named my-dep that runs the busybox image\n kubectl create deployment my-dep --image=busybox\n \n # Create a deployment with a command\n kubectl create deployment my-dep --image=busybox -- date\n \n # Create a deployment named my-dep that runs the nginx image with 3 replicas\n kubectl create deployment my-dep --image=nginx --replicas=3\n \n # Create a deployment named my-dep that runs the busybox image and expose port 5701\n kubectl create deployment my-dep --image=busybox --port=5701\n \n # Create a deployment named my-dep that runs multiple containers\n kubectl create deployment my-dep --image=busybox:latest --image=ubuntu:latest --image=nginx\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --image strings Image names to run. A deployment can have multiple images set for multi-container pod.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --port int32 The containerPort that this deployment exposes. (default -1)\n -r, --replicas int32 Number of replicas to create. Default is 1. (default 1)\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Helmrelease\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nGenerate a HelmRelease resource for a given HelmRepository, GitRepository, Bucket, or chart reference source.\n\nUsage:\n ksail workload gen helmrelease [NAME] [flags]\n\nAliases:\n helmrelease, hr\n\nExamples:\n # Generate a HelmRelease with a chart from a HelmRepository source\n ksail workload gen helmrelease podinfo \\\n --interval=10m \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --chart-version=\">4.0.0\" \\\n --export\n\n # Generate a HelmRelease with a chart from a GitRepository source\n ksail workload gen helmrelease podinfo \\\n --interval=10m \\\n --source=GitRepository/podinfo \\\n --chart=./charts/podinfo \\\n --export\n\n # Generate a HelmRelease with values from local YAML files\n ksail workload gen helmrelease podinfo \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --values=./my-values1.yaml \\\n --values=./my-values2.yaml \\\n --export\n\n # Generate a HelmRelease with values from a Kubernetes secret\n ksail workload gen helmrelease podinfo \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --values-from=Secret/my-secret-values \\\n --export\n\n # Generate a HelmRelease with a custom release name\n ksail workload gen helmrelease podinfo \\\n --release-name=podinfo-dev \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --export\n\n # Generate a HelmRelease targeting another namespace\n ksail workload gen helmrelease podinfo \\\n --target-namespace=test \\\n --create-target-namespace=true \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --export\n\n # Generate a HelmRelease using a chart reference\n ksail workload gen helmrelease podinfo \\\n --namespace=default \\\n --chart-ref=HelmChart/podinfo.flux-system \\\n --export\n\nFlags:\n --chart string Helm chart name or path\n --chart-ref string Helm chart reference (HelmChart/name, OCIRepository/name)\n --chart-version string Helm chart version, accepts a semver range\n --crds string CRDs policy (Create, CreateReplace, Skip)\n --create-target-namespace create the target namespace if not present\n --depends-on strings HelmReleases that must be ready before this release\n --export export in YAML format to stdout\n --interval duration reconciliation interval (default 1m0s)\n --kubeconfig-secret-ref string KubeConfig secret reference for remote reconciliation\n -n, --namespace string namespace scope for the HelmRelease (default \"default\")\n --release-name string name used for the Helm release\n --service-account string service account name to impersonate\n --source string source that contains the chart (HelmRepository/name, GitRepository/name, Bucket/name)\n --storage-namespace string namespace for Helm storage\n --target-namespace string namespace to target when performing operations\n --timeout duration timeout for any individual Kubernetes operation (default 5m0s)\n --values strings local values YAML files\n --values-from strings values from ConfigMap or Secret\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Ingress\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate an ingress with the specified name.\n\nUsage:\n ksail workload gen ingress NAME --rule=host/path=service:port[,tls[=secret]] [flags]\n\nAliases:\n ingress, ing\n\nExamples:\n # Create a single ingress called 'simple' that directs requests to foo.com/bar to svc\n # svc1:8080 with a TLS secret \"my-cert\"\n kubectl create ingress simple --rule=\"foo.com/bar=svc1:8080,tls=my-cert\"\n \n # Create a catch all ingress of \"/path\" pointing to service svc:port and Ingress Class as \"otheringress\"\n kubectl create ingress catch-all --class=otheringress --rule=\"/path=svc:port\"\n \n # Create an ingress with two annotations: ingress.annotation1 and ingress.annotations2\n kubectl create ingress annotated --class=default --rule=\"foo.com/bar=svc:port\" \\\n --annotation ingress.annotation1=foo \\\n --annotation ingress.annotation2=bla\n \n # Create an ingress with the same host and multiple paths\n kubectl create ingress multipath --class=default \\\n --rule=\"foo.com/=svc:port\" \\\n --rule=\"foo.com/admin/=svcadmin:portadmin\"\n \n # Create an ingress with multiple hosts and the pathType as Prefix\n kubectl create ingress ingress1 --class=default \\\n --rule=\"foo.com/path*=svc:8080\" \\\n --rule=\"bar.com/admin*=svc2:http\"\n \n # Create an ingress with TLS enabled using the default ingress certificate and different path types\n kubectl create ingress ingtls --class=default \\\n --rule=\"foo.com/=svc:https,tls\" \\\n --rule=\"foo.com/path/subpath*=othersvc:8080\"\n \n # Create an ingress with TLS enabled using a specific secret and pathType as Prefix\n kubectl create ingress ingsecret --class=default \\\n --rule=\"foo.com/*=svc:8080,tls=secret1\"\n \n # Create an ingress with a default backend\n kubectl create ingress ingdefault --class=default \\\n --default-backend=defaultsvc:http \\\n --rule=\"foo.com/*=svc:8080,tls=secret1\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --annotation stringArray Annotation to insert in the ingress object, in the format annotation=value\n --class string Ingress Class to be used\n --default-backend string Default service for backend, in format of svcname:port\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --rule stringArray Rule in format host/path=service:port[,tls=secretname]. Paths containing the leading character '*' are considered pathType=Prefix. tls argument is optional.\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Job\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a job with the specified name.\n\nUsage:\n ksail workload gen job NAME --image=image [--from=cronjob/name] -- [COMMAND] [args...] [flags]\n\nExamples:\n # Create a job\n kubectl create job my-job --image=busybox\n \n # Create a job with a command\n kubectl create job my-job --image=busybox -- date\n \n # Create a job from a cron job named \"a-cronjob\"\n kubectl create job test-job --from=cronjob/a-cronjob\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from string The name of the resource to create a Job from (only CronJob is supported).\n --image string Image name to run.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Namespace\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a namespace with the specified name.\n\nUsage:\n ksail workload gen namespace NAME [--dry-run=server|client|none] [flags]\n\nAliases:\n namespace, ns\n\nExamples:\n # Create a new namespace named my-namespace\n kubectl create namespace my-namespace\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Poddisruptionbudget\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a pod disruption budget with the specified name, selector, and desired minimum available pods.\n\nUsage:\n ksail workload gen poddisruptionbudget NAME --selector=SELECTOR --min-available=N [--dry-run=server|client|none] [flags]\n\nAliases:\n poddisruptionbudget, pdb\n\nExamples:\n # Create a pod disruption budget named my-pdb that will select all pods with the app=rails label\n # and require at least one of them being available at any point in time\n kubectl create poddisruptionbudget my-pdb --selector=app=rails --min-available=1\n \n # Create a pod disruption budget named my-pdb that will select all pods with the app=nginx label\n # and require at least half of the pods selected to be available at any point in time\n kubectl create pdb my-pdb --selector=app=nginx --min-available=50%\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --max-unavailable string The maximum number or percentage of unavailable pods this budget requires.\n --min-available string The minimum number or percentage of available pods this budget requires.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --selector string A label selector to use for this budget. Only equality-based selector requirements are supported.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Priorityclass\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a priority class with the specified name, value, globalDefault and description.\n\nUsage:\n ksail workload gen priorityclass NAME --value=VALUE --global-default=BOOL [--dry-run=server|client|none] [flags]\n\nAliases:\n priorityclass, pc\n\nExamples:\n # Create a priority class named high-priority\n kubectl create priorityclass high-priority --value=1000 --description=\"high priority\"\n \n # Create a priority class named default-priority that is considered as the global default priority\n kubectl create priorityclass default-priority --value=1000 --global-default=true --description=\"default priority\"\n \n # Create a priority class named high-priority that cannot preempt pods with lower priority\n kubectl create priorityclass high-priority --value=1000 --description=\"high priority\" --preemption-policy=\"Never\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --description string description is an arbitrary string that usually provides guidelines on when this priority class should be used.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --global-default global-default specifies whether this PriorityClass should be considered as the default priority.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --preemption-policy string preemption-policy is the policy for preempting pods with lower priority. (default \"PreemptLowerPriority\")\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --value int32 the value of this priority class.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Quota\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a resource quota with the specified name, hard limits, and optional scopes.\n\nUsage:\n ksail workload gen quota NAME [--hard=key1=value1,key2=value2] [--scopes=Scope1,Scope2] [--dry-run=server|client|none] [flags]\n\nAliases:\n quota, resourcequota\n\nExamples:\n # Create a new resource quota named my-quota\n kubectl create quota my-quota --hard=cpu=1,memory=1G,pods=2,services=3,replicationcontrollers=2,resourcequotas=1,secrets=5,persistentvolumeclaims=10\n \n # Create a new resource quota named best-effort\n kubectl create quota best-effort --hard=pods=100 --scopes=BestEffort\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --hard string A comma-delimited set of resource=quantity pairs that define a hard limit.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --scopes string A comma-delimited set of quota scopes that must all match each object tracked by the quota.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Role\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a role with single rule.\n\nUsage:\n ksail workload gen role NAME --verb=verb --resource=resource.group/subresource [--resource-name=resourcename] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a role named \"pod-reader\" that allows user to perform \"get\", \"watch\" and \"list\" on pods\n kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods\n \n # Create a role named \"pod-reader\" with ResourceName specified\n kubectl create role pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod\n \n # Create a role named \"foo\" with API Group specified\n kubectl create role foo --verb=get,list,watch --resource=rs.apps\n \n # Create a role named \"foo\" with SubResource specified\n kubectl create role foo --verb=get,list,watch --resource=pods,pods/status\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --resource strings Resource that the rule applies to\n --resource-name stringArray Resource in the white list that the rule applies to, repeat this flag for multiple items\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --verb strings Verb that applies to the resources contained in the rule\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Rolebinding\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a role binding for a particular role or cluster role.\n\nUsage:\n ksail workload gen rolebinding NAME --clusterrole=NAME|--role=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a role binding for user1, user2, and group1 using the admin cluster role\n kubectl create rolebinding admin --clusterrole=admin --user=user1 --user=user2 --group=group1\n \n # Create a role binding for service account monitoring:sa-dev using the admin role\n kubectl create rolebinding admin-binding --role=admin --serviceaccount=monitoring:sa-dev\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterrole string ClusterRole this RoleBinding should reference\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --group stringArray Groups to bind to the role. The flag can be repeated to add multiple groups.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --role string Role this RoleBinding should reference\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --serviceaccount stringArray Service accounts to bind to the role, in the format :. The flag can be repeated to add multiple service accounts.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --user stringArray Usernames to bind to the role. The flag can be repeated to add multiple users.\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nGenerate Kubernetes resource manifests using kubectl create with --dry-run=client -o yaml. The generated YAML is printed to stdout and can be redirected to a file using shell redirection (> file.yaml).\n\nUsage:\n ksail workload gen [flags]\n ksail workload gen [command]\n\nAvailable Commands:\n clusterrole Create a cluster role\n clusterrolebinding Create a cluster role binding for a particular cluster role\n configmap Create a config map from a local file, directory or literal value\n cronjob Create a cron job with the specified name\n deployment Create a deployment with the specified name\n helmrelease Generate a HelmRelease resource\n ingress Create an ingress with the specified name\n job Create a job with the specified name\n namespace Create a namespace with the specified name\n poddisruptionbudget Create a pod disruption budget with the specified name\n priorityclass Create a priority class with the specified name\n quota Create a quota with the specified name\n role Create a role with single rule\n rolebinding Create a role binding for a particular role or cluster role\n secret Create a secret using a specified subcommand\n service Create a service using a specified subcommand\n serviceaccount Create a service account with the specified name\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload gen [command] --help\" for more information about a command.\n\n```\n\n### Workload Gen Secret Docker Registry\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a new secret for use with Docker registries.\n \n Dockercfg secrets are used to authenticate against Docker registries.\n \n When using the Docker command line to push images, you can authenticate to a given registry by running:\n '$ docker login DOCKER_REGISTRY_SERVER --username=DOCKER_USER --password=DOCKER_PASSWORD --email=DOCKER_EMAIL'.\n \n That produces a ~/.dockercfg file that is used by subsequent 'docker push' and 'docker pull' commands to authenticate to the registry. The email address is optional.\n\n When creating applications, you may have a Docker registry that requires authentication. In order for the\n nodes to pull images on your behalf, they must have the credentials. You can provide this information\n by creating a dockercfg secret and attaching it to your service account.\n\nUsage:\n ksail workload gen secret docker-registry NAME --docker-username=user --docker-password=password --docker-email=email [--docker-server=string] [--from-file=[key=]source] [--dry-run=server|client|none] [flags]\n\nExamples:\n # If you do not already have a .dockercfg file, create a dockercfg secret directly\n kubectl create secret docker-registry my-secret --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER --docker-password=DOCKER_PASSWORD --docker-email=DOCKER_EMAIL\n \n # Create a new secret named my-secret from ~/.docker/config.json\n kubectl create secret docker-registry my-secret --from-file=path/to/.docker/config.json\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --docker-email string Email for Docker registry\n --docker-password string Password for Docker registry authentication\n --docker-server string Server location for Docker registry (default \"https://index.docker.io/v1/\")\n --docker-username string Username for Docker registry authentication\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-file strings Key files can be specified using their file path, in which case a default name of .dockerconfigjson will be given to them, or optionally with a name and file path, in which case the given name will be used. Specifying a directory will iterate each named file in the directory that is a valid secret key. For this command, the key should always be .dockerconfigjson.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Secret Generic\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a secret based on a file, directory, or specified literal value.\n\n A single secret may package one or more key/value pairs.\n\n When creating a secret based on a file, the key will default to the basename of the file, and the value will default to the file content. If the basename is an invalid key or you wish to chose your own, you may specify an alternate key.\n\n When creating a secret based on a directory, each file whose basename is a valid key in the directory will be packaged into the secret. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).\n\nUsage:\n ksail workload gen secret generic NAME [--type=string] [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new secret named my-secret with keys for each file in folder bar\n kubectl create secret generic my-secret --from-file=path/to/bar\n \n # Create a new secret named my-secret with specified keys instead of names on disk\n kubectl create secret generic my-secret --from-file=ssh-privatekey=path/to/id_rsa --from-file=ssh-publickey=path/to/id_rsa.pub\n \n # Create a new secret named my-secret with key1=supersecret and key2=topsecret\n kubectl create secret generic my-secret --from-literal=key1=supersecret --from-literal=key2=topsecret\n \n # Create a new secret named my-secret using a combination of a file and a literal\n kubectl create secret generic my-secret --from-file=ssh-privatekey=path/to/id_rsa --from-literal=passphrase=topsecret\n \n # Create a new secret named my-secret from env files\n kubectl create secret generic my-secret --from-env-file=path/to/foo.env --from-env-file=path/to/bar.env\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-env-file strings Specify the path to a file to read lines of key=val pairs to create a secret.\n --from-file strings Key files can be specified using their file path, in which case a default name will be given to them, or optionally with a name and file path, in which case the given name will be used. Specifying a directory will iterate each named file in the directory that is a valid secret key.\n --from-literal stringArray Specify a key and literal value to insert in secret (i.e. mykey=somevalue)\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --type string The type of secret to create\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Secret Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a secret with specified type.\n\n A docker-registry type secret is for accessing a container registry.\n\n A generic type secret indicate an Opaque secret type.\n\n A tls type secret holds TLS certificate and its associated key.\n\nUsage:\n ksail workload gen secret [command]\n\nAvailable Commands:\n docker-registry Create a secret for use with a Docker registry\n generic Create a secret from a local file, directory, or literal value\n tls Create a TLS secret\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload gen secret [command] --help\" for more information about a command.\n\n```\n\n### Workload Gen Secret Tls\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a TLS secret from the given public/private key pair.\n\n The public/private key pair must exist beforehand. The public key certificate must be .PEM encoded and match the given private key.\n\nUsage:\n ksail workload gen secret tls NAME --cert=path/to/cert/file --key=path/to/key/file [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new TLS secret named tls-secret with the given key pair\n kubectl create secret tls tls-secret --cert=path/to/tls.crt --key=path/to/tls.key\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --cert string Path to PEM encoded public key certificate.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --key string Path to private key associated with given certificate.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Service Clusterip\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a ClusterIP service with the specified name.\n\nUsage:\n ksail workload gen service clusterip NAME [--tcp=:] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new ClusterIP service named my-cs\n kubectl create service clusterip my-cs --tcp=5678:8080\n \n # Create a new ClusterIP service named my-cs (in headless mode)\n kubectl create service clusterip my-cs --clusterip=\"None\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterip string Assign your own ClusterIP or set to 'None' for a 'headless' service (no loadbalancing).\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Service Externalname\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate an ExternalName service with the specified name.\n\n ExternalName service references to an external DNS address instead of only pods, which will allow application authors to reference services that exist off platform, on other clusters, or locally.\n\nUsage:\n ksail workload gen service externalname NAME --external-name external.name [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new ExternalName service named my-ns\n kubectl create service externalname my-ns --external-name bar.com\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --external-name string External name of service\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Service Loadbalancer\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a LoadBalancer service with the specified name.\n\nUsage:\n ksail workload gen service loadbalancer NAME [--tcp=port:targetPort] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new LoadBalancer service named my-lbs\n kubectl create service loadbalancer my-lbs --tcp=5678:8080\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Service Nodeport\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a NodePort service with the specified name.\n\nUsage:\n ksail workload gen service nodeport NAME [--tcp=port:targetPort] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new NodePort service named my-ns\n kubectl create service nodeport my-ns --tcp=5678:8080\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --node-port int Port used to expose the service on each node in a cluster.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Service Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a service using a specified subcommand.\n\nUsage:\n ksail workload gen service [command]\n\nAliases:\n service, svc\n\nAvailable Commands:\n clusterip Create a ClusterIP service\n externalname Create an ExternalName service\n loadbalancer Create a LoadBalancer service\n nodeport Create a NodePort service\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload gen service [command] --help\" for more information about a command.\n\n```\n\n### Workload Gen Serviceaccount\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a service account with the specified name.\n\nUsage:\n ksail workload gen serviceaccount NAME [--dry-run=server|client|none] [flags]\n\nAliases:\n serviceaccount, sa\n\nExamples:\n # Create a new service account named my-service-account\n kubectl create serviceaccount my-service-account\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Get\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDisplay one or many Kubernetes resources from your cluster. Use -o json for structured output that includes status conditions and health. Use -o wide for additional columns. Use --all-namespaces or -A to query across all namespaces. Supports comma-separated resource types (e.g. deployments,services). For GitOps diagnostics, query Flux resources (kustomization, helmrelease, gitrepository, ocirepository) or ArgoCD resources (application) to check reconciliation status and errors.\n\nUsage:\n ksail workload get\n\nExamples:\n # List all pods in ps output format\n ksail workload get pods\n \n # List all pods in ps output format with more information (such as node name)\n ksail workload get pods -o wide\n \n # List a single replication controller with specified NAME in ps output format\n ksail workload get replicationcontroller web\n \n # List deployments in JSON output format, in the \"v1\" version of the \"apps\" API group\n ksail workload get deployments.v1.apps -o json\n \n # List a single pod in JSON output format\n ksail workload get -o json pod web-pod-13je7\n \n # List a pod identified by type and name specified in \"pod.yaml\" in JSON output format\n ksail workload get -f pod.yaml -o json\n \n # List resources from a directory with kustomization.yaml - e.g. dir/kustomization.yaml\n ksail workload get -k dir/\n \n # Return only the phase value of the specified pod\n ksail workload get -o template pod/web-pod-13je7 --template={{.status.phase}}\n \n # List resource information in custom columns\n ksail workload get pod test-pod -o custom-columns=CONTAINER:.spec.containers[0].name,IMAGE:.spec.containers[0].image\n \n # List all replication controllers and services together in ps output format\n ksail workload get rc,services\n \n # List one or more resources by their type and names\n ksail workload get rc/web service/frontend pods/web-pod-13je7\n \n # List the 'status' subresource for a single pod\n ksail workload get pod web-pod-13je7 --subresource status\n \n # List all deployments in namespace 'backend'\n ksail workload get deployments.apps --namespace backend\n \n # List all pods existing in all namespaces\n ksail workload get pods --all-namespaces\n\nFlags:\n -A, --all-namespaces If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --chunk-size int Return large lists in chunks rather than all at once. Pass 0 to disable. (default 500)\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --field-selector string Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n --ignore-not-found If set to true, suppresses NotFound error for specific objects that do not exist. Using this flag with commands that query for collections of resources has no effect when no resources are found.\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -L, --label-columns strings Accepts a comma separated list of labels that are going to be presented as columns. Names are case-sensitive. You can also use multiple flag options like -L label1 -L label2...\n -n, --namespace string If present, the namespace scope for this CLI request\n --no-headers When using the default or custom-column output format, don't print headers (default print headers).\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file, custom-columns, custom-columns-file, wide). See custom columns [https://kubernetes.io/docs/reference/kubectl/#custom-columns], golang template [http://golang.org/pkg/text/template/#pkg-overview] and jsonpath template [https://kubernetes.io/docs/reference/kubectl/jsonpath/].\n --output-watch-events Output watch event objects when --watch or --watch-only is used. Existing objects are output as initial ADDED events.\n --raw string Raw URI to request from the server. Uses the transport specified by the kubeconfig file.\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --server-print If true, have the server return the appropriate table output. Supports extension APIs and CRDs. (default true)\n --show-kind If present, list the resource type for the requested object(s).\n --show-labels When printing, show all labels as the last column (default hide labels column)\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --sort-by string If non-empty, sort list types using this field specification. The field specification is expressed as a JSONPath expression (e.g. '{.metadata.name}'). The field in the API resource specified by this JSONPath expression must be an integer or a string.\n --subresource string If specified, gets the subresource of the requested object.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n -w, --watch After listing/getting the requested object, watch for changes.\n --watch-only Watch for changes to the requested object(s), without listing/getting first.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Images\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nList container images required by the configured cluster components.\n\nThe image list is derived from the ksail.yaml configuration and includes\nimages for all enabled components (GitOps engine, CNI, policy engine, etc.).\n\nThis command is useful for:\n - Pre-pulling images before cluster creation\n - Creating offline image archives\n - Understanding infrastructure image requirements\n - CI/CD caching strategies\n\nOutput formats:\n - plain: One image per line (default, suitable for scripting)\n - json: JSON array of image strings\n\nExamples:\n # List all images for current ksail.yaml config\n ksail workload images\n\n # List images as JSON array\n ksail workload images --output=json\n\n # Pipe to docker pull\n ksail workload images | xargs -n1 docker pull\n\n # Save to file for CI caching\n ksail workload images > required-images.txt\n\nUsage:\n ksail workload images [flags]\n\nFlags:\n --cert-manager CertManager Cert-Manager configuration (Enabled: install, Disabled: skip)\n --cni CNI Container Network Interface (CNI) to use\n --csi CSI Container Storage Interface (Default: use distribution, Enabled: install CSI, Disabled: skip CSI)\n -d, --distribution Distribution Kubernetes distribution to use\n -g, --gitops-engine GitOpsEngine GitOps engine to use (None disables GitOps, Flux installs Flux controllers, ArgoCD installs Argo CD) (default None)\n --load-balancer LoadBalancer LoadBalancer support (Default: use distribution × provider, Enabled: install, Disabled: uninstall)\n --metrics-server MetricsServer Metrics Server (Default: use distribution, Enabled: install, Disabled: uninstall)\n -o, --output string Output format: plain, json (default \"plain\")\n --policy-engine PolicyEngine Policy engine (None: skip, Kyverno: install Kyverno, Gatekeeper: install Gatekeeper)\n --provider Provider Infrastructure provider backend (e.g., Docker)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Import\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nImport container images from a tar archive to the cluster's containerd runtime.\n\nImages are imported to all nodes in the cluster, making them available for\npod scheduling without requiring registry pulls.\n\nExamples:\n # Import images from images.tar (default)\n ksail workload import\n\n # Import images from a specific file\n ksail workload import ./backups/my-images.tar\n\n # Import to a specific kubeconfig context\n ksail workload import --context=kind-dev --kubeconfig=~/.kube/config\n\nUsage:\n ksail workload import [] [flags]\n\nFlags:\n -c, --context string Kubernetes context of cluster\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Install\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nInstall Helm charts to provision workloads through KSail. This command provides native Helm chart installation capabilities.\n\nUsage:\n ksail workload install [NAME] [CHART] [flags]\n\nFlags:\n --atomic if set, the installation deletes on failure\n --create-namespace create the release namespace if not present\n -n, --namespace string namespace scope for the request (default \"default\")\n --timeout duration time to wait for any individual Kubernetes operation (default 5m0s)\n --version string chart version constraint (default: latest)\n --wait wait until resources are ready\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Logs\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nPrint the logs for a container in a pod or specified resource. If the pod has only one container, the container name is optional. Use --tail=N to limit output to the last N lines. Use --previous to get logs from a previous container instance (useful for crash-loop diagnostics). Use --all-containers to get logs from all containers in a pod. For GitOps controller logs, query the controller pods directly (e.g. in flux-system or argocd namespace).\n\nUsage:\n ksail workload logs\n\nExamples:\n # Return snapshot logs from pod nginx with only one container\n ksail workload logs nginx\n \n # Return snapshot logs from pod nginx, prefixing each line with the source pod and container name\n ksail workload logs nginx --prefix\n \n # Return snapshot logs from pod nginx, limiting output to 500 bytes\n ksail workload logs nginx --limit-bytes=500\n \n # Return snapshot logs from pod nginx, waiting up to 20 seconds for it to start running.\n ksail workload logs nginx --pod-running-timeout=20s\n \n # Return snapshot logs from pod nginx with multi containers\n ksail workload logs nginx --all-containers=true\n \n # Return snapshot logs from all pods in the deployment nginx\n ksail workload logs deployment/nginx --all-pods=true\n \n # Return snapshot logs from all containers in pods defined by label app=nginx\n ksail workload logs -l app=nginx --all-containers=true\n \n # Return snapshot logs from all pods defined by label app=nginx, limiting concurrent log requests to 10 pods\n ksail workload logs -l app=nginx --max-log-requests=10\n \n # Return snapshot of previous terminated ruby container logs from pod web-1\n ksail workload logs -p -c ruby web-1\n \n # Begin streaming the logs from pod nginx, continuing even if errors occur\n ksail workload logs nginx -f --ignore-errors=true\n \n # Begin streaming the logs of the ruby container in pod web-1\n ksail workload logs -f -c ruby web-1\n \n # Begin streaming the logs from all containers in pods defined by label app=nginx\n ksail workload logs -f -l app=nginx --all-containers=true\n \n # Display only the most recent 20 lines of output in pod nginx\n ksail workload logs --tail=20 nginx\n \n # Show all logs from pod nginx written in the last hour\n ksail workload logs --since=1h nginx\n \n # Show all logs with timestamps from pod nginx starting from August 30, 2024, at 06:00:00 UTC\n ksail workload logs nginx --since-time=2024-08-30T06:00:00Z --timestamps=true\n \n # Show logs from a kubelet with an expired serving certificate\n ksail workload logs --insecure-skip-tls-verify-backend nginx\n \n # Return snapshot logs from first container of a job named hello\n ksail workload logs job/hello\n \n # Return snapshot logs from container nginx-1 of a deployment named nginx\n ksail workload logs deployment/nginx -c nginx-1\n\nFlags:\n --all-containers Get all containers' logs in the pod(s).\n --all-pods Get logs from all pod(s). Sets prefix to true.\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n -c, --container string Print the logs of this container\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n -f, --follow Specify if the logs should be streamed.\n --ignore-errors If watching / following pod logs, allow for any errors that occur to be non-fatal\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --insecure-skip-tls-verify-backend Skip verifying the identity of the kubelet that logs are requested from. In theory, an attacker could provide invalid log content back. You might want to use this if your kubelet serving certificates have expired.\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n --limit-bytes int Maximum bytes of logs to return. Defaults to no limit.\n --max-log-requests int Specify maximum number of concurrent logs to follow when using by a selector. Defaults to 5. (default 5)\n -n, --namespace string If present, the namespace scope for this CLI request\n --pod-running-timeout duration The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running (default 20s)\n --prefix Prefix each log line with the log source (pod name and container name)\n -p, --previous If true, print the logs for the previous instance of the container in a pod if it exists.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --since duration Only return logs newer than a relative duration like 5s, 2m, or 3h. Defaults to all logs. Only one of since-time / since may be used.\n --since-time string Only return logs after a specific date (RFC3339). Defaults to all logs. Only one of since-time / since may be used.\n --tail int Lines of recent log file to display. Defaults to -1 with no selector, showing all log lines otherwise 10, if a selector is provided. (default -1)\n --timestamps Include timestamps on each line in the log output\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Mirror\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nMirror a Deployment's inbound traffic to the local machine (read-only).\n\nResolves the Deployment to a running pod, injects a read-only tap (an ephemeral\ncontainer holding only CAP_NET_RAW), and streams a tcpdump pcap capture of the\nservice port over the Kubernetes exec channel — no reverse tunnel, no traffic\ninterception, the workload keeps serving untouched.\n\nThe capture runs until interrupted (Ctrl-C). By default it is written to\nmirror.pcap and summarized on stop; --output - streams the raw pcap to stdout\nfor piping into tshark/wireshark.\n\nEphemeral containers cannot be removed, so an already-injected tap on the\ntarget pod is reused rather than treated as an error.\n\nUsage:\n ksail workload mirror [flags]\n\nExamples:\n # Mirror the traffic your app receives on port 8080 into mirror.pcap\n ksail workload mirror my-app --port 8080\n\n # Mirror a specific container of a multi-container Deployment in a namespace\n ksail workload mirror my-app -n prod -c api --port 8080\n\n # Pipe the live capture straight into tshark\n ksail workload mirror my-app --port 8080 --output - | tshark -r -\n\nFlags:\n -c, --container string Container whose traffic is mirrored (required when the Deployment has several)\n --context string Kubeconfig context of the target cluster\n -n, --namespace string Namespace of the target Deployment (default \"default\")\n -o, --output string Destination pcap file, or '-' to stream the raw pcap to stdout (default \"mirror.pcap\")\n -p, --port int Service port to capture TCP traffic on (required)\n --tap-image string Image the injected tap container runs (default \"docker.io/nicolaka/netshoot:v0.16\")\n --tap-timeout duration How long to wait for the tap container to reach Running (default 1m0s)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Network\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nInspect live network traffic flows via Cilium Hubble.\n\nWhen the cluster uses the Cilium CNI, Cilium's eBPF datapath records every\nnetwork flow and exposes them through the Hubble Relay API. This command\nqueries the most recent flows and prints them, so you can debug connectivity,\nspot drops, and see which workloads talk to each other without leaving the\nterminal.\n\nThe command connects to a Hubble Relay address (default localhost:4245).\nPort-forward the in-cluster relay first, e.g.:\n\n kubectl -n kube-system port-forward svc/hubble-relay 4245:80\n\nPass --follow to keep streaming live flows as they happen (like 'kubectl logs\n-f'), until you interrupt with Ctrl-C.\n\nOutput formats:\n - plain: an aligned table (default; one row per flow while following)\n - json: a JSON array of flow records, or newline-delimited JSON (one object\n per line) while following — both fit scripting / AI consumption\n\nExamples:\n # Show the 20 most recent flows\n ksail workload network\n\n # Only flows in the \"default\" namespace, as JSON\n ksail workload network --namespace default --output json\n\n # Only the last 100 TCP flows touching a pod\n ksail workload network --pod my-app --protocol tcp --last 100\n\n # Stream live flows until Ctrl-C\n ksail workload network --follow\n\nUsage:\n ksail workload network [flags]\n\nFlags:\n --cni CNI Container Network Interface (CNI) to use\n -f, --follow Stream flows continuously until interrupted (Ctrl-C)\n --last uint Number of most recent flows to fetch (default 20)\n -n, --namespace string Filter flows by namespace (source or destination)\n -o, --output string Output format: plain, json (default \"plain\")\n --pod string Filter flows by pod-name substring (source or destination)\n --protocol string Filter flows by L4 protocol (TCP, UDP, ICMPv4, ICMPv6, SCTP)\n --server string Hubble Relay address to query (default \"localhost:4245\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Push\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nBuild and push local workloads as an OCI artifact to a registry.\n\nThe OCI reference format is: oci://:/[/]:\n\nExamples:\n # Push to auto-detected local registry with defaults\n ksail workload push\n\n # Push specific directory to auto-detected registry\n ksail workload push --path=./manifests\n\n # Push to explicit registry endpoint\n ksail workload push oci://localhost:5050/k8s:dev\n\n # Push to external registry with credentials\n ksail workload push --registry='$USER:$TOKEN@ghcr.io/org/repo'\n\n # Push using KSAIL_REGISTRY environment variable\n KSAIL_REGISTRY='ghcr.io/org/repo' ksail workload push\n\n # Push with variant (subdirectory in repository)\n ksail workload push oci://localhost:5050/my-app/base:v1.0.0 --path=./k8s\n\nAll parts of the OCI reference are optional and will be inferred:\n - host:port: Auto-detected from running local-registry container\n - repository: Derived from source directory name\n - ref: Defaults to \"dev\"\n\nUsage:\n ksail workload push [oci://:/[/]:] [flags]\n\nFlags:\n --path string Source directory containing manifests to push\n --registry string Registry to push to (format: [user:pass@]host[:port][/path]), can also be set via KSAIL_REGISTRY env var\n --validate Validate manifests before pushing\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Reconcile\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nTrigger reconciliation/sync and wait for completion. For Flux, tracks the OCIRepository and each Kustomization individually. For ArgoCD, tracks each Application until synced and healthy.\n\nUsage:\n ksail workload reconcile [flags]\n\nFlags:\n --exclude strings kustomization names to skip during progress monitoring (repeatable, comma-separated)\n --timeout duration timeout for waiting for reconciliation to complete (overrides config timeout)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout History\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nView previous rollout revisions and configurations.\n\nUsage:\n ksail workload rollout history (TYPE NAME | TYPE/NAME) [flags]\n\nExamples:\n # View the rollout history of a deployment\n kubectl rollout history deployment/abc\n \n # View the details of daemonset revision 3\n kubectl rollout history daemonset/abc --revision=3\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --revision int See the details, including podTemplate of the revision specified\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout Pause\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nMark the provided resource as paused.\n\n Paused resources will not be reconciled by a controller. Use \"kubectl rollout resume\" to resume a paused resource. Currently only deployments support being paused.\n\nUsage:\n ksail workload rollout pause RESOURCE\n\nExamples:\n # Mark the nginx deployment as paused\n # Any current state of the deployment will continue its function; new updates\n # to the deployment will not have an effect as long as the deployment is paused\n kubectl rollout pause deployment/nginx\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-rollout\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout Restart\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRestart a resource.\n\n Resource rollout will be restarted.\n\nUsage:\n ksail workload rollout restart RESOURCE\n\nExamples:\n # Restart all deployments in the test-namespace namespace\n kubectl rollout restart deployment -n test-namespace\n \n # Restart a deployment\n kubectl rollout restart deployment/nginx\n \n # Restart a daemon set\n kubectl rollout restart daemonset/abc\n \n # Restart deployments with the app=nginx label\n kubectl rollout restart deployment --selector=app=nginx\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-rollout\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout Resume\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nResume a paused resource.\n\n Paused resources will not be reconciled by a controller. By resuming a resource, we allow it to be reconciled again. Currently only deployments support being resumed.\n\nUsage:\n ksail workload rollout resume RESOURCE\n\nExamples:\n # Resume an already paused deployment\n kubectl rollout resume deployment/nginx\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-rollout\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nManage the rollout of one or many resources.\n\nUsage:\n ksail workload rollout\n ksail workload rollout [command]\n\nExamples:\n # Rollback to the previous deployment\n ksail workload rollout undo deployment/abc\n \n # Check the rollout status of a daemonset\n ksail workload rollout status daemonset/foo\n \n # Restart a deployment\n ksail workload rollout restart deployment/abc\n \n # Restart deployments with the 'app=nginx' label\n ksail workload rollout restart deployment --selector=app=nginx\n\nAvailable Commands:\n history View rollout history\n pause Mark the provided resource as paused\n restart Restart a resource\n resume Resume a paused resource\n status Show the status of the rollout\n undo Undo a previous rollout\n\nFlags:\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -n, --namespace string If present, the namespace scope for this CLI request\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -s, --server string The address and port of the Kubernetes API server\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload rollout [command] --help\" for more information about a command.\n\n```\n\n### Workload Rollout Status\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nShow the status of the rollout.\n\n By default 'rollout status' will watch the status of the latest rollout until it's done. If you don't want to wait for the rollout to finish then you can use --watch=false. Note that if a new rollout starts in-between, then 'rollout status' will continue watching the latest revision. If you want to pin to a specific revision and abort if it is rolled over by another revision, use --revision=N where N is the revision you need to watch for.\n\nUsage:\n ksail workload rollout status (TYPE NAME | TYPE/NAME) [flags]\n\nExamples:\n # Watch the rollout status of a deployment\n kubectl rollout status deployment/nginx\n\nFlags:\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --revision int Pin to a specific revision for showing its status. Defaults to 0 (last revision).\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --timeout duration The length of time to wait before ending watch, zero means never. Any other values should contain a corresponding time unit (e.g. 1s, 2m, 3h).\n -w, --watch Watch the status of the rollout until it's done. (default true)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout Undo\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRoll back to a previous rollout.\n\nUsage:\n ksail workload rollout undo (TYPE NAME | TYPE/NAME) [flags]\n\nExamples:\n # Roll back to the previous deployment\n kubectl rollout undo deployment/abc\n \n # Roll back to daemonset revision 3\n kubectl rollout undo daemonset/abc --to-revision=3\n \n # Roll back to the previous deployment with dry-run\n kubectl rollout undo --dry-run=server deployment/abc\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --to-revision int The revision to rollback to. Default to 0 (last revision).\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nManage workload operations including resource inspection, GitOps reconciliation, and lifecycle management.\n\nRead operations:\n get - List resources with optional -o json for structured output including status/conditions\n describe - Show detailed resource info including events, conditions, and error details\n logs - Print container logs (use --tail=N, --previous for crash diagnostics)\n explain - Show API documentation for a resource kind\n forward - Forward one or more local ports to a pod\n images - List container images required by cluster components\n scan - Run security scans on Kubernetes manifests using Kubescape\n wait - Wait for a specific condition on resources\n\nWrite operations:\n apply, create, debug, delete, edit, exec, export, expose, import, install, push, reconcile, rollout, scale, watch\n cipher - Manage SOPS-encrypted secret files (encrypt, decrypt, edit, import, rotate)\n\nGitOps diagnostics: Use 'get' with Flux resources (kustomization, helmrelease, ocirepository -A -o json) or ArgoCD resources (application -A -o json) to check reconciliation status, health, and errors in a single call.\n\nUsage:\n ksail workload [flags]\n ksail workload [command]\n\nResources:\n apply Apply manifests\n create Create resources\n delete Delete resources\n describe Describe resources\n edit Edit a resource\n explain Get documentation for a resource\n expose Expose a resource as a service\n gen Generate Kubernetes resource manifests\n get Get resources\n scale Scale resources\n wait Wait for a specific condition on one or many resources\n\nImages:\n export Export container images from the cluster\n images List container images required by cluster components\n import Import container images to the cluster\n\nGitOps:\n install Install Helm charts\n push Package and push an OCI artifact to a registry\n reconcile Trigger reconciliation for GitOps workloads\n scan Run security scans on Kubernetes manifests\n validate Validate Kubernetes manifests and kustomizations\n\nDev loop:\n debug Create debugging sessions for troubleshooting workloads and nodes\n exec Execute a command in a container\n forward Forward one or more local ports to a pod\n logs Print container logs\n mirror Mirror a Deployment's inbound traffic locally (read-only pcap capture)\n network Inspect live network traffic flows via Cilium Hubble\n rollout Manage the rollout of a resource\n watch Watch for file changes and auto-apply workloads\n\nSecrets:\n cipher Manage encrypted files with SOPS\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload [command] --help\" for more information about a command.\n\n```\n\n### Workload Scale\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nSet a new size for a deployment, replica set, replication controller, or stateful set.\n\nUsage:\n ksail workload scale\n\nExamples:\n # Scale a replica set named 'foo' to 3\n ksail workload scale --replicas=3 rs/foo\n \n # Scale a resource identified by type and name specified in \"foo.yaml\" to 3\n ksail workload scale --replicas=3 -f foo.yaml\n \n # If the deployment named mysql's current size is 2, scale mysql to 3\n ksail workload scale --current-replicas=2 --replicas=3 deployment/mysql\n \n # Scale multiple replication controllers\n ksail workload scale --replicas=5 rc/example1 rc/example2 rc/example3\n \n # Scale stateful set named 'web' to 3\n ksail workload scale --replicas=3 statefulset/web\n\nFlags:\n --all Select all resources in the namespace of the specified resource types\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --current-replicas int Precondition for current size. Requires that the current size of the resource match this value in order to scale. -1 (default) for no condition. (default -1)\n --disable-compression If true, opt-out of response compression for all requests to the server\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to set a new size\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -n, --namespace string If present, the namespace scope for this CLI request\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --replicas int The new desired number of replicas. Required.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n --resource-version string Precondition for resource version. Requires that the current resource version match this value in order to scale.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --timeout duration The length of time to wait before giving up on a scale operation, zero means don't wait. Any other values should contain a corresponding time unit (e.g. 1s, 2m, 3h).\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Scan\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRun security scans on Kubernetes manifests using Kubescape.\n\nThis command scans manifests in the specified path against security frameworks\nsuch as NSA-CISA, MITRE ATT&CK, and CIS Benchmarks.\n\nWhen the target directory is a Kustomize root, manifests are rendered before\nscanning (Kustomize build + Flux variable substitution + in-process Helm\ntemplating of HelmReleases), so findings reflect overlay patches and chart output\nrather than the raw files. HelmReleases that cannot be rendered offline are left\nas-is with a warning. Use --no-render to scan the raw files instead.\n\nIf no path is provided, the path is resolved in order:\n 1. spec.workload.sourceDirectory from ksail.yaml (if a config file is found and the field is set)\n 2. The default source directory when spec.workload.sourceDirectory is unset (\"k8s\" directory)\n 3. The current directory (fallback when no ksail.yaml config file is found)\n\nExceptions: pass --exceptions to forward a Kubescape exceptions file (a JSON\narray of PostureExceptionPolicy objects) so justified, runtime-enforced findings\n(e.g. Kyverno admission mutation, Cilium network policies, VPA-managed resources) are\nsuppressed and --compliance-threshold 100 can gate CI. The file loads locally with no\ncloud account and the scan stays offline.\n\nThe frameworks, exceptions file, and compliance threshold can also be set under\nspec.workload.scan in ksail.yaml so 'ksail workload scan' (no args) is a turnkey CI\ngate; a relative exceptions path resolves against the ksail.yaml directory and CLI\nflags override the config.\n\nAvailable frameworks: nsa, mitre, cis, pss (and any other framework supported by Kubescape)\nAvailable output formats: pretty-printer, json, sarif, junit (and any other format supported by Kubescape)\n\nFor more information, see https://github.com/kubescape/kubescape\n\nUsage:\n ksail workload scan [PATH] [flags]\n\nFlags:\n --compliance-threshold float32 Fail if compliance score is below this threshold (0-100) (overrides spec.workload.scan.complianceThreshold from ksail.yaml)\n --exceptions string Path to a Kubescape exceptions file (a JSON array of PostureExceptionPolicy objects) forwarded to Kubescape's --exceptions (overrides spec.workload.scan.exceptions from ksail.yaml)\n --format string Output format (pretty-printer, json, sarif, junit) (default \"pretty-printer\")\n --framework strings Security frameworks to scan against (e.g. nsa, mitre, cis, pss) (overrides spec.workload.scan.frameworks from ksail.yaml) (default [nsa])\n --no-render Scan the raw manifest files instead of the Kustomize + Helm rendered output (skip rendering entirely; restores the pre-rendering behavior)\n -o, --output string Output file path (stdout if empty)\n --verbose Show all resources in output, not just failed ones\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Validate\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nValidate Kubernetes manifest files and kustomizations using kubeconform.\n\nThis command validates individual YAML files and kustomizations in the specified path.\nIf no path is provided, the path is resolved in order:\n 1. spec.workload.sourceDirectory from ksail.yaml (if a config file is found and the field is set)\n 2. The default source directory when spec.workload.sourceDirectory is unset (\"k8s\" directory)\n 3. The current directory (fallback when no ksail.yaml config file is found)\n\nThe validation process:\n1. Validates individual YAML files (patch files referenced in a kustomization file via patches,\n patchesStrategicMerge, or patchesJson6902 are excluded — they are not valid standalone\n Kubernetes resources and are validated as part of the kustomize build output instead)\n2. Validates kustomizations by building them with kustomize and validating the output\n\n\tFlux variable substitutions are resolved before validation using type-aware placeholders:\n - ${VAR} (bare, no default): when a JSON schema type is available, substitutes a typed\n placeholder derived from the schema for the field (\"placeholder\" for strings, 0 for\n integers, true for booleans); when no schema type is available, it falls back to the\n string value \"placeholder\"\n - ${VAR:-default} / ${VAR:=default}: when a schema type is available, uses the default\n value parsed according to the field schema type (e.g., \"3\" → int 3 for integer fields);\n when no schema type is available, the default is parsed using YAML-native type inference\n - Mixed text (e.g., \"prefix.${VAR}\"): substitutes \"placeholder\" in string context\n\nSchema lookups use a local disk cache and require no network access. When no cached\nJSON schema is available, placeholders fall back to strings with YAML-native parsing.\n\nBy default, Kubernetes Secrets are skipped to avoid validation failures due to SOPS fields.\n\nUsage:\n ksail workload validate [PATH] [flags]\n\nFlags:\n --ignore-missing-schemas Ignore resources with missing schemas (default true)\n --schema-location strings Additional kubeconform schema locations (local directory or URL/path template) for CRDs absent from the CRDs-catalog, so they are validated against a supplied schema instead of skipped (merged with spec.workload.validation.schemaLocations from ksail.yaml)\n --skip-helm-render Skip rendering HelmReleases before validation (validate the HelmRelease CR as-is). By default, charts are rendered in-process and the rendered manifests are validated.\n --skip-kinds strings Additional Kubernetes kinds to skip during validation (merged with spec.workload.validation.skipKinds from ksail.yaml)\n --skip-secrets Skip validation of Kubernetes Secrets (default true)\n --strict Enable strict validation mode\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Wait\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nWait for a specific condition on one or many resources. The command takes multiple resources and waits until the specified condition is seen in the Status field of every given resource.\n\nUsage:\n ksail workload wait\n\nExamples:\n # Wait for the pod \"busybox1\" to contain the status condition of type \"Ready\"\n ksail workload wait --for=condition=Ready pod/busybox1\n \n # The default value of status condition is true; you can wait for other targets after an equal delimiter (compared after Unicode simple case folding, which is a more general form of case-insensitivity)\n ksail workload wait --for=condition=Ready=false pod/busybox1\n \n # Wait for the pod \"busybox1\" to contain the status phase to be \"Running\"\n ksail workload wait --for=jsonpath='{.status.phase}'=Running pod/busybox1\n \n # Wait for pod \"busybox1\" to be Ready\n ksail workload wait --for='jsonpath={.status.conditions[?(@.type==\"Ready\")].status}=True' pod/busybox1\n \n # Wait for the service \"loadbalancer\" to have ingress\n ksail workload wait --for=jsonpath='{.status.loadBalancer.ingress}' service/loadbalancer\n \n # Wait for the secret \"busybox1\" to be created, with a timeout of 30s\n ksail workload create secret generic busybox1\n ksail workload wait --for=create secret/busybox1 --timeout=30s\n \n # Wait for the pod \"busybox1\" to be deleted, with a timeout of 60s, after having issued the \"delete\" command\n ksail workload delete pod/busybox1\n ksail workload wait --for=delete pod/busybox1 --timeout=60s\n \n # Wait for pod \"busybox1\" to be created AND reach the \"Ready\" status condition\n ksail workload wait --for=condition=Ready --for=create pod/busybox1\n \n # Wait for pod \"busybox1\" to reach the \"Ready\" status OR for its containers to report a \"False\" readiness state\n until ksail workload wait pod/busybox1 --for=condition=Ready --timeout=1s 2>/dev/null || \\\n ksail workload wait pod/busybox1 --for=condition=ContainersReady=False --timeout=1s 2>/dev/null; \\\n do echo \"Checking conditions...\"; sleep 1; done\n\nFlags:\n --all Select all resources in the namespace of the specified resource types\n -A, --all-namespaces If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --field-selector string Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.\n -f, --filename strings identifying the resource.\n --for stringArray The condition to wait on: [create|delete|condition=condition-name[=condition-value]|jsonpath='{JSONPath expression}'=[JSONPath value]]. The default condition-value is true. Condition values are compared after Unicode simple case folding, which is a more general form of case-insensitivity. Multiple conditions are supported and AND'ed to each other in a sequential order. If --for=create is passed, it is always waited first.\n --local If true, annotation will NOT contact api-server but run locally.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory. (default true)\n -l, --selector string Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --timeout duration The length of time to wait before giving up. Zero means check once and don't wait, negative means wait for a week. (default 30s)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Watch\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nWatch a directory for file changes and automatically apply workloads.\n\nWhen files in the watched directory are created, modified, or deleted,\nthe command debounces changes (~500ms) then scopes the apply to the\nnearest directory containing a kustomization file recognized by kubectl\n(kustomization.yaml, kustomization.yml, or Kustomization), walking up\nfrom the changed file to the watch root. If no kustomization boundary is\nfound, or the boundary is the watch root, it applies the full root\ndirectory. This scoping ensures only the affected Kustomize layer is\nre-applied, making iteration faster in monorepo-style layouts.\n\nEach reconcile prints a timestamped status line showing the changed file,\nthe outcome (success or failure), and the elapsed time for the apply.\nPress Ctrl+C to stop the watcher.\n\nUse --initial-apply to synchronize the cluster with the current state of\nthe watch directory before entering the watch loop. This is useful after\nediting manifests offline or when starting a fresh session.\n\nUse --hook to run shell commands before each apply (e.g. docker build).\nHooks execute sequentially; if any hook fails the apply is skipped for\nthat cycle. Hooks can also be configured in ksail.yaml under\nspec.workload.watch.hooks. CLI --hook flags are appended after config hooks.\n\nExamples:\n # Watch the default k8s/ directory\n ksail workload watch\n\n # Watch and apply once on startup before entering the loop\n ksail workload watch --initial-apply\n\n # Watch a custom directory\n ksail workload watch --path=./manifests\n\n # Run a build before each apply\n ksail workload watch --hook \"docker build -t myapp:latest .\"\n\n # Chain multiple hooks\n ksail workload watch --hook \"make generate\" --hook \"docker build -t myapp .\"\n\nUsage:\n ksail workload watch [flags]\n\nFlags:\n --debug Show diagnostic output for file events and polling (useful for troubleshooting watch behavior)\n --hook stringArray Shell command to run before each apply (repeatable; appended after spec.workload.watch.hooks)\n --initial-apply Apply all workloads once immediately on startup before entering the watch loop\n --path string Directory to watch for changes (default: k8s/ or spec.workload.sourceDirectory from ksail.yaml)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n> For image rebuild automation and local↔remote traffic bridging, see the [Companion Tools](/integrations/companion-tools/) guide.\n\n### Gateway Api\n\nKSail clusters using the **Cilium** CNI option come Gateway API–ready out of the box. When you select `cni: Cilium`, KSail automatically:\n\n1. **Installs Gateway API CRDs** (experimental channel, v1.4.1) before the Cilium Helm chart.\n2. **Enables Cilium's Gateway API controller** (`gatewayAPI.enabled: true`) in the Helm values.\n3. **Creates a `GatewayClass`** named `cilium` via the Cilium controller.\n\nYou don't need to install any additional controllers or CRD bundles manually.\n\n> [!NOTE]\n> This guide assumes you are using **Cilium** as your CNI. Gateway API is not automatically enabled on the Default (kindnet) CNI. If you initialized your cluster without specifying `--cni`, run `ksail project init --cni Cilium` to get a Cilium-enabled cluster.\n\n## Prerequisites\n\n- [KSail CLI](/installation/) installed\n- Docker running\n- A cluster initialized with Cilium:\n\n ```bash\n ksail project init --cni Cilium\n ksail cluster create\n ```\n\n Or update an existing `ksail.yaml` to set `spec.cluster.cni: Cilium` and run `ksail cluster update`.\n\n- `kubectl` accessible (KSail writes the kubeconfig context — see [Companion Tools](/integrations/companion-tools/) for context names per distribution).\n\n## Verify Gateway API Is Ready\n\nAfter cluster creation, confirm the `GatewayClass` exists and is ready:\n\n```bash\nkubectl get gatewayclass\n```\n\nExpected output:\n\n```\nNAME CONTROLLER ACCEPTED AGE\ncilium io.cilium/gateway-controller True 2m\n```\n\nIf `ACCEPTED` is `False`, wait a few seconds for Cilium to finish initializing. You can also check:\n\n```bash\nkubectl get crd gateways.gateway.networking.k8s.io\n```\n\n## Expose a Service with HTTPRoute\n\nThe Gateway API request path is: **`GatewayClass` → `Gateway` → `HTTPRoute` → `Service`**.\n\n\n1. **Deploy a sample app**\n\n ```bash\n kubectl create deployment httpbin \\\n --image=kennethreitz/httpbin:latest \\\n --port=80\n kubectl expose deployment httpbin --port=80\n ```\n\n2. **Create a Gateway**\n\n ```yaml\n # gateway.yaml\n apiVersion: gateway.networking.k8s.io/v1\n kind: Gateway\n metadata:\n name: my-gateway\n namespace: default\n spec:\n gatewayClassName: cilium\n listeners:\n - name: http\n port: 80\n protocol: HTTP\n ```\n\n ```bash\n kubectl apply -f gateway.yaml\n kubectl get gateway my-gateway\n ```\n\n Wait until `PROGRAMMED` is `True`:\n\n ```\n NAME CLASS ADDRESS PROGRAMMED AGE\n my-gateway cilium True 30s\n ```\n\n > [!NOTE]\n > On Docker-based clusters (Vanilla, K3s, VCluster) **without an external LoadBalancer** (such as MetalLB), KSail configures Cilium's Gateway API integration to use `hostNetwork` mode — the Gateway does not get its own external IP and traffic reaches it via the node's host ports. When you enable an external LoadBalancer, `hostNetwork` is not applied and Gateways may receive an IP via a `Service`. For Hetzner and Omni cloud providers, the Gateway receives a real external IP. KWOK has no real network dataplane, so Gateway API traffic routing does not function even though the configuration objects are accepted by the API server.\n\n3. **Create an HTTPRoute**\n\n ```yaml\n # httproute.yaml\n apiVersion: gateway.networking.k8s.io/v1\n kind: HTTPRoute\n metadata:\n name: httpbin-route\n namespace: default\n spec:\n parentRefs:\n - name: my-gateway\n hostnames:\n - \"httpbin.local\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: httpbin\n port: 80\n ```\n\n ```bash\n kubectl apply -f httproute.yaml\n kubectl get httproute httpbin-route\n ```\n\n4. **Test the route**\n\n For local Docker clusters, port-forward the Cilium Gateway Service to test:\n\n ```bash\n # Port-forward the Cilium Envoy listener Service created for the Gateway\n kubectl -n kube-system port-forward svc/cilium-gateway-my-gateway 8080:80 &\n\n # Send a request that matches the HTTPRoute hostname\n curl -H \"Host: httpbin.local\" http://localhost:8080/get\n ```\n\n\n\n## Path-Based Routing\n\nSplit traffic between services based on URL path prefix:\n\n```yaml\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: api-route\n namespace: default\nspec:\n parentRefs:\n - name: my-gateway\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /api\n backendRefs:\n - name: backend-api\n port: 8080\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: frontend\n port: 3000\n```\n\n## Header-Based Routing\n\nRoute requests based on HTTP headers — useful for canary deployments or A/B testing:\n\n```yaml\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: canary-route\n namespace: default\nspec:\n parentRefs:\n - name: my-gateway\n rules:\n - matches:\n - headers:\n - name: X-Version\n value: canary\n backendRefs:\n - name: my-app-canary\n port: 80\n - backendRefs:\n - name: my-app\n port: 80\n```\n\n## TLS Termination\n\nTerminate TLS at the Gateway using a Kubernetes `Secret`:\n\n```yaml\n# tls-gateway.yaml\napiVersion: gateway.networking.k8s.io/v1\nkind: Gateway\nmetadata:\n name: my-tls-gateway\n namespace: default\nspec:\n gatewayClassName: cilium\n listeners:\n - name: https\n port: 443\n protocol: HTTPS\n tls:\n mode: Terminate\n certificateRefs:\n - name: my-tls-secret # a kubernetes.io/tls Secret\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: my-tls-route\n namespace: default\nspec:\n parentRefs:\n - name: my-tls-gateway\n hostnames:\n - \"myapp.example.com\"\n rules:\n - backendRefs:\n - name: my-app\n port: 80\n```\n\n> [!TIP]\n> Use [cert-manager](https://cert-manager.io/) to automatically provision TLS certificates. Install it with `ksail workload install cert-manager jetstack/cert-manager` and configure an `Issuer` or `ClusterIssuer` to populate the secret automatically.\n\n## Migration from Ingress\n\nGateway API replaces the Kubernetes `Ingress` resource. Here is a side-by-side comparison of a common pattern:\n\n| Concern | Ingress | HTTPRoute |\n|---------|---------|-----------|\n| Entry point | `Ingress` | `Gateway` + `HTTPRoute` |\n| Path routing | `spec.rules[].http.paths` | `spec.rules[].matches[].path` |\n| Host routing | `spec.rules[].host` | `spec.hostnames[]` |\n| TLS | `spec.tls[]` | `Gateway` listener `tls` section |\n| Annotation-based features | Varies by controller | Native spec fields |\n\nReplace each `Ingress` with a `Gateway` (one per entry point) and one or more `HTTPRoute` resources. See [Expose a Service with HTTPRoute](#expose-a-service-with-httproute) for a complete example. For a detailed migration walkthrough, see the [Kubernetes Gateway API migration guide](https://gateway-api.sigs.k8s.io/guides/migrating-from-ingress/).\n\n## Using Gateway API in GitOps\n\nWhen using KSail with Flux or ArgoCD, place Gateway and HTTPRoute manifests in your source directory alongside other workload manifests:\n\n```text\nk8s/\n├── kustomization.yaml\n├── gateway.yaml # Gateway resource\n└── my-app/\n ├── deployment.yaml\n ├── service.yaml\n └── httproute.yaml # HTTPRoute resource\n```\n\nThe Gateway API CRDs and the `cilium` GatewayClass are managed by KSail (installed during `cluster create`). Your manifests only need to declare `Gateway` and `HTTPRoute` resources — no CRD or GatewayClass manifest is needed in your source directory.\n\n```bash\nksail workload apply -f k8s/\n# or with GitOps\nksail workload push\nksail workload reconcile\n```\n\n## Troubleshooting\n\n**GatewayClass `ACCEPTED` is `False`:**\n\n```bash\nkubectl describe gatewayclass cilium\n```\n\nCilium's controller may still be starting. Wait for Cilium pods to be ready:\n\n```bash\nkubectl get pods -n kube-system -l k8s-app=cilium\n```\n\n**Gateway `PROGRAMMED` is `False`:**\n\n```bash\nkubectl describe gateway my-gateway\n```\n\nCheck for port conflicts or missing CRDs. On Docker clusters without an external LoadBalancer, confirm Cilium is running with `gatewayAPI.hostNetwork.enabled: true` (KSail sets this automatically for Docker providers when no LoadBalancer is configured).\n\n**HTTPRoute not routing traffic:**\n\n```bash\nkubectl get httproute my-route -o yaml\n```\n\nCheck `status.parents[].conditions` for `Accepted` and `ResolvedRefs` — both must be `True`. If `ResolvedRefs` is `False`, the backend `Service` may not exist or the port may be wrong.\n\n**CRDs not found:**\n\nGateway API CRDs are installed by KSail during `cluster create` for Cilium clusters. If you're seeing `No resources found` for `gateway.networking.k8s.io`:\n\n```bash\nkubectl get crd | grep gateway.networking.k8s.io\n```\n\nRe-run `ksail cluster update` to reinstall CRDs if they are missing.\n\n## Related\n\n- [Cilium Gateway API docs](https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gateway-api/) — upstream reference\n- [Kubernetes Gateway API docs](https://gateway-api.sigs.k8s.io/) — spec reference\n- [Multi-Environment Workflows](/guides/multi-environment/) — managing clusters across environments\n- [PR Preview Clusters](/guides/pr-preview-clusters/) — ephemeral clusters in CI with GitOps\n\n### Loadbalancer\n\nLoadBalancer services expose applications to external traffic. KSail supports LoadBalancer across all distributions with distribution-specific implementations for each platform.\n\n## Overview\n\nLoadBalancer support varies by Kubernetes distribution and infrastructure provider:\n\n| Distribution | Provider | Implementation | Default Behavior | Configuration Required |\n| --------------- | -------- | --------------------------------- | ---------------- | ---------------------- |\n| Vanilla (Kind) | Docker | Cloud Provider KIND | Disabled | Yes |\n| K3s (K3d) | Docker | ServiceLB (Klipper) | Enabled | No |\n| Talos | Docker | MetalLB | Disabled | Yes |\n| Talos | Hetzner | hcloud-cloud-controller-manager | Enabled | No |\n| VCluster (Vind) | Docker | Delegated to host cluster | N/A | N/A |\n\nVCluster delegates LoadBalancer to the host cluster — `spec.cluster.loadBalancer` has no effect and never triggers a cluster update. Use the `--load-balancer` flag or `spec.cluster.loadBalancer` in `ksail.yaml` with values `Default`, `Enabled`, or `Disabled`.\n\n## Platform-Specific Configuration\n\n### Vanilla (Kind) on Docker\n\nVanilla clusters use the [Cloud Provider KIND](https://github.com/kubernetes-sigs/cloud-provider-kind) controller, which runs as an external Docker container and allocates LoadBalancer IPs from the Docker bridge network.\n\n#### Enable LoadBalancer Support\n\n**CLI:**\n\n```bash\nksail project init \\\n --name my-cluster \\\n --distribution Vanilla \\\n --load-balancer Enabled\n```\n\n**ksail.yaml:**\n\n```yaml\nspec:\n cluster:\n distribution: Vanilla\n loadBalancer: Enabled\n```\n\n#### How It Works\n\nCloud Provider KIND runs as a single Docker container named `ksail-cloud-provider-kind` on the `kind` network, mounting the Docker socket to watch for `type: LoadBalancer` services. For each service it creates a dedicated `cpk--` container that routes traffic from an IP on the `kind` network bridge subnet (typically `172.18.0.0/16`) to the service's pods. `ksail cluster delete` removes the controller and all `cpk-*` containers.\n\n### K3s on Docker\n\nK3s includes [ServiceLB](https://docs.k3s.io/networking/networking-services#service-load-balancer) by default, assigning the cluster node's IP as the external IP and forwarding traffic via `iptables`. No configuration needed:\n\n```bash\nksail project init --name my-cluster --distribution K3s\nksail cluster create\n```\n\nTo disable: use `--load-balancer Disabled` (CLI) or set `loadBalancer: Disabled` in `ksail.yaml`.\n\n### Talos on Docker\n\nTalos on Docker uses [MetalLB](https://metallb.universe.tf/) to provide LoadBalancer services. MetalLB operates in Layer 2 mode and allocates IPs from a pre-configured pool.\n\n#### Enable LoadBalancer Support\n\n**CLI:**\n\n```bash\nksail project init \\\n --name my-cluster \\\n --distribution Talos \\\n --load-balancer Enabled\n```\n\n**ksail.yaml:**\n\n```yaml\nspec:\n cluster:\n distribution: Talos\n provider: Docker\n loadBalancer: Enabled\n```\n\nKSail configures MetalLB with a default IP pool of `172.18.255.200–172.18.255.250` in Layer 2 (ARP/NDP) mode on the Docker bridge network, chosen to avoid conflicts with typical Docker allocations.\n\n#### How It Works\n\nKSail installs MetalLB via Helm, configures an `IPAddressPool` and `L2Advertisement` automatically, and MetalLB assigns IPs from the pool via ARP on the Docker network.\n\n#### Custom IP Pool\n\nTo use a custom IP range, you'll need to create custom MetalLB resources after cluster creation:\n\n```yaml\napiVersion: metallb.io/v1beta1\nkind: IPAddressPool\nmetadata:\n name: custom-pool\n namespace: metallb-system\nspec:\n addresses:\n - 172.18.100.1-172.18.100.254\n---\napiVersion: metallb.io/v1beta1\nkind: L2Advertisement\nmetadata:\n name: custom-l2\n namespace: metallb-system\nspec:\n ipAddressPools:\n - custom-pool\n```\n\n### Talos on Hetzner\n\nTalos on Hetzner Cloud uses the [Hetzner Cloud Controller Manager](https://github.com/hetznercloud/hcloud-cloud-controller-manager) to provision real cloud load balancers. LoadBalancer is **enabled by default** — KSail automatically installs hcloud-ccm when `loadBalancer` is `Default` or `Enabled`.\n\n**Prerequisites:** Set `HCLOUD_TOKEN` to a Hetzner API token with read/write permissions for Load Balancers.\n\n```bash\nexport HCLOUD_TOKEN=your-token-here\nksail project init \\\n --name my-cluster \\\n --distribution Talos \\\n --provider Hetzner\nksail cluster create\n```\n\nThe Hetzner CCM provisions a real cloud load balancer with a public IP in 30–60 seconds (subject to Hetzner billing).\n\n```bash\nkubectl get svc my-app -w # EXTERNAL-IP appears after 30–60 seconds\n```\n\n#### Annotations\n\nYou can customize Hetzner Load Balancer behavior using annotations:\n\n```yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: my-app\n annotations:\n load-balancer.hetzner.cloud/location: nbg1\n load-balancer.hetzner.cloud/use-private-ip: \"true\"\n load-balancer.hetzner.cloud/health-check-interval: \"15s\"\nspec:\n type: LoadBalancer\n selector:\n app: my-app\n ports:\n - port: 80\n targetPort: 8080\n```\n\nSee the [Hetzner CCM documentation](https://github.com/hetznercloud/hcloud-cloud-controller-manager#service) for all available annotations.\n\n## Troubleshooting\n\n### LoadBalancer Service Stuck in Pending\n\n**Symptom:** `EXTERNAL-IP` shows ``.\n\n**Diagnosis:**\n\n```bash\n# Check loadBalancer setting (absent field = Default; Default auto-enables on K3s and Talos×Hetzner):\ngrep 'loadBalancer:' ksail.yaml || echo \"(not set — effective value: Default)\"\n# Vanilla: docker logs ksail-cloud-provider-kind\n# Talos: kubectl logs -n metallb-system -l app.kubernetes.io/component=controller\n# Hetzner: kubectl logs -n kube-system -l app=hcloud-cloud-controller-manager\n```\n\n**Common fixes:** LoadBalancer disabled → re-init with `--load-balancer Enabled`. Cloud Provider KIND not running → delete and recreate cluster. MetalLB IP pool exhausted → expand the pool (see below). Hetzner → ensure `HCLOUD_TOKEN` is set during cluster creation.\n\n### Cannot Access LoadBalancer IP\n\n**Symptom:** Service has an external IP but connections fail.\n\n**Diagnosis:**\n\n```bash\nkubectl get pods -l app=my-app # verify pods are Running\nkubectl get endpoints my-app # check endpoint IPs are populated\nkubectl logs -l app=my-app # review pod logs\n# Test from within the cluster:\nkubectl run test --rm -it --restart=Never --image=curlimages/curl -- curl http://my-app.default.svc.cluster.local\n```\n\n**Common fixes:** Wrong `targetPort` → match the container port. Network policy blocking traffic → inspect `NetworkPolicy` resources. Application not listening on `0.0.0.0` → fix app bind address.\n\n### MetalLB IP Pool Exhausted\n\n**Symptom:** New LoadBalancer services remain `` after many allocations (default pool has 51 IPs: `172.18.255.200–172.18.255.250`).\n\n**Fix:** Create an additional `IPAddressPool` in `metallb-system`:\n\n```yaml\napiVersion: metallb.io/v1beta1\nkind: IPAddressPool\nmetadata:\n name: expanded-pool\n namespace: metallb-system\nspec:\n addresses:\n - 172.18.255.200-172.18.255.254 # Expanded from .250 to .254\n```\n\n### Workload Validate\n\n`ksail workload validate` runs [kubeconform](https://github.com/yannh/kubeconform) against your Kubernetes manifests to catch schema errors before they reach the cluster. When your manifests use [Flux postBuild substitutions](https://fluxcd.io/flux/components/kustomize/kustomizations/#post-build-variable-substitution) (`${VAR}`, `${VAR:-default}`, `${VAR:=default}`), the validator needs concrete values to produce valid YAML for schema checking.\n\nThis guide explains how the expansion works, why environment variables are not read, and how to write substitutions that validate cleanly.\n\n## Why Local Environment Variables Are Not Used\n\n`workload validate` is designed to be **deterministic** — the same manifests should produce the same validation result regardless of the machine, user, or environment they are run on. Reading from local environment variables would break this:\n\n- A manifest that validates on a developer's machine (because `$REPLICA_COUNT` is set) might fail in CI (where it is not set).\n- Conversely, an incorrectly typed default (`replicas: \"3\"` instead of `replicas: 3`) might slip through validation on a machine where the env var overrides the bad default.\n\nInstead, KSail uses **typed schema-aware placeholders** derived from the Kubernetes JSON schema. Validation catches type mismatches at schema-check time, not at deploy time.\n\n> [!NOTE]\n> Commands that deploy or push manifests (`workload apply`, `workload push`, `workload reconcile`) do **not** expand Flux `${VAR}` substitutions from your local environment. They pass manifests through (or trigger GitOps reconciliation), and Flux performs substitution **in-cluster** via Kustomization `postBuild.substitute` / `substituteFrom`. Only `workload validate` simulates substitutions client-side, using deterministic placeholders instead of reading environment variables.\n\n## Expansion Rules\n\n### `${VAR}` — Bare Variable Reference (No Default)\n\nA bare `${VAR}` is replaced with a **typed placeholder** based on the JSON schema type of the field it occupies.\n\n| Schema type | Placeholder value |\n|-------------|------------------|\n| `string` | `\"placeholder\"` |\n| `integer` | `0` |\n| `number` | `0.0` |\n| `boolean` | `true` |\n| unknown / no schema | `\"placeholder\"` |\n\n**Example:**\n\n```yaml\nspec:\n replicas: ${REPLICA_COUNT} # integer field → 0\n image: ${IMAGE_REF} # string field → \"placeholder\"\n enableFeature: ${FEATURE_ON} # boolean field → true\n```\n\nAfter expansion:\n\n```yaml\nspec:\n replicas: 0\n image: placeholder\n enableFeature: true\n```\n\n### `${VAR:-default}` and `${VAR:=default}` — Variable With Default\n\nWhen a default is provided (either `:-` or `:=` syntax), the default value is used as-is and coerced to the schema type.\n\n```yaml\nspec:\n replicas: ${REPLICA_COUNT:-3} # integer field → 3 (not \"3\")\n name: ${APP_NAME:-my-app} # string field → \"my-app\"\n debug: ${DEBUG_MODE:-false} # boolean field → false\n```\n\n> [!NOTE]\n> Coercion only applies to scalar-only substitutions (when the entire field value is a single `${VAR:-...}`). In mixed-text contexts (e.g., `prefix-${VAR}-suffix`), the result is always a string: bare `${VAR}` references are replaced with the string placeholder `\"placeholder\"`, while `${VAR:-default}` / `${VAR:=default}` expand to the provided default text.\n\n### Mixed-Text Substitution\n\nWhen a variable reference is embedded inside a larger string, the result is always a string:\n\n```yaml\nspec:\n hostname: ${ENV}-app.example.com # → \"placeholder-app.example.com\"\n image: myrepo/${IMAGE_NAME:-nginx}:latest # → \"myrepo/nginx:latest\"\n```\n\n## Schema Inference\n\nKSail loads JSON schemas from the kubeconform disk cache (populated on previous `workload validate` runs). Schema files are looked up from the OS user cache directory (for example `~/.cache/ksail/kubeconform/`), or from `${TMPDIR}/ksail/kubeconform` when the user cache directory is unavailable (such as in some CI environments).\n\n- **Core Kubernetes resources** (Deployment, Service, ConfigMap, …): typed via [kubernetes-json-schema](https://github.com/yannh/kubernetes-json-schema) **when the relevant schema is present in the kubeconform disk cache**\n- **CRDs** (FluxCD, cert-manager, …): typed via the [CRDs-catalog](https://github.com/datreeio/CRDs-catalog) **when their schemas are present in the kubeconform disk cache**\n- **Resources without a cached schema** (including core kinds or CRDs whose schemas have not yet been cached): all bare `${VAR}` expand to `\"placeholder\"` (string)\n\n> [!NOTE]\n> Placeholder type inference reads schemas **only from the local kubeconform cache** — it does not itself make any network requests while deciding how to type `${VAR}` placeholders.\n> Kubeconform may still download missing schemas from its configured remote schema locations on a cache miss (typically the first time it sees a given kind), and then caches them under the same directory for subsequent validations.\n\n## Practical Guidance\n\n### Avoid False Validation Failures\n\nIf `workload validate` reports a type error for a field that uses `${VAR}` without a default, add a meaningful default of the correct type:\n\n```yaml\n# Before — bare ${VAR} expands to \"placeholder\" (string), fails integer validation\nspec:\n replicas: ${REPLICA_COUNT}\n\n# After — default 2 is correctly typed as an integer\nspec:\n replicas: ${REPLICA_COUNT:-2}\n```\n\n### Verify Your Defaults Are Well-Typed\n\nWhen using `${VAR:-default}`, ensure the default value matches the field's expected type. Incorrect defaults will cause validation failures even if the env var is always set at runtime:\n\n```yaml\n# This will fail validation: \"2\" is a string, but replicas expects an integer\nspec:\n replicas: ${REPLICA_COUNT:-\"2\"}\n\n# Correct: unquoted numeric default\nspec:\n replicas: ${REPLICA_COUNT:-2}\n```\n\n### Skip Validation for Specific Kinds\n\n`workload validate` checks each resource against its JSON schema from the [CRDs-catalog](https://github.com/datreeio/CRDs-catalog). When a CRD's catalog schema is **stale or missing**, kubeconform can reject otherwise-valid manifests — for example flagging a newer field as `additional properties ... not allowed`. (Kubernetes `Secret`s are already skipped by default to avoid SOPS-related failures.)\n\nSkip such kinds with the `--skip-kinds` flag:\n\n```bash\nksail workload validate --skip-kinds Coroot,SealedSecret\n```\n\n…or, so it also applies in CI (the `ksail-cluster` action with `validate: \"true\"`), via `ksail.yaml`:\n\n```yaml\nspec:\n workload:\n validation:\n skipKinds:\n - Coroot\n```\n\nThe flag and the configured kinds are merged. Skip only the kinds whose schema is genuinely unavailable — skipped resources are not validated at all.\n\n### Use `workload validate` Before Pushing\n\nCombine `workload validate` with `workload push` in your workflow to catch schema errors before they enter the GitOps pipeline:\n\n```bash\n# Validate first, then push if clean\nksail workload validate && ksail workload push\n```\n\nThis is the same pattern the `ksail-cluster` composite GitHub Action uses when `validate: \"true\"` is set. See [PR Preview Clusters](/guides/pr-preview-clusters/) for the full CI/CD workflow.\n\n### Multi-Environment Validation\n\nUse `--config` to validate against the settings of a specific environment:\n\n```bash\n# Validate against staging schema/constraints\nksail --config ksail.staging.yaml workload validate\n\n# Validate against production\nksail --config ksail.prod.yaml workload validate\n```\n\nSee [Multi-Environment Workflows](/guides/multi-environment/) for how to structure per-environment config files.\n\n## Supported Substitution Syntax\n\nKSail supports the standard Flux postBuild variable syntax:\n\n| Syntax | Behavior during validation |\n|--------|---------------------------|\n| `${VAR}` | Typed placeholder (schema-derived) |\n| `${VAR:-default}` | `default` value, coerced to schema type |\n| `${VAR:=default}` | `default` value, coerced to schema type |\n| `${VAR}` in mixed text | Replaced with `\"placeholder\"` (string) |\n\nOther Flux substitution forms (e.g., shell-style `$VAR` without braces, `$(VAR)` command substitution) are **not** expanded by KSail and are left as-is.\n" +const generatedDocumentation = "\n## Installation\n\n## Prerequisites\n\n### System Requirements\n\nKSail works on all major operating systems and modern CPU architectures:\n\n| OS | Architecture |\n| -------------------- | --------------- |\n| 🐧 Linux | amd64 and arm64 |\n| \uf8ff macOS | arm64 |\n| ⊞ Windows (native untested; WSL2 recommended) | amd64 and arm64 |\n\n### Docker (Required for the Docker Provider)\n\n**Docker is required** to create local clusters using the Docker provider. Install Docker Desktop or Docker Engine and ensure `docker ps` works.\n\n- [Install Docker Desktop](https://www.docker.com/get-started/)\n- [Install Docker Engine](https://docs.docker.com/engine/install/)\n\nAfter installation, verify Docker is running:\n\n```bash\ndocker ps\n```\n\n### Provider Support\n\nEach Kubernetes distribution runs on one or more infrastructure providers (Docker, Kubernetes, Hetzner, Omni, AWS), and you need access to at least one provider for your chosen distribution. See the [Support Matrix](/support-matrix/) for the full distribution × provider compatibility table and per-provider requirements.\n\n> [!NOTE]\n> The Kubernetes provider runs nested clusters as pods inside an existing host cluster — no Docker required on the host. See [Kubernetes Provider](/providers/kubernetes/) for setup details.\n> Talos on Hetzner requires a Hetzner Cloud account and API token (`HCLOUD_TOKEN`). Talos on Omni requires a [Sidero Omni](https://www.siderolabs.com/omni/) account, a service account key provided via environment variable (defaults to `OMNI_SERVICE_ACCOUNT_KEY`, configurable via `spec.provider.omni.serviceAccountKeyEnvVar`), and an Omni API endpoint configured via `spec.provider.omni.endpoint` in `ksail.yaml`.\n\n## Installation Methods\n\n\n \n ### Homebrew (macOS/Linux)\n\n The easiest way to install KSail on macOS or Linux:\n\n ```bash\n brew install --cask devantler-tech/tap/ksail\n ```\n\n This installs the latest stable release and makes `ksail` available in your PATH.\n\n \n\n \n ### Go Install\n\n If you have Go 1.26.1+ installed, you can build and install KSail via `go install`:\n\n ```bash\n go install github.com/devantler-tech/ksail/v7@latest\n ```\n\n This builds and installs the `ksail` binary to `$GOPATH/bin` (typically `~/go/bin`). Ensure this directory is in your PATH.\n\n \n\n \n ### Binary Download\n\n Download pre-built binaries from the [GitHub Releases](https://github.com/devantler-tech/ksail/releases) page:\n\n 1. Navigate to the [latest release](https://github.com/devantler-tech/ksail/releases/latest)\n 2. Download the appropriate binary for your OS and architecture\n 3. Extract the archive\n 4. Move the `ksail` binary to a directory in your PATH (e.g., `/usr/local/bin`)\n 5. Make it executable (Linux/macOS): `chmod +x ksail`\n\n \n\n \n ### Build from Source\n\n Clone the repository and build the binary:\n\n ```bash\n git clone https://github.com/devantler-tech/ksail.git\n cd ksail\n go build -o ksail\n ```\n\n The `ksail` binary will be created in the current directory. Move it to a directory in your PATH if desired.\n\n \n\n\n## Embedded Tools\n\nKSail embeds common Kubernetes tools as Go libraries — including kubectl, helm, kind (Vanilla), k3d (K3s), vcluster/Vind (VCluster), flux, argocd, sops, and others — so no separate installation is needed. All tools are accessible through KSail's unified CLI.\n\n## Optional: GitHub Copilot CLI (for AI Chat)\n\nInstall the [GitHub Copilot CLI](https://docs.github.com/en/copilot/how-tos/copilot-cli/install-copilot-cli) and run `copilot auth login`. Set `COPILOT_CLI_PATH` if the CLI is not in your PATH.\n\n> [!NOTE]\n> An active GitHub Copilot subscription is required. All other KSail features work without it.\n\n## VSCode Extension\n\nFor Visual Studio Code users, install the KSail extension to manage clusters directly from your editor.\n\n\n \n ### Install from Marketplace\n\n 1. Open VSCode\n 2. Press `Cmd+Shift+X` (macOS) or `Ctrl+Shift+X` (Windows/Linux) to open Extensions view\n 3. Search for \"KSail\" — or type `@mcp` to filter MCP-compatible extensions and find KSail there\n 4. Click **Install** on the extension by devantler\n\n **Marketplace Link:** [KSail - Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=devantler.ksail)\n\n \n\n \n ### Install from VSIX\n\n 1. Download the latest `.vsix` file from [GitHub Releases](https://github.com/devantler-tech/ksail/releases)\n 2. Open VSCode\n 3. Press `Cmd+Shift+P` (macOS) or `Ctrl+Shift+P` (Windows/Linux)\n 4. Type `Extensions: Install from VSIX...`\n 5. Select the downloaded `.vsix` file\n\n \n\n\n### Extension Prerequisites\n\n- **KSail CLI** installed and available in PATH (see [installation methods](#installation-methods) above)\n- **Docker** running (for cluster operations)\n- **K9s** (optional, for cluster connection via `Connect to Cluster` command)\n\nSee the [VSCode Extension](/integrations/vscode-extension/) guide for detailed capabilities, commands, and settings.\n\n## Verification\n\n```bash\nksail --version # show version\nksail --help # show all commands\n```\n\n## Support Matrix\n\nKSail supports multiple Kubernetes distributions, providers, and components. This matrix shows compatibility and support status.\n\n## Distribution × Provider Matrix\n\n| Distribution | Docker | Kubernetes | Hetzner | Omni | AWS |\n| ---------------- | ------ | ---------- | ------- | ---- | ----- |\n| Vanilla (Kind) | ✅ | ✅ | ❌ | ❌ | ❌ |\n| K3s (K3d) | ✅ | ✅ | ❌ | ❌ | ❌ |\n| Talos | ✅ | ✅ | ✅ | ✅ | ❌ |\n| VCluster (Vind) | ✅ | ✅ | ❌ | ❌ | ❌ |\n| KWOK (kwokctl) | ✅ | ✅ | ❌ | ❌ | ❌ |\n| EKS | ❌ | ❌ | ❌ | ❌ | 🚧¹⁰ |\n\n**Notes:**\n\n- Docker provider requires Docker Desktop or Docker Engine installed locally — see [Docker Provider](/providers/docker/) for setup details\n- Kubernetes provider runs nested cluster nodes as pods inside an existing host Kubernetes cluster — no Docker daemon required on the host; see [Kubernetes Provider](/providers/kubernetes/) for setup details\n- Hetzner provider requires `HCLOUD_TOKEN` environment variable and a Talos ISO uploaded to your Hetzner account (x86: `125127` for Talos 1.12.4; for ARM, look up the matching ISO ID in the Hetzner Cloud Console — see [Talos options](/configuration/declarative-configuration/#distribution-and-tool-options)) — see [Hetzner Provider](/providers/hetzner/) for setup details\n- Omni provider requires a [Sidero Omni](https://www.siderolabs.com/omni/) account, an `OMNI_SERVICE_ACCOUNT_KEY` environment variable, and an Omni API endpoint configured via `spec.provider.omni.endpoint` in your KSail configuration — see [Omni Provider](/providers/omni/) for setup details\n- ¹⁰ AWS provider requires AWS credentials and an AWS account with EKS permissions — see [AWS Provider](/providers/aws/) for setup details; `ksail cluster create` is not yet functional for EKS\n- VCluster uses the [Vind](https://github.com/loft-sh/vcluster) Docker driver to run the control plane and optional worker nodes directly as Docker containers\n- KWOK uses the kwokctl Docker runtime to run etcd, kube-apiserver, and kwok-controller as Docker containers — nodes and pods are simulated at the API level\n\n## Component × Distribution Matrix\n\n| Component | Vanilla | K3s | Talos | VCluster | KWOK | EKS |\n| ----------------------------- | ------- | -------- | ------------------- | -------- | -------- | ---------------- |\n| **CNI** |\n| Cilium | ✅ | ✅ | ✅ | N/A¹ | ❌¹¹ | ❌ |\n| Calico | ✅ | ✅ | ✅ | N/A¹ | ❌¹¹ | ❌ |\n| Amazon VPC CNI | ❌ | ❌ | ❌ | ❌ | ❌ | Built-in |\n| **CSI** |\n| Local Path Provisioner | ✅ | Built-in | ✅ (Docker) | N/A² | ❌¹² | ❌ |\n| Hetzner CSI Driver | ❌ | ❌ | ✅ (Hetzner) | ❌ | ❌ | ❌ |\n| Amazon EBS CSI Driver | ❌ | ❌ | ❌ | ❌ | ❌ | Built-in |\n| **LoadBalancer** |\n| LoadBalancer Support | ✅ | Built-in | ✅ (Docker/Hetzner) | N/A³ | Sim⁷ | Built-in |\n| Cloud Provider KIND | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |\n| MetalLB | ❌ | ❌ | ✅ (Docker) | ❌ | ❌ | ❌ |\n| Hetzner CCM | ❌ | ❌ | ✅ (Hetzner) | ❌ | ❌ | ❌ |\n| AWS Load Balancer Controller | ❌ | ❌ | ❌ | ❌ | ❌ | 🚧¹⁰ |\n| **GitOps** |\n| Flux | ✅ | ✅ | ✅ | ✅ | ❌⁹ | 🚧¹⁰ |\n| ArgoCD | ✅ | ✅ | ✅ | ✅ | Sim⁷ | 🚧¹⁰ |\n| **Observability** |\n| Metrics Server | ✅ | Built-in | ✅ | N/A⁴ | Sim⁷ | 🚧¹⁰ |\n| **Security** |\n| cert-manager | ✅ | ✅ | ✅ | ✅ | ❌¹² | 🚧¹⁰ |\n| Kyverno | ✅ | ✅ | ✅ | ✅ | ❌⁸ | 🚧¹⁰ |\n| Gatekeeper | ✅ | ✅ | ✅ | ✅ | ❌⁸ | 🚧¹⁰ |\n| **Registry** |\n| Local Registry | ✅ | ✅ | ✅ | ✅ | Sim⁷ | ❌ |\n| Mirror Registries | ✅ | ✅ | ✅ | ✅ | Sim⁷ | ❌ |\n| External Registries with Auth | ✅ | ✅ | ✅ | ✅ | Sim⁷ | 🚧¹⁰ |\n| **Image Verification** |\n| Image Verification | ✅⁶ | ❌ | ✅ (1.13+) | ❌ | ❌ | ❌ |\n\n**Notes:**\n\n- \"Built-in\" means the distribution includes this component by default\n- K3s includes local-path-provisioner, metrics-server, and ServiceLB (load balancer) out of the box\n- Talos CSI support is provider-dependent: Local Path Provisioner for Docker, Hetzner CSI Driver for Hetzner Cloud\n- **LoadBalancer support by distribution** — see [LoadBalancer Configuration](/configuration/loadbalancer/) for full details:\n - **Vanilla (Kind) on Docker**: Uses cloud-provider-kind (runs as external Docker container)\n - **K3s on Docker**: Uses built-in ServiceLB (Klipper-LB)\n - **Talos on Docker**: Uses MetalLB with default IP pool (172.18.255.200-172.18.255.250)\n - **Talos on Hetzner**: Uses Hetzner Cloud Load Balancer (cloud provider integration)\n- **VCluster footnotes:**\n - ¹ CNI is managed internally by the vCluster control plane — Vind configures networking within the Docker containers\n - ² CSI is managed internally by vCluster — no separate CSI driver needed\n - ³ LoadBalancer is delegated to the host cluster by vCluster — `spec.cluster.loadBalancer` has no effect on VCluster and KSail does not install any LoadBalancer controller\n - ⁴ Metrics Server is managed internally by vCluster\n- **⁷ KWOK Simulation**: Components are installed as API objects and their pods appear Running via KWOK's Stage simulation. They do not execute real workloads — KWOK simulates pod lifecycle at the API level. See [KWOK Distribution](/distributions/kwok/) for details.\n- **⁸ KWOK Policy Engines**: Kyverno and Gatekeeper are not installed on KWOK. Both register global `MutatingWebhookConfigurations` that intercept all Kubernetes API requests. On KWOK, no real pod serves the webhook endpoint, so every webhook call times out — breaking all subsequent Helm installs. KSail silently skips policy engine installation when `spec.cluster.distribution: KWOK` is set and emits a warning at cluster creation time.\n- **⁹ KWOK Flux**: Flux is not installed on KWOK. KSail skips Flux installation and configuration entirely (with a warning) because Flux cannot function on KWOK. GitOps reconciliation is not functional on KWOK, including with ArgoCD, because controller pods are only simulated and cannot sync resources. Use a non-KWOK distribution for real GitOps syncing, or use `ksail workload apply` on KWOK for non-GitOps manifest application.\n- **¹⁰ EKS (Planned)**: Full component installer support for EKS is in progress. `ksail project init` is available, but `ksail cluster create` is not yet functional. See [EKS Distribution](/distributions/eks/) for details.\n- **¹¹ KWOK CNI**: Cilium and Calico are not installed on KWOK. KWOK runs simulated pods with no real network dataplane, so CNI plugins are never functional and are always skipped. If a non-default CNI is configured in `ksail.yaml` for a KWOK cluster, KSail emits a warning and skips installation. The `spec.cluster.cni` setting has no effect on KWOK clusters.\n- **¹² KWOK CSI and cert-manager**: Local Path Provisioner (CSI) and cert-manager are not installed on KWOK. The Local Path Provisioner Deployment pod and cert-manager webhook pods require real container processes that KWOK does not provide, so readiness never becomes true and installation would time out. KSail skips installation of these components when `spec.cluster.distribution: KWOK` is set and emits a warning at cluster creation time.\n\n## Secret Management × Provider Matrix\n\n| Provider | Encryption | Decryption | Edit |\n| --------------- | ---------- | ---------- | ---- |\n| age | ✅ | ✅ | ✅ |\n| PGP | ✅ | ✅ | ✅ |\n| AWS KMS | ✅ | ✅ | ✅ |\n| GCP KMS | ✅ | ✅ | ✅ |\n| Azure Key Vault | ✅ | ✅ | ✅ |\n| HashiCorp Vault | ✅ | ✅ | ✅ |\n\n**Notes:**\n\n- Cloud KMS providers require appropriate credentials configured\n- See [SOPS documentation](https://github.com/getsops/sops) for provider-specific setup\n\n## CLI Commands\n\nSee the generated [CLI Flags reference](/cli-flags/) for the complete, always-current list of command groups, commands, and flags.\n\n## Update Behavior\n\nThe `ksail cluster update` command applies configuration changes to a running cluster.\nChanges are classified by impact: **in-place** (no disruption), **reboot-required** (node restart needed), or **recreate-required** (full cluster recreation).\n\n| Change | Vanilla (Kind) | K3s (K3d) | Talos | VCluster (Vind) | KWOK (kwokctl) | EKS |\n| ------------------------ | -------------- | --------- | -------- | --------------- | -------------- | ---------- |\n| Distribution | Recreate | Recreate | Recreate | Recreate | Recreate | 🚧¹⁰ |\n| Provider | Recreate | Recreate | Recreate | Recreate | Recreate | 🚧¹⁰ |\n| CNI | In-place | In-place | In-place | N/A | N/A¹¹ | 🚧¹⁰ |\n| CSI | N/A⁵ | In-place | In-place | N/A | ❌¹² | 🚧¹⁰ |\n| Metrics Server | In-place | In-place | In-place | N/A | Sim⁷ | 🚧¹⁰ |\n| Load Balancer | In-place | In-place | N/A¹ | N/A | Sim⁷ | 🚧¹⁰ |\n| cert-manager | In-place | In-place | In-place | In-place | ❌¹² | 🚧¹⁰ |\n| Policy Engine | In-place | In-place | In-place | In-place | ❌⁸ | 🚧¹⁰ |\n| GitOps Engine | In-place | In-place | In-place | In-place | Sim⁷ | 🚧¹⁰ |\n| Local Registry | Recreate | In-place | In-place | In-place | Sim⁷ | ❌ |\n| Mirrors Dir | Recreate | N/A | N/A | N/A | N/A | ❌ |\n| Control Planes | Recreate | Recreate | In-place | Recreate | Recreate | 🚧¹⁰ |\n| Workers | Recreate | In-place | In-place | N/A | N/A | 🚧¹⁰ |\n| Hetzner Server Type (CP) | N/A | N/A | Recreate | N/A | N/A | N/A |\n| Hetzner Location | N/A | N/A | Recreate | N/A | N/A | N/A |\n| Hetzner Network | N/A | N/A | Recreate | N/A | N/A | N/A |\n\n**Notes:**\n\n- \"In-place\" changes are applied without cluster downtime via Helm or provider APIs\n- \"Recreate\" changes trigger a cluster recreation. `ksail cluster update` will prompt before proceeding; use `--force` (or `-y` / `--yes`) to skip the prompt for non-interactive runs, or run `ksail cluster delete && ksail cluster create` manually.\n- If no changes are detected, `ksail cluster update` exits immediately with no modifications (idempotent no-op)\n- Use `ksail cluster update --dry-run` to preview changes before applying; add `--output json` for machine-readable diff output (suitable for CI gating or [MCP tools](/integrations/mcp/))\n- Talos supports the broadest set of in-place updates, including node scaling for both control-plane and worker nodes across all providers — including Omni (via declarative cluster template sync)\n- Kind does not support any structural node changes after creation\n- VCluster (Vind) runs control-plane and optional worker nodes as Docker containers — CNI, CSI, and metrics-server are managed by the vCluster Helm chart and are N/A for update operations; LoadBalancer services are provided by the host cluster, and `spec.cluster.loadBalancer` is ignored for VCluster and will not trigger a cluster update\n- **¹ Load Balancer for Talos**: For Talos, the provider determines which LoadBalancer implementation is used (MetalLB on Docker, Hetzner Cloud Controller Manager on Hetzner). The `spec.cluster.loadBalancer` setting controls whether KSail installs LoadBalancer support. See [FAQ](/faq/#which-distributions-support-loadbalancer-services) for details.\n- **⁵ CSI for Vanilla (Kind)**: Kind bundles local-path-provisioner by default. KSail's detector reports it as `CSIEnabled` but cannot distinguish Kind's bundled CSI from a KSail-installed CSI driver, so CSI comparison is skipped entirely during `ksail cluster update`. To change CSI settings on a Vanilla cluster, recreate it with `ksail cluster delete && ksail cluster create`.\n- **⁶ Image Verification for Vanilla (Kind)**: Uses the containerd `io.containerd.image-verifier.v1.bindir` plugin (requires containerd 2.x / Kind `v0.31.0+` / `kindest/node:v1.35.1+`). Verifier binaries (e.g., Cosign, Notation) must be pre-installed in a custom Kind node image at `/opt/image-verifier/bin`. See [Vanilla Image Verification](/distributions/vanilla/#image-verification).\n\n## Platform Requirements\n\n| Requirement | Minimum | Recommended |\n| ----------- | ---------------------------------------- | ------------- |\n| Docker | Docker Desktop 4.x or Docker Engine 24.x | Latest stable |\n| RAM | 4 GB | 8 GB+ |\n| CPU | 2 cores | 4 cores+ |\n| Disk | 10 GB | 20 GB+ |\n\n**Operating System Support:**\n\n| OS | Support |\n| --------------------- | ------- |\n| macOS (Apple Silicon) | ✅ |\n| Linux (x86_64) | ✅ |\n| Linux (arm64) | ✅ |\n| Windows (WSL2) | ✅ |\n| Windows (native) | ❌ |\n\n## Version Compatibility\n\nKSail embeds specific versions of Kubernetes tooling:\n\n| Tool | Embedded Version | Purpose |\n| ------------ | ----------------- | -------------------------- |\n| kubectl | Latest | Kubernetes CLI |\n| Helm | v4 (with kstatus) | Package manager |\n| Kind | Latest | Vanilla clusters |\n| K3d | Latest | K3s clusters |\n| vCluster SDK | v0.34.0 | VCluster virtual clusters |\n| kwokctl | Latest | KWOK simulated clusters |\n| Flux | Latest | GitOps toolkit |\n| ArgoCD | Latest | GitOps continuous delivery |\n| SOPS | Latest | Secret encryption |\n\n**Notes:**\n\n- Kubernetes versions depend on the distribution release\n- Component versions (CNI, CSI, etc.) are updated with KSail releases\n- See [releases](https://github.com/devantler-tech/ksail/releases) for specific version information\n\n## Troubleshooting\n\n## Cluster Creation Issues\n\n### Docker Connection Failed\n\nVerify Docker is running with `docker ps`. If not running, start Docker Desktop (macOS) or `sudo systemctl start docker` (Linux).\n\n### Cluster Creation Hangs\n\nCommon causes: insufficient resources, firewall blocking Docker network access, or leftover cluster state.\n\n```bash\nksail cluster list\nksail cluster delete --name \ndocker system prune -f\n```\n\n### Port Already in Use\n\nIf you see `Error: Port 5000 is already allocated`, specify a different port (e.g., `--local-registry localhost:5050`) or kill the conflicting process:\n\n**macOS/Linux:**\n\n```bash\nlsof -ti:5000 | xargs kill -9\n```\n\n**Windows (PowerShell):**\n\n```powershell\nnetstat -ano | findstr :5000\ntaskkill /PID /F\n```\n\n## GitOps Workflow Issues\n\n### Registry Access and Image Push Failures\n\nKSail automatically retries transient registry errors (HTTP 429, 5xx, timeouts) during cluster create/update and `ksail workload push` (up to 5 attempts, exponential backoff 5s–30s). For authentication errors, verify connectivity and credentials:\n\n```bash\ncurl -I https://registry.example.com/v2/\ndocker ps | grep registry\nksail project init --local-registry '${REG_USER}:${REG_TOKEN}@registry.example.com/my-org/my-repo'\n```\n\n- `external registry credentials are incomplete: username is set but password is empty` — a username was provided (e.g. `GITHUB_ACTOR` is set) but the password/token is missing. Export the token environment variable (e.g. `export GITHUB_TOKEN=...`) and ensure both are set in `spec.cluster.localRegistry.registry` in `ksail.yaml`, or re-initialize with `ksail project init --local-registry 'user:token@host/repo'`.\n- `registry requires authentication` — missing or incorrect `--local-registry` credentials\n- `registry access denied` — credentials lack write permission\n- `registry is unreachable` — DNS failure, firewall, or registry down\n\nTo diagnose mirror registry health:\n\n```bash\ndocker ps --filter label=io.ksail.registry --format 'table {{.Names}}\\t{{.Status}}'\ndocker inspect --format '{{json .State.Health}}' \n```\n\n### Flux Operator Installation Timeout\n\nFlux CRDs can take 7–10 minutes on resource-constrained systems; KSail allows up to 12 minutes. If timeouts persist, check resources (`docker stats`) and ensure 4 GB+ RAM.\n\n```bash\nksail workload get pods -n flux-system\nkubectl get crd -o jsonpath='{.status.conditions[?(@.type==\"Established\")].status}'\n```\n\n### Cluster Stability Check Failures\n\nKSail checks cluster stability at two points during installation:\n\n- **Before infrastructure components** (Cilium CNI only): Ensures the eBPF dataplane is ready before deploying components (like metrics-server) that depend on ClusterIP connectivity.\n- **Before GitOps engines**: Ensures the API server is fully ready — especially important for K3s/K3d clusters, which report creation success before the API server can serve requests.\n\nIf you see `cluster not stable before infrastructure installation`, `cluster not stable after infrastructure installation`, or `in-cluster API connectivity check failed`, check resources and optionally recreate with fewer components:\n\n```bash\nksail workload get nodes\nksail workload get pods -A | grep -v Running\nksail cluster delete && ksail cluster create\n```\n\nIf the error mentions `connectivity check pod image pull failed` with `ImagePullBackOff` or `ErrImagePull`, the check pod could not pull `busybox:stable` — typically a transient Docker Hub rate-limit or network issue. Verify reachability (`curl -I https://registry-1.docker.io/v2/`) and retry with `ksail cluster delete && ksail cluster create`.\n\n### Flux Reconciliation Fails Immediately\n\nWhen `ksail workload reconcile` fails, KSail automatically displays a [diagnostic report](/guides/gitops-workflows/#automatic-failure-diagnostics) showing failing resources, pods, and recent warning events. Use this output as a starting point before running manual `kubectl` commands.\n\n`ksail workload reconcile` automatically resets HelmReleases stuck in Failed or Stalled states before polling begins. If a HelmRelease reset does not resolve the issue, or if a Flux Kustomization encounters a permanent error, reconciliation also fails fast (without waiting for the timeout):\n\n- **Build failure** — Kustomize cannot render your manifests (invalid YAML, missing patches, schema errors). Fix the manifests and re-push.\n- **Health check failure** — A deployed workload failed its readiness/liveness probe. Check pod logs for the affected workload.\n- **Upstream dependency failure** — A Kustomization that another depends on failed permanently; dependent Kustomizations fail immediately to surface the root cause rather than timing out.\n\nRun `ksail workload get kustomization -n flux-system` and `ksail workload get pods -A | grep -v Running` to identify the failing resource and its error message.\n\n### Flux/ArgoCD Not Reconciling\n\nIf changes don't appear after `ksail workload reconcile`, check status and logs:\n\n```bash\nksail workload get pods -n flux-system # Flux\nksail workload get pods -n argocd # ArgoCD\nksail workload logs -n flux-system deployment/source-controller\nksail workload reconcile --timeout=5m\n```\n\n## Image Export Issues\n\n### Blob Integrity Check Failed\n\nAfter `ksail workload export`, KSail validates the SHA256 digest of every blob in the exported OCI tar archive. If a blob is truncated or corrupt — which `ctr export` can produce silently when containerd's content store has incomplete data (e.g., from an interrupted image pull or runner resource pressure) — you will see an error like:\n\n```text\nblob integrity check failed: blob blobs/sha256/: computed SHA256 (read N of M bytes)\n```\n\nor\n\n```text\nblob integrity check failed: tar archive is truncated or corrupted: ...\n```\n\n**Resolution**: The containerd content store on the node has an incomplete or corrupt blob for one of the exported images. Pull a fresh copy of the affected image locally and import it into the cluster to replace the corrupt data, then re-export:\n\n```bash\n# Pull a fresh copy of the affected image into your local Docker daemon\ndocker pull \n# Save it to a tar archive\ndocker save -o fresh.tar\n# Import the fresh image into the cluster\nksail workload import fresh.tar\n# Re-export\nksail workload export\n```\n\nIf the error spans multiple images or you cannot identify the affected image from the blob SHA, recreate the cluster to force a full re-pull of all images:\n\n```bash\nksail cluster delete && ksail cluster create\nksail workload export\n```\n\n## Component Installation Issues\n\n### Installation Failures and Timeouts\n\nKSail retries transient Helm registry errors automatically (5 attempts, exponential backoff). For persistent failures, check resources with `docker stats` and `curl -I https://ghcr.io`, then recreate: `ksail cluster delete && ksail cluster create`. On resource-constrained systems, increase Docker limits, skip optional components, or use K3s.\n\n## Configuration Issues\n\n### Invalid ksail.yaml\n\nValidate against the [schema](https://github.com/devantler-tech/ksail/blob/main/schemas/ksail-config.schema.json) or re-initialize: `ksail project init --name my-cluster --distribution Vanilla`\n\n### Environment Variables Not Expanding\n\nEnsure environment variables are set before running KSail. Verify with `echo $MY_TOKEN` before using `${MY_TOKEN}` in configuration.\n\n## LoadBalancer Issues\n\n### LoadBalancer Service Stuck in Pending\n\nIf `kubectl get svc` shows `` for `EXTERNAL-IP`, verify LoadBalancer is enabled in `ksail.yaml` (reinitialize with `--load-balancer Enabled` if not) and check the controller for your distribution:\n\n- **Vanilla**: `docker ps | grep ksail-cloud-provider-kind`\n- **Talos**: `kubectl get pods -n metallb-system`\n- **Hetzner**: `kubectl get pods -n kube-system | grep hcloud`\n\n### Cannot Access LoadBalancer IP\n\nIf connection fails despite an external IP, ensure the application listens on `0.0.0.0` (not `127.0.0.1`). Debug with `kubectl logs -l app=my-app`, `kubectl describe svc my-app`, and `kubectl exec -it -- netstat -tlnp` to check listening ports.\n\n### MetalLB IP Pool Exhausted\n\nIf new LoadBalancer services remain pending after several successful allocations, the MetalLB IP pool is exhausted. See the [LoadBalancer Configuration Guide](/configuration/loadbalancer/#troubleshooting) to expand the address range.\n\n## Network Issues\n\n### CNI Installation Failed\n\nIf pods are stuck in `ContainerCreating` with CNI errors, check CNI pods with `ksail workload get pods -n kube-system -l k8s-app=cilium` (or `calico-node`). If failed, recreate: `ksail project init --cni Cilium && ksail cluster create`\n\n## Talos Issues\n\n### Transient Image Pull Failures\n\nKSail automatically retries transient Talos node image pull failures (up to 3 attempts, exponential backoff 5s–30s) to handle network glitches from `ghcr.io` (e.g., 504 Gateway Timeout). `Talos image pull attempt N failed (retrying in Xs): ...` messages are expected — no action required.\n\nIf all retries fail, check your internet connection and `ghcr.io` availability with `curl -I https://ghcr.io/v2/`, then retry with `ksail cluster delete && ksail cluster create`.\n\n### \"failed to append CA certificate to RootCAs pool\" on `cluster update`\n\n`ksail cluster update` against a Talos cluster fails with:\n\n```text\nfailed to apply updates: failed to sync cluster secrets:\n failed to create Talos client for secret sync:\n failed to create Talos client from saved config:\n failed to create client connection:\n failed to append CA certificate to RootCAs pool\n```\n\nThis means the CA certificate stored under the current context in `~/.talos/config` is structurally malformed. KSail validates the saved CA before opening a Talos client and surfaces the path, context name, and underlying X.509 parse error.\n\n**Recover automatically:**\n\n```bash\nksail cluster repair\n```\n\nThe `talosconfig-ca` repair detects a known single-byte BasicConstraints corruption pattern, fixes it in place, and writes a timestamped backup (`~/.talos/config.bak.`) before overwriting. The repair is idempotent and only modifies CA bytes whose corruption it recognizes.\n\n**Verify manually** (optional):\n\n```bash\nyq '.contexts..ca' ~/.talos/config | base64 -d | openssl x509 -noout -text\n```\n\nIf neither the repair nor a backup restore work, regenerate the talosconfig by re-running `ksail cluster create` (note: this requires destroying and recreating the cluster).\n\n## VCluster Issues\n\n### Transient Startup Failures\n\nKSail automatically retries transient VCluster startup failures (up to 5 attempts, 5-second delay), including exit status 22/EINVAL, D-Bus errors, network transients, GHCR pull failures, and node join timeouts (kubelet TLS bootstrap). `Retrying vCluster create (attempt 2/5)...` messages are expected — no action required.\n\nIf all retries fail, check Docker resource limits and D-Bus availability. See the [VCluster guide](/distributions/vcluster/#troubleshooting) for details.\n\n### kubectl Commands Fail After VCluster Creation\n\nWait a few seconds if `kubectl get nodes` returns connection errors immediately after creation — VCluster control planes need time to start. Verify the active context with `kubectl config current-context` and `ksail workload get nodes`.\n\n## Hetzner Cloud Issues\n\n- **HCLOUD_TOKEN not working**: Verify read/write permissions (Hetzner Cloud Console → Security → API Tokens). Test with `hcloud server list` if installed.\n- **Talos ISO not found**: The default ISO ID may be outdated. Find the correct ID in [Hetzner Cloud Console](https://console.hetzner.com/) under Images → ISOs.\n\n## Getting More Help\n\nCheck [GitHub Issues](https://github.com/devantler-tech/ksail/issues) and [Discussions](https://github.com/devantler-tech/ksail/discussions). When reporting issues, include KSail version, OS, Docker version, `ksail.yaml`, error messages, and reproduction steps.\n\n## Faq\n\n## General Questions\n\n### What is KSail?\n\nKSail is a CLI tool that bundles common Kubernetes tooling into a single binary. It provides a unified interface to create clusters, deploy workloads, and operate cloud-native stacks across different Kubernetes distributions and infrastructure providers.\n\n### Why use KSail instead of kubectl/helm/kind/k3d directly?\n\nKSail eliminates tool sprawl by embedding kubectl, helm, kind, k3d, vcluster, flux, and argocd into one binary with a consistent workflow across distributions. It uses standard native config files (kind.yaml, k3d.yaml, vcluster.yaml), provides declarative configuration with built-in best practices, and includes GitOps integration—without vendor lock-in.\n\n### Am I locked into KSail?\n\nNo. KSail generates native configuration files usable directly with their respective tools:\n\n```bash\nkind create cluster --config kind.yaml\nk3d cluster create --config k3d.yaml\ntalosctl cluster create --config-patch @talos/cluster/patches.yaml\nvcluster create my-cluster --values vcluster.yaml\n```\n\n### Is KSail production-ready?\n\nKSail targets **local development, CI/CD, and learning environments**. For production, use managed services (EKS, GKE, AKS) with proper HA and security. The Talos Hetzner provider suits personal homelabs but should be evaluated carefully for production use.\n\n## Installation & Setup\n\n### Which operating systems does KSail support?\n\nKSail supports Linux (amd64, arm64), macOS (arm64/Apple Silicon), and Windows (WSL2 recommended). See the [Installation Guide](/installation/) for details.\n\n### Do I need to install Docker, kubectl, helm, etc.?\n\nDocker is required for local cluster creation. KSail embeds kubectl, helm, kind, k3d, vcluster, flux, and argocd as Go libraries—no separate installation needed. For Hetzner cloud clusters, you need a Hetzner account and API token.\n\n### How do I update KSail?\n\nThe update method depends on how you installed it:\n\n```bash\nbrew upgrade devantler-tech/tap/ksail # Homebrew\ngo install github.com/devantler-tech/ksail/v7@latest # Go install\n# Binary: https://github.com/devantler-tech/ksail/releases\n```\n\n## Cluster Management\n\n### Which Kubernetes distributions does KSail support?\n\nKSail currently supports **Vanilla** (Kind), **K3s** (K3d), **Talos**, **VCluster** (Vind), **KWOK** (kwokctl, simulated), and **EKS** (scaffolding available; `ksail cluster create` is not yet functional). See the [Support Matrix](/support-matrix/) for current provider compatibility and feature status.\n\n### Can I create multiple clusters?\n\nYes. Use `ksail project init --name ` then `ksail cluster create` for each cluster. List all with `ksail cluster list`.\n\n### How do I create an ephemeral cluster that auto-destroys?\n\nUse `--ttl` with `ksail cluster create`. The process blocks until the TTL elapses, then auto-deletes the cluster and its state. Press Ctrl+C to cancel the wait and keep the cluster running.\n\n```bash\n# Cluster auto-destroys after 1 hour\nksail cluster create --ttl 1h\n\n# Supported duration formats: 30m, 1h, 2h30m\n```\n\nFor usage patterns and tips, see [Ephemeral Clusters](/guides/ephemeral-clusters/).\n\n### How do I switch between clusters?\n\nUse `ksail cluster switch` for the native experience. Run it without arguments for an interactive picker, or pass a cluster name directly:\n\n```bash\nksail cluster switch # interactive picker — recent clusters shown first (requires a TTY)\nksail cluster switch dev # switch directly to \"dev\"\n```\n\nThe interactive picker orders recently-switched clusters (up to the last 5) at the top, making it fast to cycle between a small set of active clusters. History is saved to `~/.ksail/switch-history.json`.\n\nYou can also use `kubectl config use-context ` directly, or list all contexts with `kubectl config get-contexts`.\n\n### Can I use my own container registry?\n\nYes! KSail supports local registries with optional authentication, mirror registries to avoid rate limits, and external registries with authentication. Credentials are automatically discovered from Docker config (`~/.docker/config.json`), environment variables, or GitOps secrets. See [Registry Management](/guides/registry-management/) for configuration examples.\n\n### What happens if I change the distribution or provider in ksail.yaml?\n\nChanging the distribution (e.g., Vanilla to Talos) or provider (e.g., Docker to Hetzner) requires full cluster recreation. Delete the old cluster with `ksail cluster delete`, then run `ksail cluster create`.\n\n### Which distributions support LoadBalancer services?\n\nLoadBalancer support varies by distribution and provider:\n\n- **Vanilla**: cloud-provider-kind\n- **K3s**: built-in ServiceLB\n- **Talos/Docker**: MetalLB (pool 172.18.255.200-172.18.255.250); **Talos/Hetzner**: Hetzner Cloud Load Balancer\n- **VCluster**: delegates to host cluster (`spec.cluster.loadBalancer` has no effect)\n- **KWOK**: simulated via API (no real traffic routing)\n- **EKS**: built-in AWS Load Balancer Controller (planned)\n\nSee the [Support Matrix](/support-matrix/#component--distribution-matrix) for the full compatibility table.\n\n### Can I add nodes to an existing cluster?\n\nNode scaling support depends on the distribution: Talos supports both control-plane and worker nodes via `ksail cluster update`, K3s supports worker (agent) nodes only (server scaling requires recreation), and Vanilla (Kind) requires full recreation. See the [Update Behavior](/support-matrix/#update-behavior) table for details.\n\n### What does `ksail cluster update --dry-run` show?\n\nPreviews all detected configuration changes without applying them. Each change is listed with an emoji classification and `old → new` values:\n\n- 🟢 **In-place** — applied without disruption\n- 🟡 **Reboot-required** — applied but requires node reboots\n- 🔴 **Recreate-required** — requires full cluster recreation\n\nOutputs `No changes detected` when configuration is already in sync.\n\n### What happens when I run `ksail cluster update` with no changes?\n\nIt compares the current cluster state against `ksail.yaml` and exits with `No changes detected` if nothing has changed—making it safe to run frequently in CI/CD pipelines.\n\n## Workload Management\n\n### What's the difference between `ksail workload apply` and `ksail workload reconcile`?\n\n`apply` deploys directly (kubectl-style, no GitOps); `reconcile` syncs via Flux or ArgoCD for Git-driven deployments.\n\n### Can I use Helm charts with KSail?\n\nYes. KSail includes Helm v4. Use `ksail workload install --namespace ` to install a chart, or `ksail workload gen helmrelease --source=oci://registry/chart` to generate a HelmRelease for GitOps.\n\n### How do I debug failing pods?\n\nUse `ksail workload logs ` to view logs, `ksail workload describe ` to inspect resources, and `ksail workload exec -- /bin/sh` to shell into a container.\n\n## GitOps\n\n### Which GitOps tools does KSail support?\n\nKSail supports both **Flux** and **ArgoCD**, chosen with `--gitops-engine Flux` or `--gitops-engine ArgoCD` during `ksail project init`.\n\n### Do I need a Git repository for GitOps?\n\nNot necessarily. KSail packages manifests as OCI artifacts and pushes to a local registry, enabling GitOps without Git (useful for local development):\n\n```bash\nksail project init --gitops-engine Flux --local-registry localhost:5050\nksail cluster create\nksail workload push\nksail workload reconcile\n```\n\nTo use your own Git repository, configure the GitOps engine after initialization—KSail scaffolds the initial CRs.\n\n### Why does Flux operator installation take so long?\n\nFlux operator CRDs can take 7-12 minutes to become established on resource-constrained systems; KSail handles this automatically with a 12-minute timeout. Ensure 4GB+ RAM is available. See [Troubleshooting - Flux Operator Installation Timeout](/troubleshooting/#flux-operator-installation-timeout) for details.\n\n## Configuration\n\n### What's the difference between CLI flags and ksail.yaml?\n\nCLI flags provide quick overrides and scripting support, while ksail.yaml offers declarative configuration suitable for version control and team consistency. CLI flags override ksail.yaml values. See [Configuration Overview](/configuration/).\n\n### Can I version control my cluster configuration?\n\nYes! Commit `ksail.yaml` (and generated distribution configs like kind.yaml) to Git—team members can recreate the same cluster from it.\n\n### How do I share configurations between environments?\n\nUse the `--config` flag to point KSail at environment-specific files:\n\n```bash\nksail --config ksail.dev.yaml cluster create\nksail --config ksail.staging.yaml cluster update\nksail --config ksail.prod.yaml workload push\n```\n\nAlternatively, use environment variable placeholders in a shared `ksail.yaml`. For a complete walkthrough covering both approaches and CI/CD patterns, see [Multi-Environment Workflows](/guides/multi-environment/).\n\n## Security & Secrets\n\n### How do I manage secrets with KSail?\n\nKSail includes **SOPS** for secret encryption via `ksail workload cipher ` (age, PGP, cloud KMS). See [Secret Management](/guides/secret-management/).\n\n### Are my credentials stored securely?\n\nKSail expands `${VAR}` syntax at runtime; credentials are never stored in config files. Example: `ksail project init --local-registry 'user:${REGISTRY_TOKEN}@registry.example.com'` (set `REGISTRY_TOKEN` before running).\n\n## Licensing\n\n### Why is KSail licensed under PolyForm Shield 1.0.0?\n\nKSail was relicensed from Apache-2.0 (via GPL-3.0-only in [#4543](https://github.com/devantler-tech/ksail/pull/4543)) to [PolyForm Shield 1.0.0](https://polyformproject.org/licenses/shield/1.0.0) in [#4603](https://github.com/devantler-tech/ksail/pull/4603) (May 2026). The PolyForm Shield license allows anyone to use, modify, and distribute KSail for any purpose — except providing a competing product. This protects the project from commercial exploitation while keeping the code freely available for all other use cases.\n\n### Is KSail open source?\n\nKSail is **source-available**, not open source by the [OSI definition](https://opensource.org/osd). The non-compete clause disqualifies it from OSI approval. In practice, the difference only matters if you intend to build a competing product — for all other use cases (CLI tool, library, internal tooling, learning, forking), KSail works exactly like an open-source project.\n\n### Can I use KSail in my proprietary project?\n\n**Yes.** PolyForm Shield does not impose copyleft requirements — your project can use any license. You can use KSail as a CLI tool, embed it as a Go library, or incorporate its code into your own projects. If you redistribute KSail or derivatives, you must include the [license terms](https://polyformproject.org/licenses/shield/1.0.0) and required copyright notice, and the non-compete restriction still applies.\n\n### What counts as \"competing\"?\n\nThe [PolyForm Shield license](https://polyformproject.org/licenses/shield/1.0.0) defines competition broadly: goods and services compete even across different interfaces, platforms, or programming languages, and even when provided free of charge. If you market a product as a practical substitute for KSail, it competes.\n\n### How does the license affect contributors?\n\nBy submitting a pull request, you agree that your contribution is licensed under PolyForm Shield 1.0.0. Any third-party code included in contributions must be compatible with this license. See [CONTRIBUTING.md](https://github.com/devantler-tech/ksail/blob/main/CONTRIBUTING.md) for details.\n\n## Troubleshooting\n\nFor common solutions, see the [Troubleshooting Guide](/troubleshooting/). To clean up all cluster and Docker resources, run `ksail cluster delete && docker system prune`. For help, visit [GitHub Discussions](https://github.com/devantler-tech/ksail/discussions) or [GitHub Issues](https://github.com/devantler-tech/ksail/issues).\n\n## Declarative Configuration\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\nKSail uses declarative YAML configuration files for reproducible cluster setup. This page describes `ksail.yaml` — the project-level configuration file that defines your cluster's desired state.\n\n## What is ksail.yaml?\n\nEach KSail project includes a `ksail.yaml` file describing cluster distribution, networking, components, and workload configuration. Run `ksail project init` to generate it — commit to version control to share with your team.\n\n## Environment Variable Expansion\n\nKSail supports environment variable expansion in all string configuration values using the `${VAR_NAME}` syntax for secure credentials, environment-specific paths, and dynamic values.\n\n### Syntax\n\n**Basic syntax:** `${VARIABLE_NAME}` — Reference an environment variable. If not set, expands to an empty string and logs a warning.\n\n**Default value syntax:** `${VARIABLE_NAME:-default}` — Use a default value if the variable is not set. No warning is logged when using defaults.\n\n```yaml\nspec:\n editor: \"${EDITOR:-vim}\"\n cluster:\n connection:\n kubeconfig: \"${HOME}/.kube/config\"\n context: \"${KUBE_CONTEXT:-kind-kind}\"\n distributionConfig: \"${CONFIG_DIR:-configs}/kind.yaml\"\n localRegistry:\n registry: \"${REGISTRY:-localhost:5000}\"\n vanilla:\n mirrorsDir: \"${MIRRORS_DIR:-mirrors}\"\n talos:\n config: \"${TALOS_CONFIG_PATH:-~/.talos/config}\"\n provider:\n hetzner:\n sshKeyName: \"${HCLOUD_SSH_KEY}\"\n workload:\n sourceDirectory: \"${WORKLOAD_DIR:-k8s}\"\n chat:\n model: \"${CHAT_MODEL:-gpt-4o}\"\n```\n\n### Expansion Behavior\n\n| Syntax | Variable Set | Variable Not Set |\n| ----------------- | ------------ | ------------------------- |\n| `${VAR}` | Uses value | Empty string + warning |\n| `${VAR:-default}` | Uses value | Uses default (no warning) |\n| `${VAR:-}` | Uses value | Empty string (no warning) |\n\n### Scope\n\nEnvironment variables are expanded in all string fields of `ksail.yaml`, distribution configs (`kind.yaml`, `k3d.yaml`), and Talos patch files (`talos/cluster/`, `talos/control-planes/`, `talos/workers/`):\n\n```yaml\n# kind.yaml - Environment variables are expanded before parsing\nkind: Cluster\napiVersion: kind.x-k8s.io/v1alpha4\ncontainerdConfigPatches:\n - |-\n [plugins.\"io.containerd.grpc.v1.cri\".registry.mirrors.\"${REGISTRY:-localhost:5000}\"]\n endpoint = [\"http://${REGISTRY:-localhost:5000}\"]\n```\n\n```yaml\n# talos/cluster/registry.yaml - Environment variables are expanded\nmachine:\n registries:\n mirrors:\n docker.io:\n endpoints:\n - http://${REGISTRY:-localhost:5000}\n```\n\nBecause patch files are expanded too, you can inject **registry credentials** into the Talos\nmachine config as config-as-code — keeping the secret in the environment, never committed. This is\nthe supported way to give nodes registry auth (for example, so containerd can fetch cosign\nsignatures for **private** packages during image verification) without passing credentials via CLI\nflags:\n\n```yaml\n# talos/cluster/registry-auth.yaml - Credentials are injected from the environment at load time\nmachine:\n registries:\n config:\n ghcr.io:\n auth:\n username: my-user\n password: ${GHCR_TOKEN} # expanded at load; commit the placeholder, not the token\n```\n\n### Example: Credentials\n\n```yaml\nspec:\n cluster:\n localRegistry:\n registry: \"${REGISTRY_USER}:${REGISTRY_PASS}@${REGISTRY_HOST:-ghcr.io}/myorg/myrepo\"\n```\n\n```bash\nexport REGISTRY_USER=\"github-user\"\nexport REGISTRY_PASS=\"ghp_secrettoken123\"\nksail cluster create\n```\n\n### Example: Multi-Environment Setup\n\n```yaml\nspec:\n cluster:\n connection:\n context: \"${CLUSTER_NAME:-kind-kind}\"\n distributionConfig: \"${ENV:-dev}/kind.yaml\"\n workload:\n sourceDirectory: \"${ENV:-dev}/k8s\"\n```\n\n```bash\n# Development (using defaults)\nksail cluster create\n\n# Production (override with environment variables)\nexport ENV=\"prod\"\nexport CLUSTER_NAME=\"prod-cluster\"\nksail cluster create\n```\n\n## Minimal Example\n\n```yaml\n# yaml-language-server: $schema=https://raw.githubusercontent.com/devantler-tech/ksail/main/schemas/ksail-config.schema.json\napiVersion: ksail.io/v1alpha1\nkind: Cluster\nspec:\n cluster:\n distribution: Vanilla\n distributionConfig: kind.yaml\n```\n\nThis minimal configuration creates a Vanilla cluster (implemented with Kind) using defaults for all other settings.\n\n## Complete Example\n\n```yaml\n# yaml-language-server: $schema=https://raw.githubusercontent.com/devantler-tech/ksail/main/schemas/ksail-config.schema.json\napiVersion: ksail.io/v1alpha1\nkind: Cluster\nspec:\n editor: code --wait\n cluster:\n distribution: Vanilla\n distributionConfig: kind.yaml\n connection:\n kubeconfig: ~/.kube/config\n context: kind-kind\n timeout: 5m\n cni: Cilium\n csi: Default\n metricsServer: Enabled\n certManager: Enabled\n policyEngine: Kyverno\n localRegistry:\n registry: localhost:5050\n gitOpsEngine: Flux\n workload:\n sourceDirectory: k8s\n validateOnPush: true\n```\n\n## Configuration Reference\n\n### Top-Level Fields\n\n| Field | Type | Required | Description |\n| ----- | ---- | -------- | ----------- |\n| `apiVersion` | string | Yes | Must be `ksail.io/v1alpha1` |\n| `kind` | string | Yes | Must be `Cluster` |\n| `spec` | object | Yes | Cluster and workload specification (see below) |\n\n### spec\n\nThe `spec` field is a `Spec` object that defines editor, cluster, and workload configuration.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `editor` | string | – | Editor command for interactive workflows (e.g. code --wait). CLI-only; ignored by the operator. |\n| `cluster` | ClusterSpec | – | Cluster configures the Kubernetes cluster KSail manages: distribution, provider, components, and connection settings. |\n| `provider` | ProviderSpec | – | Provider holds infrastructure-provider-specific options (Hetzner, Omni, AWS, GCP, and the Kubernetes provider for nested clusters). |\n| `workload` | WorkloadSpec | – | Workload configures workload management: the manifest source directory, OCI push and validation settings, and GitOps bootstrap options. |\n| `chat` | ChatSpec | – | Chat configures the KSail AI chat assistant. CLI-only; ignored by the operator (the Cluster CRD shares this type but never reads it). |\n\n### spec.editor\n\nEditor command for interactive workflows (e.g., `code --wait`, `vim`). Falls back to `SOPS_EDITOR`, `KUBE_EDITOR`, `EDITOR`, `VISUAL`, or system defaults.\n\n### spec.cluster (ClusterSpec)\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `distributionConfig` | string | – | Path to the distribution's own configuration file (kind.yaml |\n| `connection` | Connection | – | Connection defines how KSail connects to the cluster: the kubeconfig path, context name, and operation timeout. CLI-only (local kubeconfig path/context); ignored by the operator. |\n| `distribution` | enum | – | Distribution selects the Kubernetes distribution to provision: Vanilla (Kind), K3s (K3d), Talos, VCluster, KWOK (simulated), EKS (AWS), or GKE (Google Cloud). |\n| `provider` | enum | – | Provider selects the infrastructure that runs the cluster nodes: Docker, Hetzner, Omni, AWS, GCP, or Kubernetes (nested clusters inside an existing cluster). Each distribution supports a subset of providers; when empty, KSail uses the distribution's default provider. |\n| `cni` | enum | – | CNI selects the Container Network Interface plugin. Default keeps the distribution's built-in CNI; Cilium or Calico install that CNI instead. |\n| `csi` | enum | – | CSI controls Container Storage Interface support. Default keeps the distribution's behavior; Enabled installs a CSI driver (local-path-provisioner, or Hetzner CSI on Hetzner); Disabled installs none. |\n| `cdi` | enum | – | CDI controls Container Device Interface support in the container runtime (Default, Enabled, or Disabled). |\n| `metricsServer` | enum | – | MetricsServer controls metrics-server installation. Default keeps the distribution's behavior; Enabled or Disabled override it. |\n| `loadBalancer` | enum | – | LoadBalancer controls load-balancer support. Default keeps the distribution and provider behavior; Enabled or Disabled override it. |\n| `certManager` | enum | – | CertManager controls whether cert-manager is installed (Enabled or Disabled). |\n| `imageVerification` | enum | – | Container-image signature verification scaffolding for all distributions: Talos scaffolds an ImageVerificationConfig document (1.13+); Vanilla/Kind injects a containerd verifier plugin patch; K3s/K3d scaffolds a containerd config template and mounts it into node containers. Requires verifier binaries (and typically policy) in the node image bin_dir. Disabled skips it. |\n| `policyEngine` | enum | – | PolicyEngine selects the policy engine to install: None, Kyverno, or Gatekeeper. |\n| `localRegistry` | LocalRegistry | – | LocalRegistry configures the host-local OCI registry (or an external registry for cloud providers) used by GitOps workflows. |\n| `gitOpsEngine` | enum | – | GitOpsEngine selects the GitOps engine KSail bootstraps: None, Flux, or ArgoCD. |\n| `sops` | SOPS | – | SOPS configures automatic creation of the SOPS Age secret used to decrypt encrypted manifests in the cluster. |\n| `nodeAutoscaling` | enum | – | Deprecated. Use autoscaler.node.enabled instead. Do not set both nodeAutoscaling and autoscaler. |\n| `autoscaler` | AutoscalerConfig | – | Pod and node autoscaling configuration (supersedes deprecated nodeAutoscaling) |\n| `importImages` | string | – | Path to tar archive with container images to import after cluster creation but before component installation |\n| `controlPlanes` | int32 | `1` | Number of control-plane nodes to create for the cluster (provider/distribution-agnostic) |\n| `workers` | int32 | – | Number of worker nodes to create for the cluster (provider/distribution-agnostic) |\n| `kubernetesVersion` | string | – | Kubernetes version to deploy. When set: cluster create/update reconcile toward it. When unset: cluster update follows the latest stable version and new clusters use a default compatible with the pinned Talos version. |\n| `oidc` | OIDCSpec | – | OIDC authentication configuration for the API server and kubeconfig |\n| `vanilla` | OptionsVanilla | – | Vanilla holds options specific to the Vanilla (Kind) distribution. |\n| `talos` | OptionsTalos | – | Talos holds options specific to the Talos distribution. |\n\n#### distribution\n\nSee [Distributions](/concepts/#distributions) for detailed information.\n\n- `Vanilla` (default) – Standard upstream Kubernetes via [Kind](https://kind.sigs.k8s.io/)\n- `K3s` – Lightweight Kubernetes via [K3d](https://k3d.io/)\n- `Talos` – [Talos Linux](https://www.talos.dev/) in Docker containers or Hetzner Cloud servers\n- `VCluster` – Virtual clusters via [vCluster](https://www.vcluster.com/)\n- `KWOK` – Simulated clusters via [KWOK](https://kwok.sigs.k8s.io/) (control-plane only, no real workloads)\n- `EKS` – Amazon Elastic Kubernetes Service via [eksctl](https://eksctl.io/) (requires AWS credentials and the `eksctl` CLI on `PATH`)\n- `GKE` – Google Kubernetes Engine via the native Go SDK (requires Google Cloud Application Default Credentials and a project via `GOOGLE_CLOUD_PROJECT`)\n\n#### provider\n\nSee [Providers](/concepts/#providers) for more details.\n\n- `Docker` (default) – Run nodes as Docker containers (local development)\n- `Hetzner` – Run nodes on Hetzner Cloud servers (requires `HCLOUD_TOKEN`)\n- `Omni` – Manage Talos cluster nodes through [Sidero Omni](https://omni.siderolabs.com/)\n- `AWS` – Manage EKS clusters on Amazon Web Services (requires standard AWS SDK credentials)\n- `GCP` – Manage GKE clusters on Google Cloud (requires Application Default Credentials)\n\n> [!NOTE]\n> Hetzner and Omni providers are only supported with the `Talos` distribution. The AWS provider is only supported with the `EKS` distribution, and the GCP provider only with the `GKE` distribution.\n\n#### distributionConfig\n\nPath to the distribution-specific configuration file or directory. This tells KSail where to find settings like node counts, port mappings, and distribution-specific features.\n\n**Default values by distribution:**\n\n- `Vanilla` → `kind.yaml`\n- `K3s` → `k3d.yaml`\n- `Talos` → `talos/` (directory)\n- `VCluster` → `vcluster.yaml`\n- `KWOK` → `kwok/` (directory)\n- `EKS` → `eks.yaml`\n- `GKE` → `gke.yaml` (optional – the GKE API owns the cluster shape)\n\nSee [Distribution Configuration](#distribution-configuration) below for details on each format.\n\n#### connection (Connection)\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `kubeconfig` | string | `~/.kube/config` | Path to kubeconfig file |\n| `context` | string | (derived) | Kubeconfig context name |\n| `timeout` | duration | – | Timeout for cluster operations |\n\n**Context defaults by distribution:**\n\n- `Vanilla` → `kind-kind`\n- `K3s` → `k3d-k3d-default`\n- `Talos` (Docker/Hetzner) → `admin@talos-default`\n- `Talos` (Omni) → the context name generated by Omni (e.g., `devantler-prod`)\n- `VCluster` → `vcluster-docker_vcluster-default`\n- `KWOK` → `kwok-kwok-default`\n\nWhen using Talos with Omni, Omni generates the context name; set `spec.cluster.connection.context` to that generated name.\n\n**Timeout format:** Go duration string (e.g., `30s`, `5m`, `1h`)\n\n#### cni\n\nSee [CNI](/concepts/#container-network-interface-cni) for more details.\n\n- `Default` (default) – Uses the distribution's built-in CNI (`kindnetd` for Vanilla, `flannel` for K3s)\n- `Cilium` – Installs [Cilium](https://cilium.io/) for advanced networking and observability\n- `Calico` – Installs [Calico](https://www.tigera.io/project-calico/) for network policies\n\n#### csi\n\nSee [CSI](/concepts/#container-storage-interface-csi) for more details.\n\n- `Default` (default) – Uses the distribution × provider's default behavior:\n - K3s: includes local-path-provisioner\n - Vanilla/Talos × Docker: no CSI\n - Talos × Hetzner: includes Hetzner CSI driver\n- `Enabled` – Explicitly installs CSI driver (local-path-provisioner for local clusters, Hetzner CSI for Talos × Hetzner)\n- `Disabled` – Disables CSI installation (for K3s, this disables the default local-storage)\n\n#### metricsServer\n\nWhether to install [metrics-server](/concepts/#metrics-server) for resource metrics.\n\n- `Default` (default) – Uses distribution's default behavior (K3s includes metrics-server; Vanilla and Talos do not)\n- `Enabled` – Install metrics-server\n- `Disabled` – Skip installation\n\nWhen metrics-server is enabled on Vanilla or Talos, KSail automatically:\n\n1. Configures kubelet certificate rotation (`serverTLSBootstrap: true`)\n2. Installs [kubelet-csr-approver](/concepts/#kubelet-csr-approver) to approve certificate requests\n3. Deploys metrics-server with secure TLS communication\n\n#### certManager\n\nWhether to install [cert-manager](/concepts/#cert-manager) for TLS certificate management.\n\n- `Enabled` – Install cert-manager\n- `Disabled` (default) – Skip installation\n\n#### policyEngine\n\nPolicy engine to install for enforcing security, compliance, and best practices. See [Policy Engines](/concepts/#policy-engines) for details.\n\n- `None` (default) – No policy engine\n- `Kyverno` – Install [Kyverno](https://kyverno.io/)\n- `Gatekeeper` – Install [OPA Gatekeeper](https://open-policy-agent.github.io/gatekeeper/)\n\n#### localRegistry\n\nRegistry configuration for GitOps workflows. Supports local Docker registries or external registries with authentication.\n\n**Format:** `[user:pass@]host[:port][/path]`\n\n**Examples:**\n\n- `localhost:5050` – Local Docker registry\n- `ghcr.io/myorg/myrepo` – GitHub Container Registry\n- `${USER}:${PASS}@ghcr.io:443/myorg` – With credentials from environment variables\n\n> [!NOTE]\n> Credentials support `${ENV_VAR}` placeholders for secure handling.\n\n#### gitOpsEngine\n\nGitOps engine for continuous deployment. See [GitOps](/concepts/#gitops). When set to `Flux` or `ArgoCD`, KSail scaffolds a GitOps CR into your source directory.\n\n- `None` (default) – No GitOps engine\n- `Flux` – Install [Flux CD](https://fluxcd.io/) and scaffold FluxInstance CR\n- `ArgoCD` – Install [Argo CD](https://argo-cd.readthedocs.io/) and scaffold Application CR\n\n#### Distribution and Tool Options\n\nAdvanced configuration options are direct fields under `spec.cluster`. See [Schema Support](#schema-support) for the complete structure.\n\n**Talos options (`spec.cluster.talos`):**\n\n- `controlPlanes` – Number of control-plane nodes (default: `1`)\n- `workers` – Number of worker nodes (default: `0`)\n- `config` – Path to talosconfig file (default: `~/.talos/config`)\n- `version` – Pin the Talos OS version (e.g. `v1.12.4`); caps upgrades and selects the node image (default: built-in)\n- `iso` – Cloud provider ISO/image ID for Talos Linux (default: `125127` for Talos 1.12.4 x86; for ARM, look up the matching ISO ID under **Images → ISOs** in the Hetzner Cloud Console)\n\nThe Kubernetes version is set at the top level (`spec.cluster.kubernetesVersion`), not under `talos`:\n\n- `kubernetesVersion` – Pin the Kubernetes version (e.g. `v1.32.0`). When unset, `cluster update` keeps the version already running (no unrequested upgrade) and new clusters default to one compatible with the pinned `talos.version`\n\n**Provider options (`spec.provider`):** infrastructure provider options (Hetzner, Omni, AWS, GCP, Kubernetes) are documented in the generated [spec.provider (ProviderSpec)](#specprovider-providerspec) sections below.\n\n**Autoscaler options (`spec.cluster.autoscaler`):** pod and node autoscaling options are documented in the generated [spec.cluster.autoscaler (AutoscalerConfig)](#specclusterautoscaler-autoscalerconfig) sections below.\n\n**Vanilla options (`spec.cluster.vanilla`):**\n\n- `mirrorsDir` – Directory for containerd host mirror configuration\n\n### spec.cluster.autoscaler (AutoscalerConfig)\n\nAutoscalerConfig defines configuration for pod and node autoscaling.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `pod` | PodAutoscalerConfig | – | Pod configures pod-level autoscaling (horizontal and vertical). |\n| `node` | NodeAutoscalerConfig | – | Node configures node-level autoscaling via the Cluster Autoscaler. |\n\n### spec.cluster.autoscaler.pod (PodAutoscalerConfig)\n\nPodAutoscalerConfig defines configuration for pod-level autoscaling.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `horizontal` | enum | – | Horizontal controls Horizontal Pod Autoscaler (HPA) support. |\n| `vertical` | enum | – | Vertical controls Vertical Pod Autoscaler (VPA) support. |\n\n### spec.cluster.autoscaler.node (NodeAutoscalerConfig)\n\nNodeAutoscalerConfig defines configuration for node-level autoscaling. When Enabled, the Cluster Autoscaler manages worker node counts dynamically. KSail-specified node counts serve as a baseline; the autoscaler adds and removes workers based on workload demand. Node-count changes via ksail cluster update are still applied to the Talos machine config and will take effect normally.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `enabled` | enum | – | Whether the Cluster Autoscaler is installed to manage worker node counts dynamically (Enabled or Disabled). A YAML boolean is accepted as an alias (true=Enabled |\n| `pools` | []NodePool | – | Pools defines the node pools the Cluster Autoscaler may scale (Hetzner only). |\n| `maxNodesTotal` | int32 | – | Maximum total number of nodes in the cluster (control-planes + workers + autoscaler nodes). Passed verbatim to the cluster-autoscaler --max-nodes-total flag — the autoscaler evaluates it against the count of ALL nodes so this is the whole-cluster ceiling and not an autoscaler-only budget. Set to 0 to disable the global cap; growth is then bounded only by the per-pool max values and serverLimit. Should be <= serverLimit |\n| `expander` | []enum | – | Node expander strategy for the cluster autoscaler. Accepts either a single value (e.g. LeastWaste) or an ordered priority list (e.g. [LeastNodes |\n| `scaleDownUnneededTime` | string | – | How long a node should be unneeded before it is eligible for scale down (e.g. 10m) |\n| `capacityBuffers` | boolean | – | Enable the Cluster Autoscaler capacity-buffers feature: KSail installs the CapacityBuffer CRD (capacitybuffers.autoscaling.x-k8s.io) and enables the buffer controller and pod-injection flags. CapacityBuffer resources then reserve scale-up headroom as virtual (pod-less) chunks simulated in autoscaler memory — a native replacement for low-priority balloon-pod overprovisioning. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true) |\n| `ignoreDaemonsetsUtilization` | boolean | – | Exclude DaemonSet pods from a node's resource-utilization calculation when the Cluster Autoscaler decides whether a node is unneeded (upstream --ignore-daemonsets-utilization, off by default). Enable this when DaemonSets are system components (CNI, CSI, observability, security agents) whose per-node overhead should not keep an otherwise-empty node above the scale-down utilization threshold. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true). |\n| `skipNodesWithLocalStorage` | boolean | – | Whether the Cluster Autoscaler refuses to scale down a node running a pod with local storage (emptyDir, hostPath, or a local PersistentVolume). Upstream --skip-nodes-with-local-storage defaults to true. Set false to let nodes whose only local storage is ephemeral scratch (emptyDir) be removed — required for overflow nodes to drain, since emptyDir is pervasive. Ensure durable data lives on real PVCs first. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true). |\n| `skipNodesWithSystemPods` | boolean | – | Whether the Cluster Autoscaler refuses to scale down a node running a non-DaemonSet kube-system pod that has no controlling PodDisruptionBudget. Upstream --skip-nodes-with-system-pods defaults to true. Set false to let overflow nodes hosting movable system Deployments drain — confirm those components tolerate eviction and carry PDBs first. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true). |\n\n### spec.cluster.autoscaler.node.pools[] (NodePool)\n\nNodePool defines a Hetzner node pool managed by the cluster autoscaler.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `name` | string | – | Name is the unique identifier for this node pool (DNS-1123 label). |\n| `serverType` | string | – | ServerType is the Hetzner server type for nodes in this pool (e.g. \"cx23\", \"cax11\"). |\n| `location` | string | – | Location is the Hetzner datacenter location for this pool (e.g. \"fsn1\", \"nbg1\"). |\n| `min` | int32 | – | Min is the minimum number of nodes in this pool. |\n| `max` | int32 | – | Max is the maximum number of nodes in this pool. |\n| `labels` | map[string]string | – | Kubernetes node labels applied to every node in this pool (via Talos machine.nodeLabels and the autoscaler scale-from-zero template). |\n| `taints` | []NodePoolTaint | – | Kubernetes node taints applied to every node in this pool (via Talos machine.nodeTaints and the autoscaler scale-from-zero template). |\n\n### spec.cluster.autoscaler.node.pools[].taints[] (NodePoolTaint)\n\nNodePoolTaint defines a Kubernetes node taint applied to every node in an autoscaler node pool.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `key` | string | – | Key is the taint key. Must be a valid Kubernetes label key (an optional DNS-subdomain prefix followed by a name segment). |\n| `value` | string | – | Value is the optional taint value. |\n| `effect` | enum | – | Effect is the scheduling effect: NoSchedule, PreferNoSchedule, or NoExecute. |\n\n### spec.provider (ProviderSpec)\n\nProviderSpec defines provider-specific configuration for infrastructure providers. This separates infrastructure provider concerns (Hetzner servers, Omni SaaS) from cluster/distribution concerns in ClusterSpec.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `hetzner` | OptionsHetzner | – | Hetzner holds options for the Hetzner Cloud provider. |\n| `omni` | OptionsOmni | – | Omni holds options for the Sidero Omni provider. |\n| `aws` | OptionsAWS | – | AWS holds options for the AWS provider used by the EKS distribution. |\n| `gcp` | OptionsGCP | – | GCP holds options for the Google Cloud provider used by the GKE distribution. |\n| `kubernetes` | OptionsKubernetes | – | Kubernetes holds options for the Kubernetes provider, which runs nested clusters as pods inside an existing host cluster. |\n\n### spec.provider.hetzner (OptionsHetzner)\n\nOptionsHetzner defines options specific to the Hetzner Cloud provider. These options are used when Provider is set to \"Hetzner\" for the Talos distribution.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `controlPlaneServerType` | string | `cx23` | ControlPlaneServerType is the Hetzner server type for control-plane nodes. Examples: \"cx23\" (x86), \"cax11\" (ARM), \"cpx21\" (AMD). Defaults to \"cx23\". |\n| `workerServerType` | string | `cx23` | WorkerServerType is the Hetzner server type for worker nodes. Examples: \"cx23\" (x86), \"cax11\" (ARM), \"cpx21\" (AMD). Defaults to \"cx23\". |\n| `location` | string | `fsn1` | Location is the Hetzner datacenter location. Examples: \"fsn1\" (Falkenstein), \"nbg1\" (Nuremberg), \"hel1\" (Helsinki). Defaults to \"fsn1\". |\n| `networkName` | string | – | NetworkName is the name of the private network to create or use. If empty, a network named \"<cluster-name>-network\" will be created. |\n| `networkCidr` | string | `10.0.0.0/16` | NetworkCIDR is the CIDR block for the private network. Defaults to \"10.0.0.0/16\". |\n| `sshKeyName` | string | – | SSHKeyName is the name of the SSH key to use for server access. The key must already exist in the Hetzner Cloud project. If empty, no SSH key is attached (only Talos API access). |\n| `tokenEnvVar` | string | `HCLOUD_TOKEN` | TokenEnvVar is the environment variable containing the Hetzner API token. Defaults to \"HCLOUD_TOKEN\". |\n| `placementGroupStrategy` | enum | `Spread` | PlacementGroupStrategy controls whether and how placement groups are used. \"Spread\" (default) distributes servers across different physical hosts for HA. \"None\" disables placement groups, useful when Hetzner resources are constrained. Note: Spread groups are limited to 10 servers per datacenter. |\n| `placementGroup` | string | – | PlacementGroup is the name of the placement group for server distribution. If empty, a placement group named \"<cluster-name>-placement\" will be created. Only used when PlacementGroupStrategy is \"Spread\". |\n| `fallbackLocations` | []string | – | Alternative datacenter locations to try when server creation in the primary location fails due to resource unavailability. When empty defaults to nbg1 and hel1 (both in the eu-central network zone matching the default fsn1 primary location). |\n| `placementGroupFallbackToNone` | boolean | – | PlacementGroupFallbackToNone allows automatic fallback to no placement group when spread placement constraints cannot be satisfied (e.g., due to datacenter capacity). When true and placement fails, retries server creation without a placement group. Defaults to false to preserve HA guarantees; set to true for best-effort provisioning. |\n| `floatingIPEnabled` | boolean | – | Provision a Hetzner floating IP and render it as the stable Kubernetes/Talos API endpoint (endpoint + certificate SANs + a control-plane Talos VIP block for leader ownership handover; the hcloud API token is embedded in the control-plane machine config). Defaults to false. |\n| `floatingIPLocation` | string | – | Hetzner location the floating IP is homed in (routing latency only). Defaults to the cluster's location. |\n| `ingressFirewall` | enum | `Enabled` | IngressFirewall controls the Talos OS-level ingress firewall configuration. When Enabled (default), KSail generates NetworkDefaultActionConfig and NetworkRuleConfig documents as Talos machine config patches, providing defense-in-depth at the node level independent of the Hetzner Cloud Firewall. See: https://www.talos.dev/latest/talos-guides/network/ingress-firewall/ |\n| `serverLimit` | int32 | `10` | Maximum total Hetzner servers allowed for this cluster — the account/project quota. Validation rejects configs whose reachable total (control-planes + workers + pool capacity clamped by autoscaler.node.maxNodesTotal when set) exceeds it. Set to 0 to use the default limit of 10 |\n| `allowedCidrs` | []string | – | CIDR blocks allowed to access the Kubernetes API and Talos API on control-plane nodes. When empty defaults to 0.0.0.0/0 and ::/0 (open to all IPv4 and IPv6). |\n| `workerPublicIPv4` | boolean | – | Assign a public IPv4 to worker nodes. Defaults to true. Set false for IPv4-less workers reached over the private network (requires private-network reachability and NAT egress). |\n| `workerPublicIPv6` | boolean | – | Assign a public IPv6 to worker nodes. Defaults to true. |\n| `controlPlanePublicIPv4` | boolean | – | Assign a public IPv4 to control-plane nodes. Defaults to true. Set false for IPv4-less control planes whose endpoint is the private-network IP (cluster reachable only from inside the private network). |\n| `controlPlanePublicIPv6` | boolean | – | Assign a public IPv6 to control-plane nodes. Defaults to true. |\n| `autoscalerNodePoolNames` | []string | – | AutoscalerNodePoolNames lists the node-group names configured in the Kubernetes Cluster Autoscaler for this cluster. When non-empty, KSail deletes servers labelled with hcloud/node-group=<name> during cluster deletion so that autoscaler-managed nodes are cleaned up alongside KSail-managed nodes. |\n\n### spec.provider.omni (OptionsOmni)\n\nOptionsOmni defines options specific to the Sidero Omni provider. These options are used when Provider is set to \"Omni\" for the Talos distribution.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `endpoint` | string | – | Endpoint is the Omni API endpoint URL. Example: \"https://<account>.omni.siderolabs.io:443\". |\n| `endpointEnvVar` | string | `OMNI_ENDPOINT` | EndpointEnvVar is the environment variable containing the Omni API endpoint URL. When set, the value of this environment variable takes precedence over Endpoint. Defaults to \"OMNI_ENDPOINT\". |\n| `serviceAccountKeyEnvVar` | string | `OMNI_SERVICE_ACCOUNT_KEY` | ServiceAccountKeyEnvVar is the environment variable containing the base64-encoded Omni service account key. Defaults to \"OMNI_SERVICE_ACCOUNT_KEY\". |\n| `talosVersion` | string | – | TalosVersion is the Talos version to use for the cluster in Omni. Accepts values with or without the \"v\" prefix (e.g., \"v1.11.2\" or \"1.11.2\"). Generated templates normalize the value to include the \"v\" prefix. This determines the Talos Linux version that Omni will deploy to machines. |\n| `kubernetesVersion` | string | – | KubernetesVersion is the Kubernetes version to use for the cluster in Omni. Accepts values with or without the \"v\" prefix (e.g., \"v1.32.0\" or \"1.32.0\"). Generated templates normalize the value to include the \"v\" prefix. This determines the Kubernetes version that Omni will deploy. |\n| `machineClass` | string | – | MachineClass is the Omni machine class name to use for dynamic node allocation. Machine classes are user-defined in the Omni dashboard and match machines by labels (e.g., CPU, region, role). The specified class must exist in the Omni account before cluster creation. The number of machines allocated is derived from the controlPlanes and workers count in the cluster spec. Mutually exclusive with Machines — set one or the other. When neither MachineClass nor Machines is set, KSail automatically discovers available (unallocated) machines in Omni and uses them for node allocation. |\n| `machines` | []string | – | Machines is a list of Omni machine UUIDs to use for static node allocation. The first N machines are assigned as control planes (where N = controlPlanes count), and the remaining machines are assigned as workers. Mutually exclusive with MachineClass — set one or the other. When neither MachineClass nor Machines is set, KSail automatically discovers available (unallocated) machines in Omni and uses them for node allocation. |\n\n### spec.provider.aws (OptionsAWS)\n\nOptionsAWS defines options specific to the AWS cloud provider. Credentials are resolved via the standard AWS SDK v2 credential chain; the *EnvVar fields let users point KSail at non-standard environment variable names (mirrors the Hetzner/Omni pattern).\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `profileEnvVar` | string | `AWS_PROFILE` | ProfileEnvVar is the environment variable containing the AWS shared-config profile name. Defaults to \"AWS_PROFILE\". |\n| `regionEnvVar` | string | `AWS_REGION` | RegionEnvVar is the environment variable containing the AWS region. When set, it overrides the region declared in eks.yaml. Defaults to \"AWS_REGION\". |\n| `accessKeyIdEnvVar` | string | `AWS_ACCESS_KEY_ID` | AccessKeyIDEnvVar is the environment variable containing a static AWS access key ID. Defaults to \"AWS_ACCESS_KEY_ID\". |\n| `secretAccessKeyEnvVar` | string | `AWS_SECRET_ACCESS_KEY` | SecretAccessKeyEnvVar is the environment variable containing a static AWS secret access key. Defaults to \"AWS_SECRET_ACCESS_KEY\". |\n| `sessionTokenEnvVar` | string | `AWS_SESSION_TOKEN` | SessionTokenEnvVar is the environment variable containing an AWS session token (used with temporary credentials from STS). Defaults to \"AWS_SESSION_TOKEN\". |\n\n### spec.provider.gcp (OptionsGCP)\n\nOptionsGCP defines options specific to the Google Cloud provider used by the GKE distribution. Credentials are resolved via Application Default Credentials (GOOGLE_APPLICATION_CREDENTIALS / gcloud ADC); the *EnvVar fields let users point KSail at non-standard environment variable names (mirrors the AWS/Hetzner/Omni pattern).\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `projectEnvVar` | string | `GOOGLE_CLOUD_PROJECT` | ProjectEnvVar is the environment variable containing the Google Cloud project ID. Defaults to \"GOOGLE_CLOUD_PROJECT\". |\n| `locationEnvVar` | string | `GOOGLE_CLOUD_LOCATION` | LocationEnvVar is the environment variable containing the GKE location (zone or region). Defaults to \"GOOGLE_CLOUD_LOCATION\". |\n\n### spec.provider.kubernetes (OptionsKubernetes)\n\nOptionsKubernetes defines options specific to the Kubernetes provider. The Kubernetes provider runs nested cluster nodes as pods inside an existing host cluster. It uses Gateway API (TCPRoute) to expose the nested cluster's API server.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `kubeconfig` | string | `~/.kube/config` | Kubeconfig is the path to the kubeconfig for the host cluster. Defaults to \"~/.kube/config\". |\n| `kubeconfigEnvVar` | string | `KSAIL_HOST_KUBECONFIG` | KubeconfigEnvVar is the environment variable containing the host kubeconfig path. Defaults to \"KSAIL_HOST_KUBECONFIG\". |\n| `context` | string | – | Context is the kubeconfig context for the host cluster. When empty, uses the current context. |\n| `contextEnvVar` | string | `KSAIL_HOST_CONTEXT` | ContextEnvVar is the environment variable containing the host kubeconfig context. Defaults to \"KSAIL_HOST_CONTEXT\". |\n| `gatewayClassName` | string | – | GatewayClassName is the GatewayClass to use for exposing the nested API server. Must reference a GatewayClass that exists on the host cluster. When empty, the API is exposed via ClusterIP Service only (no external Gateway). |\n| `podCidr` | string | `10.64.0.0/16` | PodCIDR is the pod CIDR for the nested cluster. Must not overlap with the host cluster's pod or service CIDRs. Defaults to \"10.64.0.0/16\". |\n| `serviceCidr` | string | `10.128.0.0/16` | ServiceCIDR is the service CIDR for the nested cluster. Must not overlap with the host cluster's pod or service CIDRs. Defaults to \"10.128.0.0/16\". |\n| `persistence` | KubernetesPersistence | – | Persistence defines storage persistence for the nested cluster's data directory. |\n\n### spec.provider.kubernetes.persistence (KubernetesPersistence)\n\nKubernetesPersistence defines storage persistence configuration for the Kubernetes provider. When enabled, a PVC is created for the nested cluster's data directory to survive pod restarts. When disabled (default), emptyDir is used and clusters are fully ephemeral.\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `enabled` | boolean | – | Enabled controls whether a PVC is used for the nested cluster's data directory. When false (default), emptyDir is used and the cluster is ephemeral. |\n| `storageClassName` | string | – | StorageClassName is the StorageClass to use for the PVC. When empty, the cluster's default StorageClass is used. |\n| `size` | string | `20Gi` | Size is the storage request size for the PVC. Defaults to \"20Gi\". |\n\n### spec.workload (WorkloadSpec)\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `sourceDirectory` | string | `k8s` | Path to the directory containing Kubernetes manifests. Used as the default path by validate, watch, and push when no explicit path argument is given. |\n| `validateOnPush` | boolean | `false` | Validate manifests against schemas before pushing (validation disabled by default) |\n| `tag` | string | `dev` | OCI artifact tag used for workload push and GitOps reconciliation (Flux OCIRepository and ArgoCD Application). Push priority: CLI oci:// ref > this field > registry-embedded tag > dev. Reconciliation priority: this field > registry-embedded tag > dev |\n| `kustomizationFile` | string | – | Path to the kustomization directory relative to sourceDirectory. When set, Flux Sync.Path is configured to this path so Flux uses the specified kustomization as the entry point instead of requiring a root kustomization.yaml. |\n| `flux` | FluxConfig | – | Flux bootstrap configuration: operator/distribution version pins and signature verification for the generated OCIRepository. Empty values use KSail's pinned versions; a GitOps repo that declares these becomes the steady-state owner. |\n| `watch` | WatchConfig | – | Configuration for the workload watch command (pre-apply hooks, etc.) |\n| `validation` | ValidationConfig | – | Configuration for the workload validate command (additional kinds to skip, etc.). |\n| `scan` | ScanConfig | – | Configuration for the workload scan command (Kubescape exceptions, frameworks, compliance threshold) so 'ksail workload scan' (no args) can act as a turnkey CI gate. |\n\n\n### spec.chat (ChatSpec)\n\n| Field | Type | Default | Description |\n| ----- | ---- | ------- | ----------- |\n| `model` | string | – | Chat model (empty or 'auto' for API default) |\n| `reasoningEffort` | string | – | Reasoning effort level for chat responses (low, medium, or high) |\n\n\n## Distribution Configuration\n\nKSail references distribution-specific configuration files to customize cluster behavior. The path to these files is set via `spec.cluster.distributionConfig`.\n\n### Vanilla (implemented with Kind) Configuration\n\n**Default:** `kind.yaml`\n\nSee [Kind Configuration](https://kind.sigs.k8s.io/docs/user/configuration/) for the full schema.\n\n**Example:**\n\n```yaml\n# kind.yaml\nkind: Cluster\napiVersion: kind.x-k8s.io/v1alpha4\nnodes:\n - role: control-plane\n extraPortMappings:\n - containerPort: 30000\n hostPort: 30000\n```\n\n### K3s (implemented with K3d) Configuration\n\n**Default:** `k3d.yaml`\n\nSee [K3d Configuration](https://k3d.io/stable/usage/configfile/) for the full schema.\n\n**Example:**\n\n```yaml\n# k3d.yaml\napiVersion: k3d.io/v1alpha5\nkind: Simple\nservers: 1\nagents: 2\nports:\n - port: 8080:80\n nodeFilters:\n - loadbalancer\n```\n\n### Talos Configuration\n\n**Default:** `talos/` directory\n\nTalos uses a directory structure for [Talos machine configuration patches](https://www.talos.dev/latest/reference/configuration/). Place YAML patch files in `talos/cluster/` (all nodes), `talos/control-planes/`, or `talos/workers/`:\n\n```yaml\n# talos/cluster/kubelet.yaml (applies to all nodes)\nmachine:\n kubelet:\n extraArgs:\n max-pods: \"250\"\n```\n\nSee [Talos Configuration Reference](https://www.talos.dev/latest/reference/configuration/) for patch syntax. Use `spec.cluster.talos` to configure node counts:\n\n```yaml\nspec:\n cluster:\n distribution: Talos\n distributionConfig: talos\n talos:\n controlPlanes: 3\n workers: 2\n```\n\n#### Port Mappings (Docker Provider)\n\nOn macOS, Docker runs in a Linux VM, so MetalLB virtual IPs are not accessible from the host. Use `extraPortMappings` to expose container ports directly:\n\n```yaml\nspec:\n cluster:\n distribution: Talos\n talos:\n extraPortMappings:\n - containerPort: 80\n hostPort: 8080\n protocol: TCP\n - containerPort: 443\n hostPort: 8443\n protocol: TCP\n```\n\nAccess services at `http://localhost:8080`. Ports are exposed on the first control-plane node; in multi-control-plane clusters, `extraPortMappings` apply only to that node.\n\n## Schema Support\n\nKSail provides a JSON Schema for IDE validation and autocompletion. Reference it at the top of your `ksail.yaml`:\n\n```yaml\n# yaml-language-server: $schema=https://raw.githubusercontent.com/devantler-tech/ksail/main/schemas/ksail-config.schema.json\napiVersion: ksail.io/v1alpha1\nkind: Cluster\nspec:\n # ...\n```\n\nIDEs with YAML language support (e.g., VS Code + [Red Hat YAML extension](https://marketplace.visualstudio.com/items?itemName=redhat.vscode-yaml)) provide field autocompletion, inline docs, validation, and enum suggestions.\n\n## CLI Command Reference\n\n\n### Cluster Add Environment\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nClone an existing cluster environment into a new one.\n\nCopies the source environment's overlay (/clusters//) and\nits root config (ksail..yaml) into a new environment , repointing the\nstructured identity along the way: the cluster-meta cluster_name, the\nclusters/ path segment and content references, the root config's metadata\nname, the connection context (distribution-aware), and — when --provider is given\n— the provider. Every other byte is preserved, so the kustomize replacements block,\nbase wiring, version pins and comments survive intact.\n\nSOPS-encrypted files (*.enc.yaml) are copied verbatim with only their path\nrepointed; re-encrypt them to the new environment's recipients afterwards with\n`ksail cipher` if the environments use different keys.\n\nExamples:\n # Clone the \"prod\" environment into a new \"staging\" environment\n ksail project add-environment staging --from prod\n\n # Clone \"prod\" into \"dev\" on a different provider, overwriting any existing files\n ksail project add-environment dev --from prod --provider Docker --force\n\nUsage:\n ksail cluster add-environment [flags]\n\nFlags:\n --force Overwrite existing destination files\n -f, --from string Source environment to clone from (required)\n -p, --provider string Provider for the new environment (defaults to the source provider)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Backup\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreates a backup archive containing Kubernetes resource manifests.\n\nThe backup is stored as a compressed tarball (.tar.gz) with resources organized by type.\nMetadata about the backup is included for restore operations.\n\nNote: This backs up resource manifests (YAML) only. Persistent volume\ncontents are not included in the current implementation.\n\nExample:\n ksail cluster backup ./my-backup.tar.gz\n ksail cluster backup ./backup.tar.gz --namespaces default,kube-system\n ksail cluster backup ./backup.tar.gz --exclude-types events,pods\n\nUsage:\n ksail cluster backup [] [flags]\n\nFlags:\n --compression int Compression level (-1..9, -1 = gzip default) (default -1)\n --exclude-types strings Resource types to exclude from backup (default [events])\n --name string Name of the cluster to back up (resolves the kubeconfig like the other cluster commands; defaults to the current kubeconfig context when unset)\n --namespaces strings Namespaces to backup (default: all)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Connect\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nLaunch k9s terminal UI to interactively manage your Kubernetes cluster.\n\nThe editor is determined by (in order of precedence):\n 1. --editor flag\n 2. spec.editor from ksail.yaml config\n 3. EDITOR or VISUAL environment variables\n 4. Fallback to vim, nano, or vi\n\nk9s flags and arguments placed after a \"--\" separator are passed through to\nk9s unchanged, allowing you to use any k9s functionality. Examples:\n\n ksail cluster connect\n ksail cluster connect --name dev-cluster\n ksail cluster connect --editor \"code --wait\"\n ksail cluster connect -- --namespace default\n ksail cluster connect -- --context my-context\n ksail cluster connect -- --readonly\n\nThe cluster is resolved in the following priority order:\n 1. From the --name flag\n 2. From metadata.name in the ksail.yaml config file (if present)\n 3. From the current kubeconfig context\n\nThe kubeconfig is resolved in the following priority order:\n 1. From the --kubeconfig flag\n 2. From the KUBECONFIG environment variable\n 3. From the ksail.yaml config file (if present)\n 4. Defaults to ~/.kube/config\n\nUsage:\n ksail cluster connect [flags]\n\nFlags:\n -c, --context string Kubernetes context of cluster\n --editor string editor command to use for k9s edit actions (e.g., 'code --wait', 'vim', 'nano')\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n -n, --name string Name of the cluster to connect to (resolved like the other cluster commands; overrides the kubeconfig context derived from ksail.yaml)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Create\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a Kubernetes cluster as defined by configuration.\n\nUsage:\n ksail cluster create [flags]\n\nFlags:\n --allowed-cidrs strings CIDR blocks allowed to access the Kubernetes API and Talos API on control-plane nodes. When empty, both APIs are open to 0.0.0.0/0 and ::/0 (all IPv4 and IPv6). Example: --allowed-cidrs 203.0.113.0/24 --allowed-cidrs 198.51.100.0/24\n --cdi CDI Container Device Interface (Default: use distribution, Enabled: enable CDI, Disabled: disable CDI)\n --cert-manager CertManager Cert-Manager configuration (Enabled: install, Disabled: skip)\n --cni CNI Container Network Interface (CNI) to use\n -c, --context string Kubernetes context of cluster\n --control-planes int32 Number of control-plane nodes (default 1)\n --csi CSI Container Storage Interface (Default: use distribution, Enabled: install CSI, Disabled: skip CSI)\n -d, --distribution Distribution Kubernetes distribution to use\n --distribution-config string Configuration file for the distribution\n --distribution-version string Distribution version to deploy and reconcile toward (Talos OS version). When unset KSail follows the latest supported version; set it to pin a specific version. Other distributions carry their version in the distribution config.\n --drain-timeout duration Per-node pod-eviction budget for rolling node drains during cluster update (default 10m when unset). Increase it for stateful workloads that need longer to evict gracefully (e.g. Longhorn rebuilds, database failovers). On timeout the update aborts; re-run with --force-drain to delete pods bypassing PodDisruptionBudgets. Talos only.\n -g, --gitops-engine GitOpsEngine GitOps engine to use (None disables GitOps, Flux installs Flux controllers, ArgoCD installs Argo CD) (default None)\n --import-images string Path to tar archive with container images to import after cluster creation but before component installation\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n --kubernetes-version string Kubernetes version to deploy and reconcile toward. When unset KSail follows the latest supported version; set it to pin a specific version. Honored by the Talos distribution; Kind/K3d/EKS carry the version in their distribution config instead.\n --load-balancer LoadBalancer LoadBalancer support (Default: use distribution × provider, Enabled: install, Disabled: uninstall)\n --local-registry string Local registry specification: [user:pass@]host[:port][/path] (e.g., localhost:5050, ghcr.io/myorg, ${USER}:${PASS}@ghcr.io:443/org)\n --metrics-server MetricsServer Metrics Server (Default: use distribution, Enabled: install, Disabled: uninstall)\n --mirror-registry strings Configure mirror registries with optional authentication. Format: [user:pass@]host[=upstream]. Credentials support environment variables using ${VAR} syntax (quote placeholders so KSail can expand them). Examples: docker.io=https://registry-1.docker.io, '${USER}:${TOKEN}@ghcr.io=https://ghcr.io'\n -n, --name string Cluster name used for container names, registry names, and kubeconfig context\n --node-autoscaler-enabled NodeAutoscalerEnabled[=Enabled] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --node-autoscaling NodeAutoscaling [Deprecated: use autoscaler.node.enabled instead] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --oidc-ca-file string Path to CA certificate for self-signed OIDC providers\n --oidc-client-id string OIDC client ID for kubectl authentication\n --oidc-extra-scope strings Additional OIDC scopes beyond openid (repeatable)\n --oidc-groups-claim string JWT claim for Kubernetes groups (default \"groups\")\n --oidc-groups-prefix string Prefix for OIDC groups in Kubernetes (default \"oidc:\")\n --oidc-issuer-url string OIDC provider issuer URL (e.g. https://dex.example.com)\n --oidc-username-claim string JWT claim for Kubernetes username (default \"email\")\n --oidc-username-prefix string Prefix for OIDC usernames in Kubernetes (default \"oidc:\")\n --policy-engine PolicyEngine Policy engine (None: skip, Kyverno: install Kyverno, Gatekeeper: install Gatekeeper)\n -p, --provider Provider Infrastructure provider backend (e.g., Docker)\n --ttl string Auto-destroy cluster after duration (e.g. 1h, 30m, 2h30m). If not set, cluster persists indefinitely.\n --workers int32 Number of worker nodes\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Delete\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDestroy a cluster.\n\nThe cluster is resolved in the following priority order:\n 1. From the --name flag\n 2. From metadata.name in the ksail.yaml config file (if present)\n 3. From the current kubeconfig context\n\nThe provider is resolved in the following priority order:\n 1. From the --provider flag\n 2. From the ksail.yaml config file (if present)\n 3. Defaults to Docker\n\nThe kubeconfig is resolved in the following priority order:\n 1. From the --kubeconfig flag\n 2. From the KUBECONFIG environment variable\n 3. From the ksail.yaml config file (if present)\n 4. Defaults to ~/.kube/config\n\nUsage:\n ksail cluster delete [flags]\n\nFlags:\n --delete-storage Delete storage volumes when cleaning up (registry volumes for Docker, block storage for Hetzner)\n -f, --force Skip confirmation prompt and delete immediately\n -k, --kubeconfig string Path to kubeconfig file for context cleanup\n -n, --name string Name of the cluster to delete\n -p, --provider Provider Provider to use (Docker, Hetzner, Omni, AWS, GCP, Kubernetes)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Diagnose\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nSurface failing Kubernetes resources for the current cluster.\n\nThis command inspects the live cluster via the Kubernetes API and reports\nany pods that are not running successfully, any nodes that are not Ready,\nand any PersistentVolumeClaims stuck in Pending phase. Each finding\nincludes a severity classification and, where a known failure pattern is\ndetected, a proactive remediation suggestion.\n\nA health score (0–100) summarizes overall cluster health: each critical\nfinding deducts 25 points and each warning deducts 10 points.\n\nThe output is intentionally compact so it can be consumed directly by users\nor by the KSail AI chat assistant (ksail open chat) and MCP server, which expose\nthis command as part of the cluster_read tool. When used from the AI\nassistant the output is fed back as context so Copilot can explain the root\ncause and suggest remediation.\n\nThe cluster is resolved in the following priority order:\n 1. From --name flag\n 2. From ksail.yaml config file (if present)\n 3. From current kubeconfig context\n\nExit code 0 is returned even when pod or node failures are reported.\nA non-zero exit code indicates the Kubernetes API could not be queried\n(e.g., the cluster is unreachable or the credentials lack sufficient\npermissions).\n\nUsage:\n ksail cluster diagnose [flags]\n\nFlags:\n -n, --name string Name of the cluster to target\n --output string Output format: text or json. Use json for machine-readable structured output. (default \"text\")\n -p, --provider Provider Provider to use (Docker, Hetzner, Omni, AWS, GCP, Kubernetes)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Diff\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCompare the desired cluster configuration (ksail.yaml) against the live\ncluster state and report any drift.\n\nThis command detects installed components via the Kubernetes API and Helm\nrelease history, then compares them against the configuration defined in\nksail.yaml. Changes are classified by impact (in-place, reboot-required,\nrecreate-required, wipe-required) — the same categories used by\n'ksail cluster update'.\n\nNo changes are applied to the cluster; this is a read-only operation.\n\nThe cluster is resolved in the following priority order:\n 1. From the --name flag override\n 2. From metadata.name in the ksail.yaml config file\n 3. From the current kubeconfig context\n\nUse --output json for machine-readable output suitable for CI pipelines.\nUse --exit-code to return exit code 2 when drift is detected (useful for\nCI gates and monitoring scripts).\n\nUse --include-version-drift to also report the distribution/Kubernetes version\nreconciliation 'ksail cluster update' applies on every run (matching\n'update --dry-run'). It is off by default: resolving the latest available\nversion performs OCI registry lookups, so enabling it makes diff\nnetwork-dependent and may report drift whenever upstream cuts a release.\n\nUsage:\n ksail cluster diff [flags]\n\nFlags:\n -c, --context string Kubernetes context of cluster\n --exit-code Return exit code 2 when drift is detected (for CI gates)\n --include-version-drift Also report distribution/Kubernetes version drift the next 'cluster update' would reconcile (performs OCI registry lookups; off by default)\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n -n, --name string Cluster name used for container names, registry names, and kubeconfig context\n --output string Output format: text or json. Use json for machine-readable structured output. (default \"text\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Info\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDisplay cluster information from the infrastructure provider and Kubernetes API. Succeeds if information is available from any source.\n\nUsage:\n ksail cluster info [flags]\n\nFlags:\n -n, --name string Name of the cluster to target\n -p, --provider Provider Provider to use (Docker, Hetzner, Omni, AWS, GCP, Kubernetes)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Init\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nInitialize a new project in the specified directory (or current directory if none specified).\n\nUsage:\n ksail cluster init [flags]\n\nFlags:\n --allowed-cidrs strings CIDR blocks allowed to access the Kubernetes API and Talos API on control-plane nodes. When empty, both APIs are open to 0.0.0.0/0 and ::/0 (all IPv4 and IPv6). Example: --allowed-cidrs 203.0.113.0/24 --allowed-cidrs 198.51.100.0/24\n --cdi CDI Container Device Interface (Default: use distribution, Enabled: enable CDI, Disabled: disable CDI)\n --cert-manager CertManager Cert-Manager configuration (Enabled: install, Disabled: skip)\n --cni CNI Container Network Interface (CNI) to use\n -c, --context string Kubernetes context of cluster\n --control-planes int32 Number of control-plane nodes (default 1)\n --csi CSI Container Storage Interface (Default: use distribution, Enabled: install CSI, Disabled: skip CSI)\n -d, --distribution Distribution Kubernetes distribution to use\n --distribution-config string Configuration file for the distribution\n --distribution-version string Distribution version to deploy and reconcile toward (Talos OS version). When unset KSail follows the latest supported version; set it to pin a specific version. Other distributions carry their version in the distribution config.\n -f, --force Overwrite existing files\n -g, --gitops-engine GitOpsEngine GitOps engine to use (None disables GitOps, Flux installs Flux controllers, ArgoCD installs Argo CD) (default None)\n --image-verification ImageVerification Image verification (Talos: scaffold ImageVerificationConfig template; Vanilla/Kind: inject containerd verifier plugin patch; requires verifier binaries and typically policy to be present in the node image bin_dir; K3s/K3d: scaffold containerd config template with image verifier plugin and mount into node containers; requires verifier binaries and typically policy to be present in the node image bin_dir; Disabled: skip)\n --import-images string Path to tar archive with container images to import after cluster creation but before component installation\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n --kubernetes-version string Kubernetes version to deploy and reconcile toward. When unset KSail follows the latest supported version; set it to pin a specific version. Honored by the Talos distribution; Kind/K3d/EKS carry the version in their distribution config instead.\n --kustomization-file string Relative directory within sourceDirectory used as the kustomize entry point (e.g., clusters/local)\n --load-balancer LoadBalancer LoadBalancer support (Default: use distribution × provider, Enabled: install, Disabled: uninstall)\n --local-registry string Local registry specification: [user:pass@]host[:port][/path] (e.g., localhost:5050, ghcr.io/myorg, ${USER}:${PASS}@ghcr.io:443/org)\n --metrics-server MetricsServer Metrics Server (Default: use distribution, Enabled: install, Disabled: uninstall)\n --mirror-registry strings Configure mirror registries with optional authentication. Format: [user:pass@]host[=upstream]. Credentials support environment variables using ${VAR} syntax (quote placeholders so KSail can expand them). Examples: docker.io=https://registry-1.docker.io, '${USER}:${TOKEN}@ghcr.io=https://ghcr.io'\n --multi-cluster string Scaffold a multi-cluster source layout (clusters/base/ + clusters//) with the given initial environment name; the generated ksail.yaml points its kustomizationFile at the environment overlay\n -n, --name string Cluster name used for container names, registry names, and kubeconfig context\n --no-devcontainer Skip scaffolding .devcontainer/devcontainer.json\n --node-autoscaler-enabled NodeAutoscalerEnabled[=Enabled] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --node-autoscaling NodeAutoscaling [Deprecated: use autoscaler.node.enabled instead] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --oidc-ca-file string Path to CA certificate for self-signed OIDC providers\n --oidc-client-id string OIDC client ID for kubectl authentication\n --oidc-extra-scope strings Additional OIDC scopes beyond openid (repeatable)\n --oidc-groups-claim string JWT claim for Kubernetes groups (default \"groups\")\n --oidc-groups-prefix string Prefix for OIDC groups in Kubernetes (default \"oidc:\")\n --oidc-issuer-url string OIDC provider issuer URL (e.g. https://dex.example.com)\n --oidc-username-claim string JWT claim for Kubernetes username (default \"email\")\n --oidc-username-prefix string Prefix for OIDC usernames in Kubernetes (default \"oidc:\")\n -o, --output string Output directory for the project\n --policy-engine PolicyEngine Policy engine (None: skip, Kyverno: install Kyverno, Gatekeeper: install Gatekeeper)\n --provider Provider Infrastructure provider backend (e.g., Docker)\n -s, --source-directory string Directory containing workloads to deploy (default \"k8s\")\n --workers int32 Number of worker nodes\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster List\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nList all Kubernetes clusters managed by KSail.\n\nBy default, lists clusters from all distributions across all providers.\nUse --provider to filter results to a specific provider.\n\nOutput Format:\n PROVIDER DISTRIBUTION CLUSTER STATUS\n docker Vanilla dev-cluster Running\n docker K3s test-cluster Stopped\n hetzner Talos prod-cluster Unknown\n\nThe STATUS column reports the cluster's run-state: \"Running\" when its nodes are\nup, \"Stopped\" when they exist but are not running (e.g. a stopped Docker\ncluster), and \"Unknown\" for providers that cannot report it (cloud providers).\n\nWhen any cluster has a TTL set, a TTL column is appended:\n PROVIDER DISTRIBUTION CLUSTER STATUS TTL\n docker K3s dev-cluster Running 2h 30m\n\nThe PROVIDER and CLUSTER values from the output can be used directly\nwith other cluster commands:\n ksail cluster delete --name --provider \n ksail cluster stop --name --provider \n\nUse --output json for machine-readable output. The JSON is an array of objects:\n [\n {\"name\": \"dev\", \"provider\": \"docker\", \"distribution\": \"Vanilla\", \"status\": \"Running\", \"ttl\": \"2h 30m\"}\n ]\nThe \"status\" field is \"Running\", \"Stopped\", or \"Unknown\" (see the STATUS column).\nThe \"ttl\" field is null when no TTL is set and \"EXPIRED\" once the TTL has elapsed.\n\nExamples:\n # List all clusters\n ksail cluster list\n\n # List only Docker-based clusters\n ksail cluster list --provider Docker\n\n # List only Hetzner clusters\n ksail cluster list --provider Hetzner\n\n # List only Omni clusters\n ksail cluster list --provider Omni\n\n # Machine-readable JSON (name/provider/distribution/ttl)\n ksail cluster list --output json\n\nUsage:\n ksail cluster list [flags]\n\nFlags:\n --output string Output format: text or json. Use json for machine-readable structured output (array of {name, provider, distribution, status, ttl}). (default \"text\")\n -p, --provider Provider Filter by provider (Docker, Hetzner, Omni, AWS, GCP, Kubernetes). If not specified, lists all providers.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Oidc Get Token\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nGet an OIDC token for Kubernetes authentication.\n\nThis command implements the client.authentication.k8s.io/v1 ExecCredential protocol.\nIt is intended to be used as a kubeconfig exec credential plugin, not called directly.\n\nThe token acquisition flow:\n 1. Check the local cache for a valid token\n 2. If expired, attempt to refresh using the stored refresh token\n 3. If no valid token, start the browser-based authorization code flow with PKCE\n 4. Output the ExecCredential JSON to stdout\n\nUsage:\n ksail cluster oidc get-token [flags]\n\nFlags:\n --ca-file string Path to CA certificate for self-signed OIDC providers\n --client-id string OIDC client ID (required)\n --extra-scope strings Additional OIDC scopes\n --issuer-url string OIDC provider issuer URL (required)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Oidc Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nOIDC authentication utilities for Kubernetes clusters.\n\nProvides an exec credential plugin that can be used in kubeconfig\nto authenticate with OIDC providers (e.g., Dex, Keycloak).\n\nUsage:\n ksail cluster oidc [command]\n\nAvailable Commands:\n get-token Get an OIDC token (exec credential plugin)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail cluster oidc [command] --help\" for more information about a command.\n\n```\n\n### Cluster Repair\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDetect and repair known corruption patterns in local state files.\n\nCurrently supported repairs:\n - talosconfig-ca: fixes a single-byte BasicConstraints corruption in\n the Talos talosconfig CA that prevents 'cluster update' from\n establishing a Talos client.\n\nEach repair is idempotent and writes a timestamped backup of any file\nit modifies.\n\nUsage:\n ksail cluster repair [flags]\n\nFlags:\n --talosconfig string path to talosconfig (default: ~/.talos/config)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Restore\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRestores Kubernetes resources from a backup archive to the target cluster.\n\nResources are restored in the correct order (CRDs first, then namespaces, storage, workloads).\nExisting resources can be skipped or updated based on the policy.\n\nExample:\n ksail cluster restore ./my-backup.tar.gz\n ksail cluster restore ./backup.tar.gz --existing-resource-policy update\n ksail cluster restore ./backup.tar.gz --dry-run\n\nUsage:\n ksail cluster restore [] [flags]\n\nFlags:\n --dry-run Print what would be restored without applying\n --existing-resource-policy string Policy for existing resources: none (skip) or update (patch) (default \"none\")\n --name string Name of the cluster to restore into (resolves the kubeconfig like the other cluster commands; defaults to the current kubeconfig context when unset)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nManage lifecycle operations for local Kubernetes clusters, including provisioning, teardown, and status.\n\nUsage:\n ksail cluster [flags]\n ksail cluster [command]\n\nAvailable Commands:\n backup Backup cluster resources\n connect Connect to cluster with k9s\n create Create a cluster\n delete Destroy a cluster\n diagnose Diagnose failing cluster resources\n diff Show configuration drift between ksail.yaml and live cluster\n info Display cluster information\n list List clusters\n oidc OIDC authentication utilities\n repair Repair local KSail/Talos state files\n restore Restore cluster resources from backup\n start Start a stopped cluster\n stop Stop a running cluster\n switch Switch active cluster context\n update Update a cluster configuration\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail cluster [command] --help\" for more information about a command.\n\n```\n\n### Cluster Start\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nStart a previously stopped Kubernetes cluster.\n\nThe cluster is resolved in the following priority order:\n 1. From --name flag\n 2. From ksail.yaml config file (if present)\n 3. From current kubeconfig context\n\nThe provider is resolved in the following priority order:\n 1. From --provider flag\n 2. From ksail.yaml config file (if present)\n 3. Defaults to Docker\n\nSupported distributions are automatically detected from existing clusters.\n\nUsage:\n ksail cluster start [flags]\n\nFlags:\n -n, --name string Name of the cluster to target\n -p, --provider Provider Provider to use (Docker, Hetzner, Omni, AWS, GCP, Kubernetes)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Stop\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nStop a running Kubernetes cluster.\n\nThe cluster is resolved in the following priority order:\n 1. From --name flag\n 2. From ksail.yaml config file (if present)\n 3. From current kubeconfig context\n\nThe provider is resolved in the following priority order:\n 1. From --provider flag\n 2. From ksail.yaml config file (if present)\n 3. Defaults to Docker\n\nSupported distributions are automatically detected from existing clusters.\n\nUsage:\n ksail cluster stop [flags]\n\nFlags:\n -n, --name string Name of the cluster to target\n -p, --provider Provider Provider to use (Docker, Hetzner, Omni, AWS, GCP, Kubernetes)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Switch\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nSwitch the active kubeconfig context to the named cluster.\n\nThis command accepts a cluster name and automatically resolves it to the\ncorrect kubeconfig context by checking all supported distribution prefixes\n(kind-, k3d-, k3k-, admin@, vcluster-docker_, kwok-). The k3k- prefix matches\nnested K3s clusters on the Kubernetes provider, and kwok- matches KWOK clusters.\n\nIf multiple distributions have contexts for the same cluster name, the\ncommand returns an error listing the matching contexts.\n\nThe kubeconfig is resolved in the following priority order:\n 1. From KUBECONFIG environment variable\n 2. From ksail.yaml config file (if present)\n 3. Defaults to ~/.kube/config\n\nWhen called without arguments, an interactive picker is shown\nto select from available clusters. Recently-switched clusters\nappear at the top of the list (up to the last 5), followed by\nthe remaining clusters in alphabetical order. The history is\npersisted to ~/.ksail/switch-history.json.\n\nIn the picker, press '/' to enter filter mode and type to narrow\nthe list by keyword (case-insensitive). Press Esc to exit filter mode.\n\nExamples:\n # Switch to a Vanilla (Kind) cluster named \"dev\"\n ksail cluster switch dev\n\n # Switch to a cluster named \"staging\"\n ksail cluster switch staging\n\n # Select a cluster interactively (recent clusters shown first)\n ksail cluster switch\n\nUsage:\n ksail cluster switch [cluster-name] [flags]\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Cluster Update\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nUpdate a Kubernetes cluster to match the current configuration.\n\nThis command applies changes from your ksail.yaml configuration to a running cluster.\n\nFor Talos clusters, many configuration changes can be applied in-place without\ncluster recreation (e.g., network settings, kubelet config, registry mirrors).\n\nFor Kind/K3d clusters, in-place updates are more limited. Worker node scaling\nis supported for K3d, but most other changes require cluster recreation.\n\nChanges are classified into the following categories:\n - In-Place: Applied without disruption\n - Reboot-Required: Applied but may require node reboots\n - Wipe-Required: Requires wiping node partitions (e.g. disk encryption\n migration); requires --force-drain\n - Rolling-Recreate: Nodes are replaced one at a time (e.g. a Talos × Hetzner\n server-type change); requires confirmation (or --yes to skip the prompt)\n - Recreate-Required: Require full cluster recreation\n\nConfirmation vs. disruption are two separate flags:\n - --yes (-y) skips KSail's interactive confirmation prompts only.\n - --force-drain additionally lets node drains delete pods directly (bypassing\n PodDisruptionBudgets) and authorizes partition wipes — use it when a budget\n would otherwise block a rolling reboot/recreate (may cause workload\n disruption or data loss).\n\nUse --dry-run to preview changes without applying them.\nUse --output json to emit a machine-readable diff for CI/MCP consumption.\n\nUsage:\n ksail cluster update [flags]\n\nFlags:\n --allowed-cidrs strings CIDR blocks allowed to access the Kubernetes API and Talos API on control-plane nodes. When empty, both APIs are open to 0.0.0.0/0 and ::/0 (all IPv4 and IPv6). Example: --allowed-cidrs 203.0.113.0/24 --allowed-cidrs 198.51.100.0/24\n --cdi CDI Container Device Interface (Default: use distribution, Enabled: enable CDI, Disabled: disable CDI)\n --cert-manager CertManager Cert-Manager configuration (Enabled: install, Disabled: skip)\n --cni CNI Container Network Interface (CNI) to use\n -c, --context string Kubernetes context of cluster\n --control-planes int32 Number of control-plane nodes (default 1)\n --csi CSI Container Storage Interface (Default: use distribution, Enabled: install CSI, Disabled: skip CSI)\n -d, --distribution Distribution Kubernetes distribution to use\n --distribution-config string Configuration file for the distribution\n --distribution-version string Distribution version to deploy and reconcile toward (Talos OS version). When unset KSail follows the latest supported version; set it to pin a specific version. Other distributions carry their version in the distribution config.\n --drain-timeout duration Per-node pod-eviction budget for rolling node drains during cluster update (default 10m when unset). Increase it for stateful workloads that need longer to evict gracefully (e.g. Longhorn rebuilds, database failovers). On timeout the update aborts; re-run with --force-drain to delete pods bypassing PodDisruptionBudgets. Talos only.\n --dry-run Preview changes without applying them\n --force-drain Make node drains delete pods directly, bypassing PodDisruptionBudgets, so a rolling reboot/recreate completes even when a budget would block graceful eviction; also authorizes partition wipes (may cause workload disruption or data loss). This is the destructive behavior the old --force implied.\n -g, --gitops-engine GitOpsEngine GitOps engine to use (None disables GitOps, Flux installs Flux controllers, ArgoCD installs Argo CD) (default None)\n --import-images string Path to tar archive with container images to import after cluster creation but before component installation\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n --kubernetes-version string Kubernetes version to deploy and reconcile toward. When unset KSail follows the latest supported version; set it to pin a specific version. Honored by the Talos distribution; Kind/K3d/EKS carry the version in their distribution config instead.\n --load-balancer LoadBalancer LoadBalancer support (Default: use distribution × provider, Enabled: install, Disabled: uninstall)\n --local-registry string Local registry specification: [user:pass@]host[:port][/path] (e.g., localhost:5050, ghcr.io/myorg, ${USER}:${PASS}@ghcr.io:443/org)\n --metrics-server MetricsServer Metrics Server (Default: use distribution, Enabled: install, Disabled: uninstall)\n --mirror-registry strings Configure mirror registries with optional authentication. Format: [user:pass@]host[=upstream]. Credentials support environment variables using ${VAR} syntax (quote placeholders so KSail can expand them). Examples: docker.io=https://registry-1.docker.io, '${USER}:${TOKEN}@ghcr.io=https://ghcr.io'\n -n, --name string Cluster name used for container names, registry names, and kubeconfig context\n --node-autoscaler-enabled NodeAutoscalerEnabled[=Enabled] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --node-autoscaling NodeAutoscaling [Deprecated: use autoscaler.node.enabled instead] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --oidc-ca-file string Path to CA certificate for self-signed OIDC providers\n --oidc-client-id string OIDC client ID for kubectl authentication\n --oidc-extra-scope strings Additional OIDC scopes beyond openid (repeatable)\n --oidc-groups-claim string JWT claim for Kubernetes groups (default \"groups\")\n --oidc-groups-prefix string Prefix for OIDC groups in Kubernetes (default \"oidc:\")\n --oidc-issuer-url string OIDC provider issuer URL (e.g. https://dex.example.com)\n --oidc-username-claim string JWT claim for Kubernetes username (default \"email\")\n --oidc-username-prefix string Prefix for OIDC usernames in Kubernetes (default \"oidc:\")\n --output string Output format: text (default) or json (machine-readable, for CI/MCP) (default \"text\")\n --policy-engine PolicyEngine Policy engine (None: skip, Kyverno: install Kyverno, Gatekeeper: install Gatekeeper)\n -p, --provider Provider Infrastructure provider backend (e.g., Docker)\n --workers int32 Number of worker nodes\n -y, --yes Skip KSail's interactive confirmation prompts (does NOT bypass PodDisruptionBudgets — use --force-drain for that)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Open Chat\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nStart an interactive AI chat session powered by GitHub Copilot.\n\nThe assistant understands KSail's CLI, configuration schemas, and can help with:\n - Guided cluster configuration and setup\n - Troubleshooting cluster issues\n - Explaining KSail concepts and features\n - Running KSail commands with your approval\n\nPrerequisites:\n - An active GitHub Copilot subscription\n\nWrite operations require explicit confirmation before execution.\n\nUsage:\n ksail open chat [flags]\n\nFlags:\n -m, --model string Model to use (e.g., gpt-5, claude-sonnet-4)\n -r, --reasoning-effort string Reasoning effort level for models that support it (low, medium, high)\n -s, --streaming Enable streaming responses (default true)\n -t, --timeout duration Response timeout duration (default 5m0s)\n --tui Use interactive TUI mode with markdown rendering (default true)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Open Desktop\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nOpen the KSail desktop application.\n\nThe desktop app is a native window that runs the KSail web UI locally, letting you provision and\nmanage clusters without a browser. It ships as a separate download (or build it from source with\n`make desktop`).\n\nThis command launches the desktop app from, in order: a \"ksail-desktop\" binary next to the ksail\nexecutable, the same binary on your PATH, or (on macOS) an installed \"KSail\" app.\n\nUsage:\n ksail open desktop [flags]\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Open Mcp\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nStart an MCP server that exposes KSail commands as tools.\n\nThe MCP server uses stdio for communication and is designed to be\nconsumed by MCP clients such as AI assistants and automation tools.\n\nExample usage with an MCP client:\n claude desktop or other MCP-compatible client can connect to:\n ksail open mcp\n\nThe server will run until the client disconnects or the process is terminated.\n\nUsage:\n ksail open mcp [flags]\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Open Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nOpen an interface to KSail for provisioning and managing clusters on your machine.\n\nKSail surfaces the same functionality in several ways: a web UI in your browser, a native\ndesktop app, an interactive AI chat assistant, and an MCP server for external AI tools. Pick\nwhichever fits how you work — run a subcommand below to get started.\n\nUsage:\n ksail open [command]\n\nAvailable Commands:\n chat Start an AI-assisted chat session\n desktop Open the KSail desktop application\n mcp Start an MCP server\n web Open the KSail web UI to manage local clusters\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail open [command] --help\" for more information about a command.\n\n```\n\n### Open Web\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nOpen the KSail web UI to provision and manage clusters on your machine.\n\nThis starts a small local web server (bound to 127.0.0.1 only) that serves the KSail web UI and a\nREST API backed by your local cluster lifecycle, then opens it in your browser. It is the same UI\nthe KSail operator serves in a cluster, but here it manages clusters locally via Docker.\n\nThe server runs until you press Ctrl+C.\n\nExamples:\n ksail open web\n ksail open web --port 8080\n ksail open web --no-browser\n\nUsage:\n ksail open web [flags]\n\nFlags:\n --no-browser Do not open the browser automatically\n --port int Port to serve the UI on (0 picks a free port)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Operator Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRun the KSail Kubernetes operator.\n\nThe operator runs inside a hub Kubernetes cluster, watches Cluster custom resources, and\ncontinuously reconciles them by creating, updating, and deleting the underlying clusters.\nIt is intended to be deployed via the KSail operator Helm chart rather than run directly.\n\nUsage:\n ksail operator [flags]\n\nFlags:\n --api-bind-address string Address the REST API binds to (empty disables it, e.g. \":8080\")\n --dev-logging Emit human-readable console logs instead of structured JSON (for local development)\n --health-probe-bind-address string Address the health and readiness probes bind to (default \":8081\")\n --host-cluster Register the cluster the operator runs on as a Cluster resource (named \"host\") so it appears in the cluster list (default true)\n --leader-elect Enable leader election to ensure only one active operator instance\n --metrics-bind-address string Address the metrics endpoint binds to (\"0\" disables it) (default \"0\")\n --oidc-client-id string OIDC client ID (the client secret is read from KSAIL_OPERATOR_OIDC_CLIENT_SECRET)\n --oidc-issuer-url string OIDC issuer URL; enables app-driven OIDC authentication on the REST API when set\n --oidc-redirect-url string OIDC callback URL reachable by the browser (e.g. https://host/api/v1/auth/callback)\n --oidc-scopes string OIDC scopes, space- or comma-separated (openid is always included) (default \"openid email profile\")\n --read-only Run the REST API in read-only mode, rejecting all mutating requests\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Project Add Environment\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nClone an existing cluster environment into a new one.\n\nCopies the source environment's overlay (/clusters//) and\nits root config (ksail..yaml) into a new environment , repointing the\nstructured identity along the way: the cluster-meta cluster_name, the\nclusters/ path segment and content references, the root config's metadata\nname, the connection context (distribution-aware), and — when --provider is given\n— the provider. Every other byte is preserved, so the kustomize replacements block,\nbase wiring, version pins and comments survive intact.\n\nSOPS-encrypted files (*.enc.yaml) are copied verbatim with only their path\nrepointed; re-encrypt them to the new environment's recipients afterwards with\n`ksail cipher` if the environments use different keys.\n\nExamples:\n # Clone the \"prod\" environment into a new \"staging\" environment\n ksail project add-environment staging --from prod\n\n # Clone \"prod\" into \"dev\" on a different provider, overwriting any existing files\n ksail project add-environment dev --from prod --provider Docker --force\n\nUsage:\n ksail project add-environment [flags]\n\nFlags:\n --force Overwrite existing destination files\n -f, --from string Source environment to clone from (required)\n -p, --provider string Provider for the new environment (defaults to the source provider)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Project Init\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nInitialize a new project in the specified directory (or current directory if none specified).\n\nUsage:\n ksail project init [flags]\n\nFlags:\n --allowed-cidrs strings CIDR blocks allowed to access the Kubernetes API and Talos API on control-plane nodes. When empty, both APIs are open to 0.0.0.0/0 and ::/0 (all IPv4 and IPv6). Example: --allowed-cidrs 203.0.113.0/24 --allowed-cidrs 198.51.100.0/24\n --cdi CDI Container Device Interface (Default: use distribution, Enabled: enable CDI, Disabled: disable CDI)\n --cert-manager CertManager Cert-Manager configuration (Enabled: install, Disabled: skip)\n --cni CNI Container Network Interface (CNI) to use\n -c, --context string Kubernetes context of cluster\n --control-planes int32 Number of control-plane nodes (default 1)\n --csi CSI Container Storage Interface (Default: use distribution, Enabled: install CSI, Disabled: skip CSI)\n -d, --distribution Distribution Kubernetes distribution to use\n --distribution-config string Configuration file for the distribution\n --distribution-version string Distribution version to deploy and reconcile toward (Talos OS version). When unset KSail follows the latest supported version; set it to pin a specific version. Other distributions carry their version in the distribution config.\n -f, --force Overwrite existing files\n -g, --gitops-engine GitOpsEngine GitOps engine to use (None disables GitOps, Flux installs Flux controllers, ArgoCD installs Argo CD) (default None)\n --image-verification ImageVerification Image verification (Talos: scaffold ImageVerificationConfig template; Vanilla/Kind: inject containerd verifier plugin patch; requires verifier binaries and typically policy to be present in the node image bin_dir; K3s/K3d: scaffold containerd config template with image verifier plugin and mount into node containers; requires verifier binaries and typically policy to be present in the node image bin_dir; Disabled: skip)\n --import-images string Path to tar archive with container images to import after cluster creation but before component installation\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n --kubernetes-version string Kubernetes version to deploy and reconcile toward. When unset KSail follows the latest supported version; set it to pin a specific version. Honored by the Talos distribution; Kind/K3d/EKS carry the version in their distribution config instead.\n --kustomization-file string Relative directory within sourceDirectory used as the kustomize entry point (e.g., clusters/local)\n --load-balancer LoadBalancer LoadBalancer support (Default: use distribution × provider, Enabled: install, Disabled: uninstall)\n --local-registry string Local registry specification: [user:pass@]host[:port][/path] (e.g., localhost:5050, ghcr.io/myorg, ${USER}:${PASS}@ghcr.io:443/org)\n --metrics-server MetricsServer Metrics Server (Default: use distribution, Enabled: install, Disabled: uninstall)\n --mirror-registry strings Configure mirror registries with optional authentication. Format: [user:pass@]host[=upstream]. Credentials support environment variables using ${VAR} syntax (quote placeholders so KSail can expand them). Examples: docker.io=https://registry-1.docker.io, '${USER}:${TOKEN}@ghcr.io=https://ghcr.io'\n --multi-cluster string Scaffold a multi-cluster source layout (clusters/base/ + clusters//) with the given initial environment name; the generated ksail.yaml points its kustomizationFile at the environment overlay\n -n, --name string Cluster name used for container names, registry names, and kubeconfig context\n --no-devcontainer Skip scaffolding .devcontainer/devcontainer.json\n --node-autoscaler-enabled NodeAutoscalerEnabled[=Enabled] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --node-autoscaling NodeAutoscaling [Deprecated: use autoscaler.node.enabled instead] Node autoscaling (Talos: Enabled defers worker and control-plane scaling to an external autoscaler, Disabled lets KSail manage node counts; other distributions currently ignore this setting)\n --oidc-ca-file string Path to CA certificate for self-signed OIDC providers\n --oidc-client-id string OIDC client ID for kubectl authentication\n --oidc-extra-scope strings Additional OIDC scopes beyond openid (repeatable)\n --oidc-groups-claim string JWT claim for Kubernetes groups (default \"groups\")\n --oidc-groups-prefix string Prefix for OIDC groups in Kubernetes (default \"oidc:\")\n --oidc-issuer-url string OIDC provider issuer URL (e.g. https://dex.example.com)\n --oidc-username-claim string JWT claim for Kubernetes username (default \"email\")\n --oidc-username-prefix string Prefix for OIDC usernames in Kubernetes (default \"oidc:\")\n -o, --output string Output directory for the project\n --policy-engine PolicyEngine Policy engine (None: skip, Kyverno: install Kyverno, Gatekeeper: install Gatekeeper)\n --provider Provider Infrastructure provider backend (e.g., Docker)\n -s, --source-directory string Directory containing workloads to deploy (default \"k8s\")\n --workers int32 Number of worker nodes\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Project Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nManage the GitOps project files (the on-disk project structure) without contacting a live cluster. These commands scaffold and transform the project — e.g. initializing a new project and cloning environments — as opposed to the cluster commands that operate on a running cluster.\n\nUsage:\n ksail project [flags]\n ksail project [command]\n\nAvailable Commands:\n add-environment Clone an existing cluster environment into a new one\n init Initialize a new project\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail project [command] --help\" for more information about a command.\n\n```\n\n### Tenant Create\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nGenerate RBAC isolation manifests and GitOps sync resources for a new tenant.\n\nUsage:\n ksail tenant create [flags]\n\nFlags:\n --cluster-role strings ClusterRole(s) to bind to the tenant ServiceAccount (repeatable) (default [edit])\n --delivery string How to deliver platform changes: commit or pr (default \"commit\")\n --disable-token-automount Set automountServiceAccountToken: false on the tenant ServiceAccount\n --flux-decryption (Flux) Add a SOPS decryption block referencing the sops-age secret\n --flux-retry-interval string (Flux) Flux Kustomization retryInterval\n --flux-timeout string (Flux) Flux Kustomization timeout; setting it implies --flux-wait (default 5m when waiting)\n --flux-wait (Flux) Set wait: true and timeout on the Flux Kustomization\n --force Overwrite existing tenant directory\n --git-provider string Git provider for manifest URLs: github, gitlab, gitea (repo scaffolding requires github)\n --git-token string GitHub API token for repo scaffolding (--git-provider=github)\n --image-pull-secret strings imagePullSecret to add to the tenant ServiceAccount (repeatable)\n --kustomization-path string Path to kustomization.yaml (fallback: auto-discover)\n --limit-default-cpu string Default container CPU limit (default \"500m\")\n --limit-default-memory string Default container memory limit (default \"512Mi\")\n --limit-request-cpu string Default container CPU request (default \"100m\")\n --limit-request-memory string Default container memory request (default \"128Mi\")\n -n, --namespace strings Namespaces to create (repeatable, default: tenant-name)\n --oci-path string Path suffix appended to OCI registry URL to avoid tag collisions (e.g., 'manifests' produces oci://registry/owner/repo/manifests)\n -o, --output string Output directory for platform manifests (default \".\")\n --platform-repo string Platform repo as owner/repo-name for PR delivery (default: auto-detect from git remote)\n --pod-security string Pod Security Standards level for namespaces: restricted, baseline, or privileged\n --production Enable the recommended production baseline (PSS baseline, default-deny NetworkPolicy, ResourceQuota, LimitRange, hardened ServiceAccount and Flux sync)\n --quota-cpu string CPU quota (sets requests.cpu and limits.cpu) (default \"4\")\n --quota-memory string Memory quota (sets requests.memory and limits.memory) (default \"8Gi\")\n --register Register tenant in kustomization.yaml\n --registry string OCI registry URL for Flux OCI source (e.g., oci://ghcr.io)\n --repo-visibility string Repo visibility: Private, Internal, or Public (default \"Private\")\n --source-directory string Directory name for tenant manifests in the tenant repo (default \"k8s\")\n --sync-source string Flux source type: oci or git (default \"oci\")\n --target-branch string PR target branch (default: repo's default branch)\n --tenant-repo string Tenant repo as owner/repo-name\n -t, --type string Tenant type: flux, argocd, or kubectl (default: auto-detect from ksail.yaml gitOpsEngine)\n --with-limit-range Generate a LimitRange with default container requests/limits\n --with-network-policy Generate default-deny NetworkPolicy plus DNS and intra-namespace allow rules\n --with-quota Generate a ResourceQuota for each namespace\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Tenant Delete\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRemove tenant manifests, unregister from kustomization.yaml, and optionally delete the tenant Git repository.\n\nUsage:\n ksail tenant delete [flags]\n\nFlags:\n --delete-repo Also delete the tenant Git repository\n -f, --force Skip all confirmation prompts\n --git-provider string Git provider (required with --delete-repo)\n --git-token string Git provider API token\n --kustomization-path string Path to kustomization.yaml\n -o, --output string Directory containing tenant manifests (default \".\")\n --tenant-repo string Tenant repo as owner/repo-name (required with --delete-repo)\n --unregister Remove tenant from kustomization.yaml (default true)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Tenant Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nManage multi-tenancy onboarding for Kubernetes clusters, including RBAC isolation, GitOps sync resources, and tenant repository scaffolding.\n\nUsage:\n ksail tenant [flags]\n ksail tenant [command]\n\nAvailable Commands:\n create Create a new tenant\n delete Delete a tenant\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail tenant [command] --help\" for more information about a command.\n\n```\n\n### Workload Apply Edit Last Applied\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nEdit the latest last-applied-configuration annotations of resources from the default editor.\n\n The edit-last-applied command allows you to directly edit any API resource you can retrieve via the command-line tools. It will open the editor defined by your KUBE_EDITOR, or EDITOR environment variables, or fall back to 'vi' for Linux or 'notepad' for Windows. You can edit multiple objects, although changes are applied one at a time. The command accepts file names as well as command-line arguments, although the files you point to must be previously saved versions of resources.\n\n The default format is YAML. To edit in JSON, specify \"-o json\".\n\n The flag --windows-line-endings can be used to force Windows line endings, otherwise the default for your operating system will be used.\n\n In the event an error occurs while updating, a temporary file will be created on disk that contains your unapplied changes. The most common error when updating a resource is another editor changing the resource on the server. When this occurs, you will have to apply your changes to the newer version of the resource, or update your temporary saved copy to include the latest resource version.\n\nUsage:\n ksail workload apply edit-last-applied (RESOURCE/NAME | -f FILENAME)\n\nExamples:\n # Edit the last-applied-configuration annotations by type/name in YAML\n kubectl apply edit-last-applied deployment/nginx\n \n # Edit the last-applied-configuration annotations by file in JSON\n kubectl apply edit-last-applied -f deploy.yaml -o json\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-client-side-apply\")\n -f, --filename strings Filename, directory, or URL to files to use to edit the resource\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --windows-line-endings Defaults to the line ending native to your platform.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Apply Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nApply local Kubernetes manifests to your cluster.\n\nUsage:\n ksail workload apply\n ksail workload apply [command]\n\nExamples:\n # Apply the configuration in pod.json to a pod\n ksail workload apply -f ./pod.json\n \n # Apply resources from a directory containing kustomization.yaml - e.g. dir/kustomization.yaml\n ksail workload apply -k dir/\n \n # Apply the JSON passed into stdin to a pod\n cat pod.json | ksail workload apply -f -\n \n # Apply the configuration from all files that end with '.json'\n ksail workload apply -f '*.json'\n \n # Note: --prune is still in Alpha\n # Apply the configuration in manifest.yaml that matches label app=nginx and delete all other resources that are not in the file and match label app=nginx\n ksail workload apply --prune -f manifest.yaml -l app=nginx\n \n # Apply the configuration in manifest.yaml and delete all the other config maps that are not in the file\n ksail workload apply --prune -f manifest.yaml --all --prune-allowlist=core/v1/ConfigMap\n\nAvailable Commands:\n edit-last-applied Edit latest last-applied-configuration annotations of a resource/object\n set-last-applied Set the last-applied-configuration annotation on a live object to match the contents of a file\n view-last-applied View the latest last-applied-configuration annotations of a resource/object\n\nFlags:\n --all Select all resources in the namespace of the specified resource types.\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --cascade string[=\"background\"] Must be \"background\", \"orphan\", or \"foreground\". Selects the deletion cascading strategy for the dependents (e.g. Pods created by a ReplicationController). Defaults to background. (default \"background\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-client-side-apply\")\n -f, --filename strings The files that contain the configurations to apply.\n --force If true, immediately remove resources from API and bypass graceful deletion. Note that immediate deletion of some resources may result in inconsistency or data loss and requires confirmation.\n --force-conflicts If true, server-side apply will force the changes against conflicts.\n --grace-period int Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. Set to 1 for immediate shutdown. Can only be set to 0 when --force is true (force deletion). (default -1)\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process a kustomization directory. This flag can't be used together with -f or -R.\n -n, --namespace string If present, the namespace scope for this CLI request\n --openapi-patch If true, use openapi to calculate diff when the openapi presents and the resource can be found in the openapi spec. Otherwise, fall back to use baked-in types. (default true)\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --overwrite Automatically resolve conflicts between the modified and live configuration by using values from the modified configuration (default true)\n --prune Automatically delete resource objects, that do not appear in the configs and are created by either apply or create --save-config. Should be used with either -l or --all.\n --prune-allowlist stringArray Overwrite the default allowlist with for --prune\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --server-side If true, apply runs in the server instead of the client.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --subresource string If specified, apply will operate on the subresource of the requested object. Only allowed when using --server-side.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --timeout duration The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --wait If true, wait for resources to be gone before returning. This waits for finalizers.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload apply [command] --help\" for more information about a command.\n\n```\n\n### Workload Apply Set Last Applied\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nSet the latest last-applied-configuration annotations by setting it to match the contents of a file. This results in the last-applied-configuration being updated as though 'kubectl apply -f ' was run, without updating any other parts of the object.\n\nUsage:\n ksail workload apply set-last-applied -f FILENAME\n\nExamples:\n # Set the last-applied-configuration of a resource to match the contents of a file\n kubectl apply set-last-applied -f deploy.yaml\n \n # Execute set-last-applied against each configuration file in a directory\n kubectl apply set-last-applied -f path/\n \n # Set the last-applied-configuration of a resource to match the contents of a file; will create the annotation if it does not already exist\n kubectl apply set-last-applied -f deploy.yaml --create-annotation=true\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --create-annotation Will create 'last-applied-configuration' annotations if current objects doesn't have one\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n -f, --filename strings Filename, directory, or URL to files that contains the last-applied-configuration annotations\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Apply View Last Applied\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nView the latest last-applied-configuration annotations by type/name or file.\n\n The default output will be printed to stdout in YAML format. You can use the -o option to change the output format.\n\nUsage:\n ksail workload apply view-last-applied (TYPE [NAME | -l label] | TYPE/NAME | -f FILENAME)\n\nExamples:\n # View the last-applied-configuration annotations by type/name in YAML\n kubectl apply view-last-applied deployment/nginx\n \n # View the last-applied-configuration annotations by file in JSON\n kubectl apply view-last-applied -f deploy.yaml -o json\n\nFlags:\n --all Select all resources in the namespace of the specified resource types\n -f, --filename strings Filename, directory, or URL to files that contains the last-applied-configuration annotations\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. Must be one of (yaml, json) (default \"yaml\")\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Cipher Decrypt\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDecrypt a file using SOPS (Secrets OPerationS).\n\nIf no file is given, input is read from stdin.\n\nSOPS supports multiple key management systems:\n - age recipients\n - PGP fingerprints\n - AWS KMS\n - GCP KMS\n - Azure Key Vault\n - HashiCorp Vault\n\nExample:\n ksail workload cipher decrypt secrets.yaml\n ksail workload cipher decrypt secrets.yaml --extract '[\"data\"][\"password\"]'\n ksail workload cipher decrypt secrets.yaml --output plaintext.yaml\n ksail workload cipher decrypt secrets.yaml --ignore-mac\n cat secrets.enc.yaml | ksail workload cipher decrypt\n\nUsage:\n ksail workload cipher decrypt [file] [flags]\n\nFlags:\n -e, --extract string extract a specific key from the decrypted file (JSONPath format)\n --ignore-mac ignore Message Authentication Code (MAC) check\n -o, --output string output file path (default: stdout)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Cipher Edit\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nEdit an encrypted file using SOPS (Secrets OPerationS).\n\nIf the file exists and is encrypted, it will be decrypted for editing.\nIf the file does not exist, an example file will be created.\n\nThe editor is determined by (in order of precedence):\n 1. --editor flag\n 2. spec.editor from ksail.yaml config\n 3. SOPS_EDITOR or EDITOR environment variables\n 4. Fallback to vim, nano, or vi\n\nSOPS supports multiple key management systems:\n - age recipients\n - PGP fingerprints\n - AWS KMS\n - GCP KMS\n - Azure Key Vault\n - HashiCorp Vault\n\nExample:\n ksail workload cipher edit secrets.yaml\n ksail workload cipher edit --editor \"code --wait\" secrets.yaml\n SOPS_EDITOR=\"code --wait\" ksail workload cipher edit secrets.yaml\n\nUsage:\n ksail workload cipher edit [flags]\n\nFlags:\n --editor string editor command to use (e.g., 'code --wait', 'vim', 'nano')\n --ignore-mac ignore Message Authentication Code during decryption\n --show-master-keys show master keys in the editor\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Cipher Encrypt\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nEncrypt a file using SOPS (Secrets OPerationS).\n\nSOPS supports multiple key management systems:\n - age recipients\n - PGP fingerprints\n - AWS KMS\n - GCP KMS\n - Azure Key Vault\n - HashiCorp Vault\n\nExample:\n ksail workload cipher encrypt secrets.yaml\n\nUsage:\n ksail workload cipher encrypt [flags]\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Cipher Import\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nImport an age private key to the system's default SOPS age key location.\n\nThe private key must be provided as a command argument and must include the full\nkey with the AGE-SECRET-KEY- prefix.\n\nThe public key will be automatically derived from the private key.\n\nThe command will automatically add metadata including:\n - Creation timestamp\n - Public key (derived from private key)\n\nKey file location (checked in order):\n 1. SOPS_AGE_KEY_FILE environment variable\n 2. $XDG_CONFIG_HOME/sops/age/keys.txt (if XDG_CONFIG_HOME is set)\n 3. Platform-specific defaults:\n Linux: $HOME/.config/sops/age/keys.txt\n macOS: $HOME/Library/Application Support/sops/age/keys.txt\n Windows: %AppData%\\sops\\age\\keys.txt\n\nThe private key must be in age format (starting with \"AGE-SECRET-KEY-\").\n\nExamples:\n # Import a private key (public key will be derived automatically)\n ksail workload cipher import AGE-SECRET-KEY-1ABCDEF...\n\nUsage:\n ksail workload cipher import PRIVATE_KEY [flags]\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Cipher Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCipher command provides access to SOPS (Secrets OPerationS) functionality\nfor encrypting and decrypting files.\n\nSOPS supports multiple key management systems:\n - age recipients\n - PGP fingerprints\n - AWS KMS\n - GCP KMS\n - Azure Key Vault\n - HashiCorp Vault\n\nUsage:\n ksail workload cipher [command]\n\nAvailable Commands:\n decrypt Decrypt a file with SOPS\n edit Edit an encrypted file with SOPS\n encrypt Encrypt a file with SOPS\n import Import an age key to the system's SOPS key location\n rotate Rotate data keys for SOPS-encrypted files\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload cipher [command] --help\" for more information about a command.\n\n```\n\n### Workload Cipher Rotate\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRotate data keys for SOPS-encrypted files.\n\nThis command generates a new data encryption key and re-encrypts all values\nin the target file(s). This is the same behavior as the native 'sops rotate'\ncommand, extended with batch directory support.\n\nWhen the target is a file, only that file is rotated. When the target is a\nfolder, all SOPS-encrypted YAML and JSON files in the folder are rotated.\nUse --recursive to include subdirectories.\n\nOptionally, master key recipients can be added or removed during rotation:\n --add-key adds a new master key recipient\n --remove-key removes an existing master key recipient\n\nBy default, the command shows which files will be affected and prompts for\nconfirmation. Use --force to skip the confirmation prompt. In non-interactive\nenvironments (no TTY), the prompt is automatically skipped.\n\nUse --dry-run to preview which files would be rotated without making changes.\n\nKey type is auto-detected from the key format:\n - Age keys (age1...)\n\nExamples:\n # Rotate all encrypted files in a folder (with confirmation)\n ksail workload cipher rotate ./k8s\n\n # Rotate without confirmation prompt\n ksail workload cipher rotate ./k8s --force\n\n # Rotate recursively through subdirectories\n ksail workload cipher rotate ./k8s --recursive\n\n # Rotate a single file\n ksail workload cipher rotate secrets.yaml\n\n # Add a new age recipient during rotation\n ksail workload cipher rotate ./k8s --add-key age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p\n\n # Remove an old age recipient during rotation\n ksail workload cipher rotate ./k8s --remove-key age1oldkey...\n\n # Replace a recipient (add new, remove old)\n ksail workload cipher rotate ./k8s --add-key age1newkey... --remove-key age1oldkey...\n\n # Re-seal every file to a completely new recipient set (e.g. after a key is\n # retired or compromised) — declare the full set, no need to enumerate old keys\n ksail workload cipher rotate ./k8s --set-key age1newkey1... --set-key age1newkey2... --recursive\n\n # Preview which files would be rotated without making changes\n ksail workload cipher rotate ./k8s --dry-run\n\nUsage:\n ksail workload cipher rotate [flags]\n\nFlags:\n --add-key string public key to add as a master key recipient\n --dry-run show which files would be rotated without making changes\n -f, --force skip confirmation prompt and rotate immediately\n -r, --recursive scan subdirectories when target is a folder\n --remove-key string public key to remove from master key recipients\n --set-key stringArray public key for the complete new recipient set (repeatable); replaces all recipients and re-seals to a fresh data key — mutually exclusive with --add-key/--remove-key\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Clusterrole\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cluster role.\n\nUsage:\n ksail workload create clusterrole NAME --verb=verb --resource=resource.group [--resource-name=resourcename] [--dry-run=server|client|none]\n\nExamples:\n # Create a cluster role named \"pod-reader\" that allows user to perform \"get\", \"watch\" and \"list\" on pods\n kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods\n \n # Create a cluster role named \"pod-reader\" with ResourceName specified\n kubectl create clusterrole pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod\n \n # Create a cluster role named \"foo\" with API Group specified\n kubectl create clusterrole foo --verb=get,list,watch --resource=rs.apps\n \n # Create a cluster role named \"foo\" with SubResource specified\n kubectl create clusterrole foo --verb=get,list,watch --resource=pods,pods/status\n \n # Create a cluster role name \"foo\" with NonResourceURL specified\n kubectl create clusterrole \"foo\" --verb=get --non-resource-url=/logs/*\n \n # Create a cluster role name \"monitoring\" with AggregationRule specified\n kubectl create clusterrole monitoring --aggregation-rule=\"rbac.example.com/aggregate-to-monitoring=true\"\n\nFlags:\n --aggregation-rule mapStringString An aggregation label selector for combining ClusterRoles.\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --non-resource-url strings A partial url that user should have access to.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --resource strings Resource that the rule applies to\n --resource-name stringArray Resource in the white list that the rule applies to, repeat this flag for multiple items\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --verb strings Verb that applies to the resources contained in the rule\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Clusterrolebinding\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cluster role binding for a particular cluster role.\n\nUsage:\n ksail workload create clusterrolebinding NAME --clusterrole=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none]\n\nExamples:\n # Create a cluster role binding for user1, user2, and group1 using the cluster-admin cluster role\n kubectl create clusterrolebinding cluster-admin --clusterrole=cluster-admin --user=user1 --user=user2 --group=group1\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterrole string ClusterRole this ClusterRoleBinding should reference\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --group stringArray Groups to bind to the clusterrole. The flag can be repeated to add multiple groups.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --serviceaccount stringArray Service accounts to bind to the clusterrole, in the format :. The flag can be repeated to add multiple service accounts.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --user stringArray Usernames to bind to the clusterrole. The flag can be repeated to add multiple users.\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Configmap\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a config map based on a file, directory, or specified literal value.\n\n A single config map may package one or more key/value pairs.\n\n When creating a config map based on a file, the key will default to the basename of the file, and the value will default to the file content. If the basename is an invalid key, you may specify an alternate key.\n\n When creating a config map based on a directory, each file whose basename is a valid key in the directory will be packaged into the config map. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).\n\nUsage:\n ksail workload create configmap NAME [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none]\n\nAliases:\n configmap, cm\n\nExamples:\n # Create a new config map named my-config based on folder bar\n kubectl create configmap my-config --from-file=path/to/bar\n \n # Create a new config map named my-config with specified keys instead of file basenames on disk\n kubectl create configmap my-config --from-file=key1=/path/to/bar/file1.txt --from-file=key2=/path/to/bar/file2.txt\n \n # Create a new config map named my-config with key1=config1 and key2=config2\n kubectl create configmap my-config --from-literal=key1=config1 --from-literal=key2=config2\n \n # Create a new config map named my-config with key=value pairs from an env file\n kubectl create configmap my-config --from-env-file=path/to/bar.env\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the configmap to its name.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-env-file strings Specify the path to a file to read lines of key=val pairs to create a configmap.\n --from-file strings Key file can be specified using its file path, in which case file basename will be used as configmap key, or optionally with a key and file path, in which case the given key will be used. Specifying a directory will iterate each named file in the directory whose basename is a valid configmap key.\n --from-literal stringArray Specify a key and literal value to insert in configmap (i.e. mykey=somevalue)\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Cronjob\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cron job with the specified name.\n\nUsage:\n ksail workload create cronjob NAME --image=image --schedule='0/5 * * * ?' -- [COMMAND] [args...] [flags]\n\nAliases:\n cronjob, cj\n\nExamples:\n # Create a cron job\n kubectl create cronjob my-job --image=busybox --schedule=\"*/1 * * * *\"\n \n # Create a cron job with a command\n kubectl create cronjob my-job --image=busybox --schedule=\"*/1 * * * *\" -- date\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --image string Image name to run.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --restart string job's restart policy. supported values: OnFailure, Never\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --schedule string A schedule in the Cron format the job should be run with.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Deployment\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a deployment with the specified name.\n\nUsage:\n ksail workload create deployment NAME --image=image -- [COMMAND] [args...]\n\nAliases:\n deployment, deploy\n\nExamples:\n # Create a deployment named my-dep that runs the busybox image\n kubectl create deployment my-dep --image=busybox\n \n # Create a deployment with a command\n kubectl create deployment my-dep --image=busybox -- date\n \n # Create a deployment named my-dep that runs the nginx image with 3 replicas\n kubectl create deployment my-dep --image=nginx --replicas=3\n \n # Create a deployment named my-dep that runs the busybox image and expose port 5701\n kubectl create deployment my-dep --image=busybox --port=5701\n \n # Create a deployment named my-dep that runs multiple containers\n kubectl create deployment my-dep --image=busybox:latest --image=ubuntu:latest --image=nginx\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --image strings Image names to run. A deployment can have multiple images set for multi-container pod.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --port int32 The containerPort that this deployment exposes. (default -1)\n -r, --replicas int32 Number of replicas to create. Default is 1. (default 1)\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Helmrelease\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update a HelmRelease resource using Flux APIs\n\nUsage:\n ksail workload create helmrelease [name] [flags]\n\nAliases:\n helmrelease, hr\n\nExamples:\n # Create a HelmRelease with a chart from a HelmRepository source\n ksail workload create helmrelease podinfo \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --chart-version=6.6.2 \\\n --namespace=flux-system\n\n # Create a HelmRelease targeting a different namespace\n ksail workload create helmrelease podinfo \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --target-namespace=production \\\n --create-target-namespace=true\n\nFlags:\n --chart string Helm chart name or path\n --chart-version string Helm chart version\n --create-target-namespace create the target namespace if it doesn't exist\n --depends-on strings HelmRelease that must be ready before this one\n --export export in YAML format to stdout\n --interval duration reconciliation interval (default 1m0s)\n --source string source name in format 'Kind/name' or 'Kind/name.namespace'\n --source-kind string source kind (HelmRepository, GitRepository, Bucket) (default \"HelmRepository\")\n --target-namespace string namespace to install the Helm release\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Ingress\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate an ingress with the specified name.\n\nUsage:\n ksail workload create ingress NAME --rule=host/path=service:port[,tls[=secret]] \n\nAliases:\n ingress, ing\n\nExamples:\n # Create a single ingress called 'simple' that directs requests to foo.com/bar to svc\n # svc1:8080 with a TLS secret \"my-cert\"\n kubectl create ingress simple --rule=\"foo.com/bar=svc1:8080,tls=my-cert\"\n \n # Create a catch all ingress of \"/path\" pointing to service svc:port and Ingress Class as \"otheringress\"\n kubectl create ingress catch-all --class=otheringress --rule=\"/path=svc:port\"\n \n # Create an ingress with two annotations: ingress.annotation1 and ingress.annotations2\n kubectl create ingress annotated --class=default --rule=\"foo.com/bar=svc:port\" \\\n --annotation ingress.annotation1=foo \\\n --annotation ingress.annotation2=bla\n \n # Create an ingress with the same host and multiple paths\n kubectl create ingress multipath --class=default \\\n --rule=\"foo.com/=svc:port\" \\\n --rule=\"foo.com/admin/=svcadmin:portadmin\"\n \n # Create an ingress with multiple hosts and the pathType as Prefix\n kubectl create ingress ingress1 --class=default \\\n --rule=\"foo.com/path*=svc:8080\" \\\n --rule=\"bar.com/admin*=svc2:http\"\n \n # Create an ingress with TLS enabled using the default ingress certificate and different path types\n kubectl create ingress ingtls --class=default \\\n --rule=\"foo.com/=svc:https,tls\" \\\n --rule=\"foo.com/path/subpath*=othersvc:8080\"\n \n # Create an ingress with TLS enabled using a specific secret and pathType as Prefix\n kubectl create ingress ingsecret --class=default \\\n --rule=\"foo.com/*=svc:8080,tls=secret1\"\n \n # Create an ingress with a default backend\n kubectl create ingress ingdefault --class=default \\\n --default-backend=defaultsvc:http \\\n --rule=\"foo.com/*=svc:8080,tls=secret1\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --annotation stringArray Annotation to insert in the ingress object, in the format annotation=value\n --class string Ingress Class to be used\n --default-backend string Default service for backend, in format of svcname:port\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --rule stringArray Rule in format host/path=service:port[,tls=secretname]. Paths containing the leading character '*' are considered pathType=Prefix. tls argument is optional.\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Job\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a job with the specified name.\n\nUsage:\n ksail workload create job NAME --image=image [--from=cronjob/name] -- [COMMAND] [args...]\n\nExamples:\n # Create a job\n kubectl create job my-job --image=busybox\n \n # Create a job with a command\n kubectl create job my-job --image=busybox -- date\n \n # Create a job from a cron job named \"a-cronjob\"\n kubectl create job test-job --from=cronjob/a-cronjob\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from string The name of the resource to create a Job from (only CronJob is supported).\n --image string Image name to run.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Kustomization\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update a Kustomization resource using Flux APIs\n\nUsage:\n ksail workload create kustomization [name] [flags]\n\nExamples:\n # Create a Kustomization from a GitRepository source\n ksail workload create kustomization podinfo \\\n --source=GitRepository/podinfo \\\n --path=\"./kustomize\" \\\n --prune=true \\\n --interval=5m\n\n # Create a Kustomization with a target namespace\n ksail workload create kustomization podinfo \\\n --source=GitRepository/podinfo \\\n --path=\"./kustomize\" \\\n --target-namespace=default \\\n --prune=true\n\nFlags:\n --depends-on strings Kustomization that must be ready before this one\n --export export in YAML format to stdout\n --interval duration reconciliation interval (default 1m0s)\n --path string path to the directory containing a kustomization.yaml file (default \"./\")\n --prune enable garbage collection\n --source string source name in format 'Kind/name' or 'Kind/name.namespace'\n --source-kind string source kind (GitRepository, OCIRepository, Bucket) (default \"GitRepository\")\n --target-namespace string overrides the namespace of all Kustomization objects\n --wait enable health checking\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Namespace\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a namespace with the specified name.\n\nUsage:\n ksail workload create namespace NAME [--dry-run=server|client|none]\n\nAliases:\n namespace, ns\n\nExamples:\n # Create a new namespace named my-namespace\n kubectl create namespace my-namespace\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Poddisruptionbudget\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a pod disruption budget with the specified name, selector, and desired minimum available pods.\n\nUsage:\n ksail workload create poddisruptionbudget NAME --selector=SELECTOR --min-available=N [--dry-run=server|client|none]\n\nAliases:\n poddisruptionbudget, pdb\n\nExamples:\n # Create a pod disruption budget named my-pdb that will select all pods with the app=rails label\n # and require at least one of them being available at any point in time\n kubectl create poddisruptionbudget my-pdb --selector=app=rails --min-available=1\n \n # Create a pod disruption budget named my-pdb that will select all pods with the app=nginx label\n # and require at least half of the pods selected to be available at any point in time\n kubectl create pdb my-pdb --selector=app=nginx --min-available=50%\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --max-unavailable string The maximum number or percentage of unavailable pods this budget requires.\n --min-available string The minimum number or percentage of available pods this budget requires.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --selector string A label selector to use for this budget. Only equality-based selector requirements are supported.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Priorityclass\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a priority class with the specified name, value, globalDefault and description.\n\nUsage:\n ksail workload create priorityclass NAME --value=VALUE --global-default=BOOL [--dry-run=server|client|none]\n\nAliases:\n priorityclass, pc\n\nExamples:\n # Create a priority class named high-priority\n kubectl create priorityclass high-priority --value=1000 --description=\"high priority\"\n \n # Create a priority class named default-priority that is considered as the global default priority\n kubectl create priorityclass default-priority --value=1000 --global-default=true --description=\"default priority\"\n \n # Create a priority class named high-priority that cannot preempt pods with lower priority\n kubectl create priorityclass high-priority --value=1000 --description=\"high priority\" --preemption-policy=\"Never\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --description string description is an arbitrary string that usually provides guidelines on when this priority class should be used.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --global-default global-default specifies whether this PriorityClass should be considered as the default priority.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --preemption-policy string preemption-policy is the policy for preempting pods with lower priority. (default \"PreemptLowerPriority\")\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --value int32 the value of this priority class.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Quota\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a resource quota with the specified name, hard limits, and optional scopes.\n\nUsage:\n ksail workload create quota NAME [--hard=key1=value1,key2=value2] [--scopes=Scope1,Scope2] [--dry-run=server|client|none]\n\nAliases:\n quota, resourcequota\n\nExamples:\n # Create a new resource quota named my-quota\n kubectl create quota my-quota --hard=cpu=1,memory=1G,pods=2,services=3,replicationcontrollers=2,resourcequotas=1,secrets=5,persistentvolumeclaims=10\n \n # Create a new resource quota named best-effort\n kubectl create quota best-effort --hard=pods=100 --scopes=BestEffort\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --hard string A comma-delimited set of resource=quantity pairs that define a hard limit.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --scopes string A comma-delimited set of quota scopes that must all match each object tracked by the quota.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Role\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a role with single rule.\n\nUsage:\n ksail workload create role NAME --verb=verb --resource=resource.group/subresource [--resource-name=resourcename] [--dry-run=server|client|none]\n\nExamples:\n # Create a role named \"pod-reader\" that allows user to perform \"get\", \"watch\" and \"list\" on pods\n kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods\n \n # Create a role named \"pod-reader\" with ResourceName specified\n kubectl create role pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod\n \n # Create a role named \"foo\" with API Group specified\n kubectl create role foo --verb=get,list,watch --resource=rs.apps\n \n # Create a role named \"foo\" with SubResource specified\n kubectl create role foo --verb=get,list,watch --resource=pods,pods/status\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --resource strings Resource that the rule applies to\n --resource-name stringArray Resource in the white list that the rule applies to, repeat this flag for multiple items\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --verb strings Verb that applies to the resources contained in the rule\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Rolebinding\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a role binding for a particular role or cluster role.\n\nUsage:\n ksail workload create rolebinding NAME --clusterrole=NAME|--role=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none]\n\nExamples:\n # Create a role binding for user1, user2, and group1 using the admin cluster role\n kubectl create rolebinding admin --clusterrole=admin --user=user1 --user=user2 --group=group1\n \n # Create a role binding for service account monitoring:sa-dev using the admin role\n kubectl create rolebinding admin-binding --role=admin --serviceaccount=monitoring:sa-dev\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterrole string ClusterRole this RoleBinding should reference\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --group stringArray Groups to bind to the role. The flag can be repeated to add multiple groups.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --role string Role this RoleBinding should reference\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --serviceaccount stringArray Service accounts to bind to the role, in the format :. The flag can be repeated to add multiple service accounts.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --user stringArray Usernames to bind to the role. The flag can be repeated to add multiple users.\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate Kubernetes resources from files or stdin.\n\nUsage:\n ksail workload create\n ksail workload create [command]\n\nExamples:\n # Create a pod using the data in pod.json\n ksail workload create -f ./pod.json\n \n # Create a pod based on the JSON passed into stdin\n cat pod.json | ksail workload create -f -\n \n # Edit the data in registry.yaml in JSON then create the resource using the edited data\n ksail workload create -f registry.yaml --edit -o json\n\nAvailable Commands:\n clusterrole Create a cluster role\n clusterrolebinding Create a cluster role binding for a particular cluster role\n configmap Create a config map from a local file, directory or literal value\n cronjob Create a cron job with the specified name\n deployment Create a deployment with the specified name\n helmrelease Create or update a HelmRelease resource\n ingress Create an ingress with the specified name\n job Create a job with the specified name\n kustomization Create or update a Kustomization resource\n namespace Create a namespace with the specified name\n poddisruptionbudget Create a pod disruption budget with the specified name\n priorityclass Create a priority class with the specified name\n quota Create a quota with the specified name\n role Create a role with single rule\n rolebinding Create a role binding for a particular role or cluster role\n secret Create a secret using a specified subcommand\n service Create a service using a specified subcommand\n serviceaccount Create a service account with the specified name\n source Create or update Flux sources\n token Request a service account token\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --edit Edit the API resource before creating\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -f, --filename strings Filename, directory, or URL to files to use to create the resource\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -n, --namespace string If present, the namespace scope for this CLI request\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --raw string Raw URI to POST to the server. Uses the transport specified by the kubeconfig file.\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --windows-line-endings Only relevant if --edit=true. Defaults to the line ending native to your platform.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload create [command] --help\" for more information about a command.\n\n```\n\n### Workload Create Secret Docker Registry\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a new secret for use with Docker registries.\n \n Dockercfg secrets are used to authenticate against Docker registries.\n \n When using the Docker command line to push images, you can authenticate to a given registry by running:\n '$ docker login DOCKER_REGISTRY_SERVER --username=DOCKER_USER --password=DOCKER_PASSWORD --email=DOCKER_EMAIL'.\n \n That produces a ~/.dockercfg file that is used by subsequent 'docker push' and 'docker pull' commands to authenticate to the registry. The email address is optional.\n\n When creating applications, you may have a Docker registry that requires authentication. In order for the\n nodes to pull images on your behalf, they must have the credentials. You can provide this information\n by creating a dockercfg secret and attaching it to your service account.\n\nUsage:\n ksail workload create secret docker-registry NAME --docker-username=user --docker-password=password --docker-email=email [--docker-server=string] [--from-file=[key=]source] [--dry-run=server|client|none]\n\nExamples:\n # If you do not already have a .dockercfg file, create a dockercfg secret directly\n kubectl create secret docker-registry my-secret --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER --docker-password=DOCKER_PASSWORD --docker-email=DOCKER_EMAIL\n \n # Create a new secret named my-secret from ~/.docker/config.json\n kubectl create secret docker-registry my-secret --from-file=path/to/.docker/config.json\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --docker-email string Email for Docker registry\n --docker-password string Password for Docker registry authentication\n --docker-server string Server location for Docker registry (default \"https://index.docker.io/v1/\")\n --docker-username string Username for Docker registry authentication\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-file strings Key files can be specified using their file path, in which case a default name of .dockerconfigjson will be given to them, or optionally with a name and file path, in which case the given name will be used. Specifying a directory will iterate each named file in the directory that is a valid secret key. For this command, the key should always be .dockerconfigjson.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Secret Generic\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a secret based on a file, directory, or specified literal value.\n\n A single secret may package one or more key/value pairs.\n\n When creating a secret based on a file, the key will default to the basename of the file, and the value will default to the file content. If the basename is an invalid key or you wish to chose your own, you may specify an alternate key.\n\n When creating a secret based on a directory, each file whose basename is a valid key in the directory will be packaged into the secret. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).\n\nUsage:\n ksail workload create secret generic NAME [--type=string] [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none]\n\nExamples:\n # Create a new secret named my-secret with keys for each file in folder bar\n kubectl create secret generic my-secret --from-file=path/to/bar\n \n # Create a new secret named my-secret with specified keys instead of names on disk\n kubectl create secret generic my-secret --from-file=ssh-privatekey=path/to/id_rsa --from-file=ssh-publickey=path/to/id_rsa.pub\n \n # Create a new secret named my-secret with key1=supersecret and key2=topsecret\n kubectl create secret generic my-secret --from-literal=key1=supersecret --from-literal=key2=topsecret\n \n # Create a new secret named my-secret using a combination of a file and a literal\n kubectl create secret generic my-secret --from-file=ssh-privatekey=path/to/id_rsa --from-literal=passphrase=topsecret\n \n # Create a new secret named my-secret from env files\n kubectl create secret generic my-secret --from-env-file=path/to/foo.env --from-env-file=path/to/bar.env\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-env-file strings Specify the path to a file to read lines of key=val pairs to create a secret.\n --from-file strings Key files can be specified using their file path, in which case a default name will be given to them, or optionally with a name and file path, in which case the given name will be used. Specifying a directory will iterate each named file in the directory that is a valid secret key.\n --from-literal stringArray Specify a key and literal value to insert in secret (i.e. mykey=somevalue)\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --type string The type of secret to create\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Secret Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a secret with specified type.\n\n A docker-registry type secret is for accessing a container registry.\n\n A generic type secret indicate an Opaque secret type.\n\n A tls type secret holds TLS certificate and its associated key.\n\nUsage:\n ksail workload create secret (docker-registry | generic | tls)\n ksail workload create secret [command]\n\nAvailable Commands:\n docker-registry Create a secret for use with a Docker registry\n generic Create a secret from a local file, directory, or literal value\n tls Create a TLS secret\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload create secret [command] --help\" for more information about a command.\n\n```\n\n### Workload Create Secret Tls\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a TLS secret from the given public/private key pair.\n\n The public/private key pair must exist beforehand. The public key certificate must be .PEM encoded and match the given private key.\n\nUsage:\n ksail workload create secret tls NAME --cert=path/to/cert/file --key=path/to/key/file [--dry-run=server|client|none]\n\nExamples:\n # Create a new TLS secret named tls-secret with the given key pair\n kubectl create secret tls tls-secret --cert=path/to/tls.crt --key=path/to/tls.key\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --cert string Path to PEM encoded public key certificate.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --key string Path to private key associated with given certificate.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Service Clusterip\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a ClusterIP service with the specified name.\n\nUsage:\n ksail workload create service clusterip NAME [--tcp=:] [--dry-run=server|client|none]\n\nExamples:\n # Create a new ClusterIP service named my-cs\n kubectl create service clusterip my-cs --tcp=5678:8080\n \n # Create a new ClusterIP service named my-cs (in headless mode)\n kubectl create service clusterip my-cs --clusterip=\"None\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterip string Assign your own ClusterIP or set to 'None' for a 'headless' service (no loadbalancing).\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Service Externalname\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate an ExternalName service with the specified name.\n\n ExternalName service references to an external DNS address instead of only pods, which will allow application authors to reference services that exist off platform, on other clusters, or locally.\n\nUsage:\n ksail workload create service externalname NAME --external-name external.name [--dry-run=server|client|none]\n\nExamples:\n # Create a new ExternalName service named my-ns\n kubectl create service externalname my-ns --external-name bar.com\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --external-name string External name of service\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Service Loadbalancer\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a LoadBalancer service with the specified name.\n\nUsage:\n ksail workload create service loadbalancer NAME [--tcp=port:targetPort] [--dry-run=server|client|none]\n\nExamples:\n # Create a new LoadBalancer service named my-lbs\n kubectl create service loadbalancer my-lbs --tcp=5678:8080\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Service Nodeport\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a NodePort service with the specified name.\n\nUsage:\n ksail workload create service nodeport NAME [--tcp=port:targetPort] [--dry-run=server|client|none]\n\nExamples:\n # Create a new NodePort service named my-ns\n kubectl create service nodeport my-ns --tcp=5678:8080\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --node-port int Port used to expose the service on each node in a cluster.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Service Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a service using a specified subcommand.\n\nUsage:\n ksail workload create service [flags]\n ksail workload create service [command]\n\nAliases:\n service, svc\n\nAvailable Commands:\n clusterip Create a ClusterIP service\n externalname Create an ExternalName service\n loadbalancer Create a LoadBalancer service\n nodeport Create a NodePort service\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload create service [command] --help\" for more information about a command.\n\n```\n\n### Workload Create Serviceaccount\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a service account with the specified name.\n\nUsage:\n ksail workload create serviceaccount NAME [--dry-run=server|client|none]\n\nAliases:\n serviceaccount, sa\n\nExamples:\n # Create a new service account named my-service-account\n kubectl create serviceaccount my-service-account\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Source Git\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update a GitRepository source using Flux APIs\n\nUsage:\n ksail workload create source git [name] [flags]\n\nExamples:\n # Create a source from a public Git repository master branch\n ksail workload create source git podinfo \\\n --url=https://github.com/stefanprodan/podinfo \\\n --branch=master\n\n # Create a source for a Git repository pinned to specific git tag\n ksail workload create source git podinfo \\\n --url=https://github.com/stefanprodan/podinfo \\\n --tag=\"3.2.3\"\n\n # Create a source from a Git repository using SSH authentication\n ksail workload create source git podinfo \\\n --url=ssh://git@github.com/stefanprodan/podinfo \\\n --branch=master \\\n --secret-ref=git-credentials\n\nFlags:\n --branch string git branch\n --commit string git commit\n --export export in YAML format to stdout\n --interval duration source sync interval (default 1m0s)\n --secret-ref string the name of an existing secret containing SSH or basic credentials\n --tag string git tag\n --tag-semver string git tag semver range\n --url string git address, e.g. ssh://git@host/org/repository\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Source Helm\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update a HelmRepository source using Flux APIs\n\nUsage:\n ksail workload create source helm [name] [flags]\n\nExamples:\n # Create a source from an HTTPS Helm repository\n ksail workload create source helm podinfo \\\n --url=https://stefanprodan.github.io/podinfo\n\n # Create a source for an OCI Helm repository\n ksail workload create source helm podinfo \\\n --url=oci://ghcr.io/stefanprodan/charts/podinfo \\\n --secret-ref=docker-config\n\nFlags:\n --export export in YAML format to stdout\n --interval duration source sync interval (default 1m0s)\n --oci-provider string OCI provider for authentication\n --pass-credentials pass credentials to all domains\n --secret-ref string the name of an existing secret containing credentials\n --url string Helm repository address\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Source Oci\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update an OCIRepository source using Flux APIs\n\nUsage:\n ksail workload create source oci [name] [flags]\n\nExamples:\n # Create a source for an OCI artifact\n ksail workload create source oci podinfo \\\n --url=oci://ghcr.io/stefanprodan/manifests/podinfo \\\n --tag=6.6.2 \\\n --namespace=flux-system\n\n # Create a source with semver range\n ksail workload create source oci podinfo \\\n --url=oci://ghcr.io/stefanprodan/manifests/podinfo \\\n --tag-semver=\">=6.6.0 <7.0.0\"\n\nFlags:\n --digest string OCI artifact digest\n --export export in YAML format to stdout\n --insecure allow insecure connections\n --interval duration source sync interval (default 1m0s)\n --provider string OCI provider (default \"generic\")\n --secret-ref string the name of an existing secret containing credentials\n --tag string OCI artifact tag\n --tag-semver string OCI artifact tag semver range\n --url string OCI repository URL\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Create Source Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate or update Flux sources\n\nUsage:\n ksail workload create source [command]\n\nAvailable Commands:\n git Create or update a GitRepository source\n helm Create or update a HelmRepository source\n oci Create or update an OCIRepository source\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload create source [command] --help\" for more information about a command.\n\n```\n\n### Workload Create Token\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRequest a service account token.\n\nUsage:\n ksail workload create token SERVICE_ACCOUNT_NAME\n\nExamples:\n # Request a token to authenticate to the kube-apiserver as the service account \"myapp\" in the current namespace\n kubectl create token myapp\n \n # Request a token for a service account in a custom namespace\n kubectl create token myapp --namespace myns\n \n # Request a token with a custom expiration\n kubectl create token myapp --duration 10m\n \n # Request a token with a custom audience\n kubectl create token myapp --audience https://example.com\n \n # Request a token bound to an instance of a Secret object\n kubectl create token myapp --bound-object-kind Secret --bound-object-name mysecret\n \n # Request a token bound to an instance of a Secret object with a specific UID\n kubectl create token myapp --bound-object-kind Secret --bound-object-name mysecret --bound-object-uid 0d4691ed-659b-4935-a832-355f77ee47cc\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --audience stringArray Audience of the requested token. If unset, defaults to requesting a token for use with the Kubernetes API server. May be repeated to request a token valid for multiple audiences.\n --bound-object-kind string Kind of an object to bind the token to. Supported kinds are Node, Pod, Secret. If set, --bound-object-name must be provided.\n --bound-object-name string Name of an object to bind the token to. The token will expire when the object is deleted. Requires --bound-object-kind.\n --bound-object-uid string UID of an object to bind the token to. Requires --bound-object-kind and --bound-object-name. If unset, the UID of the existing object is used.\n --duration duration Requested lifetime of the issued token. If not set or if set to 0, the lifetime will be determined by the server automatically. The server may return a token with a longer or shorter lifetime.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Debug\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate debugging sessions for troubleshooting workloads and nodes.\n\nDebug containers allow you to interactively troubleshoot running pods, create copies of pods with modified configuration, or attach a debug container to a node.\n\nUsage:\n ksail workload debug\n\nExamples:\n # Create an interactive debugging session in pod mypod and immediately attach to it.\n ksail workload debug mypod -it --image=busybox\n \n # Create an interactive debugging session for the pod in the file pod.yaml and immediately attach to it.\n # (requires the EphemeralContainers feature to be enabled in the cluster)\n ksail workload debug -f pod.yaml -it --image=busybox\n \n # Create a debug container named debugger using a custom automated debugging image.\n ksail workload debug --image=myproj/debug-tools -c debugger mypod\n \n # Create a copy of mypod adding a debug container and attach to it\n ksail workload debug mypod -it --image=busybox --copy-to=my-debugger\n \n # Create a copy of mypod changing the command of mycontainer\n ksail workload debug mypod -it --copy-to=my-debugger --container=mycontainer -- sh\n \n # Create a copy of mypod changing all container images to busybox\n ksail workload debug mypod --copy-to=my-debugger --set-image=*=busybox\n \n # Create a copy of mypod adding a debug container and changing container images\n ksail workload debug mypod -it --copy-to=my-debugger --image=debian --set-image=app=app:debug,sidecar=sidecar:debug\n \n # Create an interactive debugging session on a node and immediately attach to it.\n # The container will run in the host namespaces and the host's filesystem will be mounted at /host\n ksail workload debug node/mynode -it --image=busybox\n\nFlags:\n --arguments-only If specified, everything after -- will be passed to the new container as Args instead of Command.\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --attach If true, wait for the container to start running, and then attach as if 'kubectl attach ...' were called. Default false, unless '-i/--stdin' is set, in which case the default is true.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n -c, --container string Container name to use for debug container.\n --context string The name of the kubeconfig context to use\n --copy-to string Create a copy of the target Pod with this name.\n --custom string Path to a JSON or YAML file containing a partial container spec to customize built-in debug profiles.\n --disable-compression If true, opt-out of response compression for all requests to the server\n --env stringToString Environment variables to set in the container. (default [])\n -f, --filename strings identifying the resource to debug\n --host string Node name for host-level debugging (bypasses Kubernetes, targets the infrastructure node directly)\n --image string Container image to use for debug container.\n --image-pull-policy string The image pull policy for the container. If left empty, this value will not be specified by the client and defaulted by the server.\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --keep-annotations If true, keep the original pod annotations.(This flag only works when used with '--copy-to')\n --keep-init-containers Run the init containers for the pod. Defaults to true.(This flag only works when used with '--copy-to') (default true)\n --keep-labels If true, keep the original pod labels.(This flag only works when used with '--copy-to')\n --keep-liveness If true, keep the original pod liveness probes.(This flag only works when used with '--copy-to')\n --keep-readiness If true, keep the original pod readiness probes.(This flag only works when used with '--copy-to')\n --keep-startup If true, keep the original startup probes.(This flag only works when used with '--copy-to')\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -n, --namespace string If present, the namespace scope for this CLI request\n --profile string Options are \"general\", \"baseline\", \"restricted\", \"netadmin\" or \"sysadmin\". Defaults to \"general\" (default \"general\")\n -q, --quiet If true, suppress informational messages.\n --replace When used with '--copy-to', delete the original Pod.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n --same-node When used with '--copy-to', schedule the copy of target Pod on the same node.\n -s, --server string The address and port of the Kubernetes API server\n --set-image stringToString When used with '--copy-to', a list of name=image pairs for changing container images, similar to how 'kubectl set image' works. (default [])\n --share-processes When used with '--copy-to', enable process namespace sharing in the copy. (default true)\n -i, --stdin Keep stdin open on the container(s) in the pod, even if nothing is attached.\n --target string When using an ephemeral container, target processes in this container name.\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n -t, --tty Allocate a TTY for the debugging container.\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Delete\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDelete Kubernetes resources by file names, stdin, resources and names, or by resources and label selector.\n\nUsage:\n ksail workload delete\n\nExamples:\n # Delete a pod using the type and name specified in pod.json\n ksail workload delete -f ./pod.json\n \n # Delete resources from a directory containing kustomization.yaml - e.g. dir/kustomization.yaml\n ksail workload delete -k dir\n \n # Delete resources from all files that end with '.json'\n ksail workload delete -f '*.json'\n \n # Delete a pod based on the type and name in the JSON passed into stdin\n cat pod.json | ksail workload delete -f -\n \n # Delete pods and services with same names \"baz\" and \"foo\"\n ksail workload delete pod,service baz foo\n \n # Delete pods and services with label name=myLabel\n ksail workload delete pods,services -l name=myLabel\n \n # Delete a pod with minimal delay\n ksail workload delete pod foo --now\n \n # Force delete a pod on a dead node\n ksail workload delete pod foo --force\n \n # Delete all pods\n ksail workload delete pods --all\n \n # Delete all pods only if the user confirms the deletion\n ksail workload delete pods --all --interactive\n\nFlags:\n --all Delete all resources, in the namespace of the specified resource types.\n -A, --all-namespaces If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --cascade string[=\"background\"] Must be \"background\", \"orphan\", or \"foreground\". Selects the deletion cascading strategy for the dependents (e.g. Pods created by a ReplicationController). Defaults to background. (default \"background\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-selector string Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.\n -f, --filename strings containing the resource to delete.\n --force If true, immediately remove resources from API and bypass graceful deletion. Note that immediate deletion of some resources may result in inconsistency or data loss and requires confirmation.\n --grace-period int Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. Set to 1 for immediate shutdown. Can only be set to 0 when --force is true (force deletion). (default -1)\n --ignore-not-found Treat \"resource not found\" as a successful delete. Defaults to \"true\" when --all is specified.\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n -i, --interactive If true, delete resource only when user confirms.\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process a kustomization directory. This flag can't be used together with -f or -R.\n -n, --namespace string If present, the namespace scope for this CLI request\n --now If true, resources are signaled for immediate shutdown (same as --grace-period=1).\n -o, --output string Output mode. Use \"-o name\" for shorter output (resource/name).\n --raw string Raw URI to DELETE to the server. Uses the transport specified by the kubeconfig file.\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --timeout duration The length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n --wait If true, wait for resources to be gone before returning. This waits for finalizers. (default true)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Describe\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nShow details of a specific resource or group of resources, including metadata, status conditions, events, and container info. Useful for diagnosing why a resource is not ready — check the Events and Conditions sections. For Flux resources (kustomization, helmrelease), shows reconciliation status and last error. For ArgoCD resources (application), shows sync status and health.\n\nUsage:\n ksail workload describe\n\nExamples:\n # Describe a node\n ksail workload describe nodes kubernetes-node-emt8.c.myproject.internal\n \n # Describe a pod\n ksail workload describe pods/nginx\n \n # Describe a pod identified by type and name in \"pod.json\"\n ksail workload describe -f pod.json\n \n # Describe all pods\n ksail workload describe pods\n \n # Describe pods by label name=myLabel\n ksail workload describe pods -l name=myLabel\n \n # Describe all pods managed by the 'frontend' replication controller\n # (rc-created pods get the name of the rc as a prefix in the pod name)\n ksail workload describe pods frontend\n\nFlags:\n -A, --all-namespaces If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --chunk-size int Return large lists in chunks rather than all at once. Pass 0 to disable. (default 500)\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n -f, --filename strings Filename, directory, or URL to files containing the resource to describe\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -n, --namespace string If present, the namespace scope for this CLI request\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --show-events If true, display events related to the described object. Defaults to true for a single object, false for multiple objects and prefix matching. (default true)\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Edit\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nEdit a Kubernetes resource from the default editor.\n\nThe editor is determined by (in order of precedence):\n 1. --editor flag\n 2. spec.editor from ksail.yaml config\n 3. KUBE_EDITOR, EDITOR, or VISUAL environment variables\n 4. Fallback to vim, nano, or vi\n\nExample:\n ksail workload edit deployment/my-deployment\n ksail workload edit --editor \"code --wait\" deployment/my-deployment\n\nUsage:\n ksail workload edit [flags]\n\nFlags:\n --editor string editor command to use (e.g., 'code --wait', 'vim', 'nano')\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Exec\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nExecute a command in a container in a pod.\n\nUsage:\n ksail workload exec\n\nExamples:\n # Get output from running the 'date' command from pod mypod, using the first container by default\n ksail workload exec mypod -- date\n \n # Get output from running the 'date' command in ruby-container from pod mypod\n ksail workload exec mypod -c ruby-container -- date\n \n # Switch to raw terminal mode; sends stdin to 'bash' in ruby-container from pod mypod\n # and sends stdout/stderr from 'bash' back to the client\n ksail workload exec mypod -c ruby-container -i -t -- bash -il\n \n # List contents of /usr from the first container of pod mypod and sort by modification time\n # If the command you want to execute in the pod has any flags in common (e.g. -i),\n # you must use two dashes (--) to separate your command's flags/arguments\n # Also note, do not surround your command and its flags/arguments with quotes\n # unless that is how you would execute it normally (i.e., do ls -t /usr, not \"ls -t /usr\")\n ksail workload exec mypod -i -t -- ls -t /usr\n \n # Get output from running 'date' command from the first pod of the deployment mydeployment, using the first container by default\n ksail workload exec deploy/mydeployment -- date\n \n # Get output from running 'date' command from the first pod of the service myservice, using the first container by default\n ksail workload exec svc/myservice -- date\n\nFlags:\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n -c, --container string Container name. If omitted, use the kubectl.kubernetes.io/default-container annotation for selecting the container to be attached or the first container in the pod will be chosen\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n -f, --filename strings to use to exec into the resource\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -n, --namespace string If present, the namespace scope for this CLI request\n --pod-running-timeout duration The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running (default 1m0s)\n -q, --quiet Only print output from the remote session\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -s, --server string The address and port of the Kubernetes API server\n -i, --stdin Pass stdin to the container\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n -t, --tty Stdin is a TTY\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Explain\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nGet documentation for Kubernetes resources, including field descriptions and structure.\n\nUsage:\n ksail workload explain\n\nExamples:\n # Get the documentation of the resource and its fields\n ksail workload explain pods\n \n # Get all the fields in the resource\n ksail workload explain pods --recursive\n \n # Get the explanation for deployment in supported api versions\n ksail workload explain deployments --api-version=apps/v1\n \n # Get the documentation of a specific field of a resource\n ksail workload explain pods.spec.containers\n \n # Get the documentation of resources in different format\n ksail workload explain deployment --output=plaintext-openapiv2\n\nFlags:\n --api-version string Get different explanations for particular API version (API group/version)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -n, --namespace string If present, the namespace scope for this CLI request\n -o, --output string Format in which to render the schema (plaintext, plaintext-openapiv2) (default \"plaintext\")\n -R, --recursive Print the fields of fields (Currently only 1 level deep)\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -s, --server string The address and port of the Kubernetes API server\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Export\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nExport container images from the cluster's containerd runtime to a tar archive.\n\nThe exported archive can be used to:\n - Share image sets between development machines\n - Pre-load images for offline development\n - Speed up cluster recreation by avoiding registry pulls\n\nExamples:\n # Export all images from cluster to images.tar (default)\n ksail workload export\n\n # Export all images to a specific file\n ksail workload export ./backups/my-images.tar\n\n # Export specific images from cluster\n ksail workload export --image=nginx:latest --image=redis:7\n\n # Export from a specific kubeconfig context\n ksail workload export --context=kind-dev --kubeconfig=~/.kube/config\n\nUsage:\n ksail workload export [] [flags]\n\nFlags:\n -c, --context string Kubernetes context of cluster\n --image stringArray Image(s) to export (repeatable); if not specified, all images are exported\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Expose\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nExpose a resource as a new Kubernetes service.\n\nUsage:\n ksail workload expose\n\nExamples:\n # Create a service for a replicated nginx, which serves on port 80 and connects to the containers on port 8000\n ksail workload expose rc nginx --port=80 --target-port=8000\n \n # Create a service for a replication controller identified by type and name specified in \"nginx-controller.yaml\", which serves on port 80 and connects to the containers on port 8000\n ksail workload expose -f nginx-controller.yaml --port=80 --target-port=8000\n \n # Create a service for a pod valid-pod, which serves on port 444 with the name \"frontend\"\n ksail workload expose pod valid-pod --port=444 --name=frontend\n \n # Create a second service based on the above service, exposing the container port 8443 as port 443 with the name \"nginx-https\"\n ksail workload expose service nginx --port=443 --target-port=8443 --name=nginx-https\n \n # Create a service for a replicated streaming application on port 4100 balancing UDP traffic and named 'video-stream'.\n ksail workload expose rc streamer --port=4100 --protocol=UDP --name=video-stream\n \n # Create a service for a replicated nginx using replica set, which serves on port 80 and connects to the containers on port 8000\n ksail workload expose rs nginx --port=80 --target-port=8000\n \n # Create a service for an nginx deployment, which serves on port 80 and connects to the containers on port 8000\n ksail workload expose deployment nginx --port=80 --target-port=8000\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --cluster-ip string ClusterIP to be assigned to the service. Leave empty to auto-allocate, or set to 'None' to create a headless service.\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --external-ip string Additional external IP address (not managed by Kubernetes) to accept for the service. If this IP is routed to a node, the service can be accessed by this IP in addition to its generated service IP.\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-expose\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to expose a service\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -l, --labels string Labels to apply to the service created by this call.\n --load-balancer-ip string IP to assign to the LoadBalancer. If empty, an ephemeral IP will be created and used (cloud-provider specific).\n --name string The name for the newly created object.\n -n, --namespace string If present, the namespace scope for this CLI request\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --override-type string The method used to override the generated object: json, merge, or strategic. (default \"merge\")\n --overrides string An inline JSON override for the generated object. If this is non-empty, it is used to override the generated object. Requires that the object supply a valid apiVersion field.\n --port string The port that the service should serve on. Copied from the resource being exposed, if unspecified\n --protocol string The network protocol for the service to be created. Default is 'TCP'.\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --selector string A label selector to use for this service. Only equality-based selector requirements are supported. If empty (the default) infer the selector from the resource being exposed.\n -s, --server string The address and port of the Kubernetes API server\n --session-affinity string If non-empty, set the session affinity for the service to this; legal values: 'None', 'ClientIP'\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --target-port string Name or number for the port on the container that the service should direct traffic to. Optional.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --type string Type for this service: ClusterIP, NodePort, LoadBalancer, or ExternalName. Default is 'ClusterIP'.\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Forward\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nForward one or more local ports to a pod.\n\nUse resource type/name such as deployment/mydeployment to select a pod. Resource type defaults to 'pod' if omitted.\n\nIf there are multiple pods matching the criteria, a pod will be selected automatically. The forwarding session ends when the selected pod terminates, and a rerun of the command is needed to resume forwarding.\n\nUsage:\n ksail workload forward\n\nExamples:\n # Listen on ports 5000 and 6000 locally, forwarding data to/from ports 5000 and 6000 in the pod\n ksail workload forward pod/mypod 5000 6000\n \n # Listen on ports 5000 and 6000 locally, forwarding data to/from ports 5000 and 6000 in a pod selected by the deployment\n ksail workload forward deployment/mydeployment 5000 6000\n \n # Listen on port 8443 locally, forwarding to the targetPort of the service's port named \"https\" in a pod selected by the service\n ksail workload forward service/myservice 8443:https\n \n # Listen on port 8888 locally, forwarding to 5000 in the pod\n ksail workload forward pod/mypod 8888:5000\n \n # Listen on port 8888 on all addresses, forwarding to 5000 in the pod\n ksail workload forward --address 0.0.0.0 pod/mypod 8888:5000\n \n # Listen on port 8888 on localhost and selected IP, forwarding to 5000 in the pod\n ksail workload forward --address localhost,10.19.21.23 pod/mypod 8888:5000\n \n # Listen on a random port locally, forwarding to 5000 in the pod\n ksail workload forward pod/mypod :5000\n\nFlags:\n --address strings Addresses to listen on (comma separated). Only accepts IP addresses or localhost as a value. When localhost is supplied, kubectl will try to bind on both 127.0.0.1 and ::1 and will fail if neither of these addresses are available to bind. (default [localhost])\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -n, --namespace string If present, the namespace scope for this CLI request\n --pod-running-timeout duration The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running (default 1m0s)\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -s, --server string The address and port of the Kubernetes API server\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Clusterrole\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cluster role.\n\nUsage:\n ksail workload gen clusterrole NAME --verb=verb --resource=resource.group [--resource-name=resourcename] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a cluster role named \"pod-reader\" that allows user to perform \"get\", \"watch\" and \"list\" on pods\n kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods\n \n # Create a cluster role named \"pod-reader\" with ResourceName specified\n kubectl create clusterrole pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod\n \n # Create a cluster role named \"foo\" with API Group specified\n kubectl create clusterrole foo --verb=get,list,watch --resource=rs.apps\n \n # Create a cluster role named \"foo\" with SubResource specified\n kubectl create clusterrole foo --verb=get,list,watch --resource=pods,pods/status\n \n # Create a cluster role name \"foo\" with NonResourceURL specified\n kubectl create clusterrole \"foo\" --verb=get --non-resource-url=/logs/*\n \n # Create a cluster role name \"monitoring\" with AggregationRule specified\n kubectl create clusterrole monitoring --aggregation-rule=\"rbac.example.com/aggregate-to-monitoring=true\"\n\nFlags:\n --aggregation-rule mapStringString An aggregation label selector for combining ClusterRoles.\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --non-resource-url strings A partial url that user should have access to.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --resource strings Resource that the rule applies to\n --resource-name stringArray Resource in the white list that the rule applies to, repeat this flag for multiple items\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --verb strings Verb that applies to the resources contained in the rule\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Clusterrolebinding\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cluster role binding for a particular cluster role.\n\nUsage:\n ksail workload gen clusterrolebinding NAME --clusterrole=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a cluster role binding for user1, user2, and group1 using the cluster-admin cluster role\n kubectl create clusterrolebinding cluster-admin --clusterrole=cluster-admin --user=user1 --user=user2 --group=group1\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterrole string ClusterRole this ClusterRoleBinding should reference\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --group stringArray Groups to bind to the clusterrole. The flag can be repeated to add multiple groups.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --serviceaccount stringArray Service accounts to bind to the clusterrole, in the format :. The flag can be repeated to add multiple service accounts.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --user stringArray Usernames to bind to the clusterrole. The flag can be repeated to add multiple users.\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Configmap\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a config map based on a file, directory, or specified literal value.\n\n A single config map may package one or more key/value pairs.\n\n When creating a config map based on a file, the key will default to the basename of the file, and the value will default to the file content. If the basename is an invalid key, you may specify an alternate key.\n\n When creating a config map based on a directory, each file whose basename is a valid key in the directory will be packaged into the config map. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).\n\nUsage:\n ksail workload gen configmap NAME [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none] [flags]\n\nAliases:\n configmap, cm\n\nExamples:\n # Create a new config map named my-config based on folder bar\n kubectl create configmap my-config --from-file=path/to/bar\n \n # Create a new config map named my-config with specified keys instead of file basenames on disk\n kubectl create configmap my-config --from-file=key1=/path/to/bar/file1.txt --from-file=key2=/path/to/bar/file2.txt\n \n # Create a new config map named my-config with key1=config1 and key2=config2\n kubectl create configmap my-config --from-literal=key1=config1 --from-literal=key2=config2\n \n # Create a new config map named my-config with key=value pairs from an env file\n kubectl create configmap my-config --from-env-file=path/to/bar.env\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the configmap to its name.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-env-file strings Specify the path to a file to read lines of key=val pairs to create a configmap.\n --from-file strings Key file can be specified using its file path, in which case file basename will be used as configmap key, or optionally with a key and file path, in which case the given key will be used. Specifying a directory will iterate each named file in the directory whose basename is a valid configmap key.\n --from-literal stringArray Specify a key and literal value to insert in configmap (i.e. mykey=somevalue)\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Cronjob\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a cron job with the specified name.\n\nUsage:\n ksail workload gen cronjob NAME --image=image --schedule='0/5 * * * ?' -- [COMMAND] [args...] [flags]\n\nAliases:\n cronjob, cj\n\nExamples:\n # Create a cron job\n kubectl create cronjob my-job --image=busybox --schedule=\"*/1 * * * *\"\n \n # Create a cron job with a command\n kubectl create cronjob my-job --image=busybox --schedule=\"*/1 * * * *\" -- date\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --image string Image name to run.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --restart string job's restart policy. supported values: OnFailure, Never\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --schedule string A schedule in the Cron format the job should be run with.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Deployment\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a deployment with the specified name.\n\nUsage:\n ksail workload gen deployment NAME --image=image -- [COMMAND] [args...] [flags]\n\nAliases:\n deployment, deploy\n\nExamples:\n # Create a deployment named my-dep that runs the busybox image\n kubectl create deployment my-dep --image=busybox\n \n # Create a deployment with a command\n kubectl create deployment my-dep --image=busybox -- date\n \n # Create a deployment named my-dep that runs the nginx image with 3 replicas\n kubectl create deployment my-dep --image=nginx --replicas=3\n \n # Create a deployment named my-dep that runs the busybox image and expose port 5701\n kubectl create deployment my-dep --image=busybox --port=5701\n \n # Create a deployment named my-dep that runs multiple containers\n kubectl create deployment my-dep --image=busybox:latest --image=ubuntu:latest --image=nginx\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --image strings Image names to run. A deployment can have multiple images set for multi-container pod.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --port int32 The containerPort that this deployment exposes. (default -1)\n -r, --replicas int32 Number of replicas to create. Default is 1. (default 1)\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Helmrelease\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nGenerate a HelmRelease resource for a given HelmRepository, GitRepository, Bucket, or chart reference source.\n\nUsage:\n ksail workload gen helmrelease [NAME] [flags]\n\nAliases:\n helmrelease, hr\n\nExamples:\n # Generate a HelmRelease with a chart from a HelmRepository source\n ksail workload gen helmrelease podinfo \\\n --interval=10m \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --chart-version=\">4.0.0\" \\\n --export\n\n # Generate a HelmRelease with a chart from a GitRepository source\n ksail workload gen helmrelease podinfo \\\n --interval=10m \\\n --source=GitRepository/podinfo \\\n --chart=./charts/podinfo \\\n --export\n\n # Generate a HelmRelease with values from local YAML files\n ksail workload gen helmrelease podinfo \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --values=./my-values1.yaml \\\n --values=./my-values2.yaml \\\n --export\n\n # Generate a HelmRelease with values from a Kubernetes secret\n ksail workload gen helmrelease podinfo \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --values-from=Secret/my-secret-values \\\n --export\n\n # Generate a HelmRelease with a custom release name\n ksail workload gen helmrelease podinfo \\\n --release-name=podinfo-dev \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --export\n\n # Generate a HelmRelease targeting another namespace\n ksail workload gen helmrelease podinfo \\\n --target-namespace=test \\\n --create-target-namespace=true \\\n --source=HelmRepository/podinfo \\\n --chart=podinfo \\\n --export\n\n # Generate a HelmRelease using a chart reference\n ksail workload gen helmrelease podinfo \\\n --namespace=default \\\n --chart-ref=HelmChart/podinfo.flux-system \\\n --export\n\nFlags:\n --chart string Helm chart name or path\n --chart-ref string Helm chart reference (HelmChart/name, OCIRepository/name)\n --chart-version string Helm chart version, accepts a semver range\n --crds string CRDs policy (Create, CreateReplace, Skip)\n --create-target-namespace create the target namespace if not present\n --depends-on strings HelmReleases that must be ready before this release\n --export export in YAML format to stdout\n --interval duration reconciliation interval (default 1m0s)\n --kubeconfig-secret-ref string KubeConfig secret reference for remote reconciliation\n -n, --namespace string namespace scope for the HelmRelease (default \"default\")\n --release-name string name used for the Helm release\n --service-account string service account name to impersonate\n --source string source that contains the chart (HelmRepository/name, GitRepository/name, Bucket/name)\n --storage-namespace string namespace for Helm storage\n --target-namespace string namespace to target when performing operations\n --timeout duration timeout for any individual Kubernetes operation (default 5m0s)\n --values strings local values YAML files\n --values-from strings values from ConfigMap or Secret\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Ingress\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate an ingress with the specified name.\n\nUsage:\n ksail workload gen ingress NAME --rule=host/path=service:port[,tls[=secret]] [flags]\n\nAliases:\n ingress, ing\n\nExamples:\n # Create a single ingress called 'simple' that directs requests to foo.com/bar to svc\n # svc1:8080 with a TLS secret \"my-cert\"\n kubectl create ingress simple --rule=\"foo.com/bar=svc1:8080,tls=my-cert\"\n \n # Create a catch all ingress of \"/path\" pointing to service svc:port and Ingress Class as \"otheringress\"\n kubectl create ingress catch-all --class=otheringress --rule=\"/path=svc:port\"\n \n # Create an ingress with two annotations: ingress.annotation1 and ingress.annotations2\n kubectl create ingress annotated --class=default --rule=\"foo.com/bar=svc:port\" \\\n --annotation ingress.annotation1=foo \\\n --annotation ingress.annotation2=bla\n \n # Create an ingress with the same host and multiple paths\n kubectl create ingress multipath --class=default \\\n --rule=\"foo.com/=svc:port\" \\\n --rule=\"foo.com/admin/=svcadmin:portadmin\"\n \n # Create an ingress with multiple hosts and the pathType as Prefix\n kubectl create ingress ingress1 --class=default \\\n --rule=\"foo.com/path*=svc:8080\" \\\n --rule=\"bar.com/admin*=svc2:http\"\n \n # Create an ingress with TLS enabled using the default ingress certificate and different path types\n kubectl create ingress ingtls --class=default \\\n --rule=\"foo.com/=svc:https,tls\" \\\n --rule=\"foo.com/path/subpath*=othersvc:8080\"\n \n # Create an ingress with TLS enabled using a specific secret and pathType as Prefix\n kubectl create ingress ingsecret --class=default \\\n --rule=\"foo.com/*=svc:8080,tls=secret1\"\n \n # Create an ingress with a default backend\n kubectl create ingress ingdefault --class=default \\\n --default-backend=defaultsvc:http \\\n --rule=\"foo.com/*=svc:8080,tls=secret1\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --annotation stringArray Annotation to insert in the ingress object, in the format annotation=value\n --class string Ingress Class to be used\n --default-backend string Default service for backend, in format of svcname:port\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --rule stringArray Rule in format host/path=service:port[,tls=secretname]. Paths containing the leading character '*' are considered pathType=Prefix. tls argument is optional.\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Job\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a job with the specified name.\n\nUsage:\n ksail workload gen job NAME --image=image [--from=cronjob/name] -- [COMMAND] [args...] [flags]\n\nExamples:\n # Create a job\n kubectl create job my-job --image=busybox\n \n # Create a job with a command\n kubectl create job my-job --image=busybox -- date\n \n # Create a job from a cron job named \"a-cronjob\"\n kubectl create job test-job --from=cronjob/a-cronjob\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from string The name of the resource to create a Job from (only CronJob is supported).\n --image string Image name to run.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Namespace\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a namespace with the specified name.\n\nUsage:\n ksail workload gen namespace NAME [--dry-run=server|client|none] [flags]\n\nAliases:\n namespace, ns\n\nExamples:\n # Create a new namespace named my-namespace\n kubectl create namespace my-namespace\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Poddisruptionbudget\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a pod disruption budget with the specified name, selector, and desired minimum available pods.\n\nUsage:\n ksail workload gen poddisruptionbudget NAME --selector=SELECTOR --min-available=N [--dry-run=server|client|none] [flags]\n\nAliases:\n poddisruptionbudget, pdb\n\nExamples:\n # Create a pod disruption budget named my-pdb that will select all pods with the app=rails label\n # and require at least one of them being available at any point in time\n kubectl create poddisruptionbudget my-pdb --selector=app=rails --min-available=1\n \n # Create a pod disruption budget named my-pdb that will select all pods with the app=nginx label\n # and require at least half of the pods selected to be available at any point in time\n kubectl create pdb my-pdb --selector=app=nginx --min-available=50%\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --max-unavailable string The maximum number or percentage of unavailable pods this budget requires.\n --min-available string The minimum number or percentage of available pods this budget requires.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --selector string A label selector to use for this budget. Only equality-based selector requirements are supported.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Priorityclass\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a priority class with the specified name, value, globalDefault and description.\n\nUsage:\n ksail workload gen priorityclass NAME --value=VALUE --global-default=BOOL [--dry-run=server|client|none] [flags]\n\nAliases:\n priorityclass, pc\n\nExamples:\n # Create a priority class named high-priority\n kubectl create priorityclass high-priority --value=1000 --description=\"high priority\"\n \n # Create a priority class named default-priority that is considered as the global default priority\n kubectl create priorityclass default-priority --value=1000 --global-default=true --description=\"default priority\"\n \n # Create a priority class named high-priority that cannot preempt pods with lower priority\n kubectl create priorityclass high-priority --value=1000 --description=\"high priority\" --preemption-policy=\"Never\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --description string description is an arbitrary string that usually provides guidelines on when this priority class should be used.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --global-default global-default specifies whether this PriorityClass should be considered as the default priority.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --preemption-policy string preemption-policy is the policy for preempting pods with lower priority. (default \"PreemptLowerPriority\")\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --value int32 the value of this priority class.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Quota\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a resource quota with the specified name, hard limits, and optional scopes.\n\nUsage:\n ksail workload gen quota NAME [--hard=key1=value1,key2=value2] [--scopes=Scope1,Scope2] [--dry-run=server|client|none] [flags]\n\nAliases:\n quota, resourcequota\n\nExamples:\n # Create a new resource quota named my-quota\n kubectl create quota my-quota --hard=cpu=1,memory=1G,pods=2,services=3,replicationcontrollers=2,resourcequotas=1,secrets=5,persistentvolumeclaims=10\n \n # Create a new resource quota named best-effort\n kubectl create quota best-effort --hard=pods=100 --scopes=BestEffort\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --hard string A comma-delimited set of resource=quantity pairs that define a hard limit.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --scopes string A comma-delimited set of quota scopes that must all match each object tracked by the quota.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Role\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a role with single rule.\n\nUsage:\n ksail workload gen role NAME --verb=verb --resource=resource.group/subresource [--resource-name=resourcename] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a role named \"pod-reader\" that allows user to perform \"get\", \"watch\" and \"list\" on pods\n kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods\n \n # Create a role named \"pod-reader\" with ResourceName specified\n kubectl create role pod-reader --verb=get --resource=pods --resource-name=readablepod --resource-name=anotherpod\n \n # Create a role named \"foo\" with API Group specified\n kubectl create role foo --verb=get,list,watch --resource=rs.apps\n \n # Create a role named \"foo\" with SubResource specified\n kubectl create role foo --verb=get,list,watch --resource=pods,pods/status\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --resource strings Resource that the rule applies to\n --resource-name stringArray Resource in the white list that the rule applies to, repeat this flag for multiple items\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n --verb strings Verb that applies to the resources contained in the rule\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Rolebinding\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a role binding for a particular role or cluster role.\n\nUsage:\n ksail workload gen rolebinding NAME --clusterrole=NAME|--role=NAME [--user=username] [--group=groupname] [--serviceaccount=namespace:serviceaccountname] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a role binding for user1, user2, and group1 using the admin cluster role\n kubectl create rolebinding admin --clusterrole=admin --user=user1 --user=user2 --group=group1\n \n # Create a role binding for service account monitoring:sa-dev using the admin role\n kubectl create rolebinding admin-binding --role=admin --serviceaccount=monitoring:sa-dev\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterrole string ClusterRole this RoleBinding should reference\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --group stringArray Groups to bind to the role. The flag can be repeated to add multiple groups.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --role string Role this RoleBinding should reference\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --serviceaccount stringArray Service accounts to bind to the role, in the format :. The flag can be repeated to add multiple service accounts.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --user stringArray Usernames to bind to the role. The flag can be repeated to add multiple users.\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nGenerate Kubernetes resource manifests using kubectl create with --dry-run=client -o yaml. The generated YAML is printed to stdout and can be redirected to a file using shell redirection (> file.yaml).\n\nUsage:\n ksail workload gen [flags]\n ksail workload gen [command]\n\nAvailable Commands:\n clusterrole Create a cluster role\n clusterrolebinding Create a cluster role binding for a particular cluster role\n configmap Create a config map from a local file, directory or literal value\n cronjob Create a cron job with the specified name\n deployment Create a deployment with the specified name\n helmrelease Generate a HelmRelease resource\n ingress Create an ingress with the specified name\n job Create a job with the specified name\n namespace Create a namespace with the specified name\n poddisruptionbudget Create a pod disruption budget with the specified name\n priorityclass Create a priority class with the specified name\n quota Create a quota with the specified name\n role Create a role with single rule\n rolebinding Create a role binding for a particular role or cluster role\n secret Create a secret using a specified subcommand\n service Create a service using a specified subcommand\n serviceaccount Create a service account with the specified name\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload gen [command] --help\" for more information about a command.\n\n```\n\n### Workload Gen Secret Docker Registry\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a new secret for use with Docker registries.\n \n Dockercfg secrets are used to authenticate against Docker registries.\n \n When using the Docker command line to push images, you can authenticate to a given registry by running:\n '$ docker login DOCKER_REGISTRY_SERVER --username=DOCKER_USER --password=DOCKER_PASSWORD --email=DOCKER_EMAIL'.\n \n That produces a ~/.dockercfg file that is used by subsequent 'docker push' and 'docker pull' commands to authenticate to the registry. The email address is optional.\n\n When creating applications, you may have a Docker registry that requires authentication. In order for the\n nodes to pull images on your behalf, they must have the credentials. You can provide this information\n by creating a dockercfg secret and attaching it to your service account.\n\nUsage:\n ksail workload gen secret docker-registry NAME --docker-username=user --docker-password=password --docker-email=email [--docker-server=string] [--from-file=[key=]source] [--dry-run=server|client|none] [flags]\n\nExamples:\n # If you do not already have a .dockercfg file, create a dockercfg secret directly\n kubectl create secret docker-registry my-secret --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER --docker-password=DOCKER_PASSWORD --docker-email=DOCKER_EMAIL\n \n # Create a new secret named my-secret from ~/.docker/config.json\n kubectl create secret docker-registry my-secret --from-file=path/to/.docker/config.json\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --docker-email string Email for Docker registry\n --docker-password string Password for Docker registry authentication\n --docker-server string Server location for Docker registry (default \"https://index.docker.io/v1/\")\n --docker-username string Username for Docker registry authentication\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-file strings Key files can be specified using their file path, in which case a default name of .dockerconfigjson will be given to them, or optionally with a name and file path, in which case the given name will be used. Specifying a directory will iterate each named file in the directory that is a valid secret key. For this command, the key should always be .dockerconfigjson.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Secret Generic\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a secret based on a file, directory, or specified literal value.\n\n A single secret may package one or more key/value pairs.\n\n When creating a secret based on a file, the key will default to the basename of the file, and the value will default to the file content. If the basename is an invalid key or you wish to chose your own, you may specify an alternate key.\n\n When creating a secret based on a directory, each file whose basename is a valid key in the directory will be packaged into the secret. Any directory entries except regular files are ignored (e.g. subdirectories, symlinks, devices, pipes, etc).\n\nUsage:\n ksail workload gen secret generic NAME [--type=string] [--from-file=[key=]source] [--from-literal=key1=value1] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new secret named my-secret with keys for each file in folder bar\n kubectl create secret generic my-secret --from-file=path/to/bar\n \n # Create a new secret named my-secret with specified keys instead of names on disk\n kubectl create secret generic my-secret --from-file=ssh-privatekey=path/to/id_rsa --from-file=ssh-publickey=path/to/id_rsa.pub\n \n # Create a new secret named my-secret with key1=supersecret and key2=topsecret\n kubectl create secret generic my-secret --from-literal=key1=supersecret --from-literal=key2=topsecret\n \n # Create a new secret named my-secret using a combination of a file and a literal\n kubectl create secret generic my-secret --from-file=ssh-privatekey=path/to/id_rsa --from-literal=passphrase=topsecret\n \n # Create a new secret named my-secret from env files\n kubectl create secret generic my-secret --from-env-file=path/to/foo.env --from-env-file=path/to/bar.env\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --from-env-file strings Specify the path to a file to read lines of key=val pairs to create a secret.\n --from-file strings Key files can be specified using their file path, in which case a default name will be given to them, or optionally with a name and file path, in which case the given name will be used. Specifying a directory will iterate each named file in the directory that is a valid secret key.\n --from-literal stringArray Specify a key and literal value to insert in secret (i.e. mykey=somevalue)\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --type string The type of secret to create\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Secret Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a secret with specified type.\n\n A docker-registry type secret is for accessing a container registry.\n\n A generic type secret indicate an Opaque secret type.\n\n A tls type secret holds TLS certificate and its associated key.\n\nUsage:\n ksail workload gen secret [command]\n\nAvailable Commands:\n docker-registry Create a secret for use with a Docker registry\n generic Create a secret from a local file, directory, or literal value\n tls Create a TLS secret\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload gen secret [command] --help\" for more information about a command.\n\n```\n\n### Workload Gen Secret Tls\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a TLS secret from the given public/private key pair.\n\n The public/private key pair must exist beforehand. The public key certificate must be .PEM encoded and match the given private key.\n\nUsage:\n ksail workload gen secret tls NAME --cert=path/to/cert/file --key=path/to/key/file [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new TLS secret named tls-secret with the given key pair\n kubectl create secret tls tls-secret --cert=path/to/tls.crt --key=path/to/tls.key\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --append-hash Append a hash of the secret to its name.\n --cert string Path to PEM encoded public key certificate.\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --key string Path to private key associated with given certificate.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Service Clusterip\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a ClusterIP service with the specified name.\n\nUsage:\n ksail workload gen service clusterip NAME [--tcp=:] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new ClusterIP service named my-cs\n kubectl create service clusterip my-cs --tcp=5678:8080\n \n # Create a new ClusterIP service named my-cs (in headless mode)\n kubectl create service clusterip my-cs --clusterip=\"None\"\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --clusterip string Assign your own ClusterIP or set to 'None' for a 'headless' service (no loadbalancing).\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Service Externalname\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate an ExternalName service with the specified name.\n\n ExternalName service references to an external DNS address instead of only pods, which will allow application authors to reference services that exist off platform, on other clusters, or locally.\n\nUsage:\n ksail workload gen service externalname NAME --external-name external.name [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new ExternalName service named my-ns\n kubectl create service externalname my-ns --external-name bar.com\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --external-name string External name of service\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Service Loadbalancer\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a LoadBalancer service with the specified name.\n\nUsage:\n ksail workload gen service loadbalancer NAME [--tcp=port:targetPort] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new LoadBalancer service named my-lbs\n kubectl create service loadbalancer my-lbs --tcp=5678:8080\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Service Nodeport\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a NodePort service with the specified name.\n\nUsage:\n ksail workload gen service nodeport NAME [--tcp=port:targetPort] [--dry-run=server|client|none] [flags]\n\nExamples:\n # Create a new NodePort service named my-ns\n kubectl create service nodeport my-ns --tcp=5678:8080\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n --node-port int Port used to expose the service on each node in a cluster.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --tcp strings Port pairs can be specified as ':'.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Gen Service Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a service using a specified subcommand.\n\nUsage:\n ksail workload gen service [command]\n\nAliases:\n service, svc\n\nAvailable Commands:\n clusterip Create a ClusterIP service\n externalname Create an ExternalName service\n loadbalancer Create a LoadBalancer service\n nodeport Create a NodePort service\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload gen service [command] --help\" for more information about a command.\n\n```\n\n### Workload Gen Serviceaccount\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nCreate a service account with the specified name.\n\nUsage:\n ksail workload gen serviceaccount NAME [--dry-run=server|client|none] [flags]\n\nAliases:\n serviceaccount, sa\n\nExamples:\n # Create a new service account named my-service-account\n kubectl create serviceaccount my-service-account\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-create\")\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n --save-config If true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --validate string[=\"strict\"] Must be one of: strict (or true), warn, ignore (or false). \"true\" or \"strict\" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. \"warn\" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as \"ignore\" otherwise. \"false\" or \"ignore\" will not perform any schema validation, silently dropping any unknown or duplicate fields. (default \"strict\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Get\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nDisplay one or many Kubernetes resources from your cluster. Use -o json for structured output that includes status conditions and health. Use -o wide for additional columns. Use --all-namespaces or -A to query across all namespaces. Supports comma-separated resource types (e.g. deployments,services). For GitOps diagnostics, query Flux resources (kustomization, helmrelease, gitrepository, ocirepository) or ArgoCD resources (application) to check reconciliation status and errors.\n\nUsage:\n ksail workload get\n\nExamples:\n # List all pods in ps output format\n ksail workload get pods\n \n # List all pods in ps output format with more information (such as node name)\n ksail workload get pods -o wide\n \n # List a single replication controller with specified NAME in ps output format\n ksail workload get replicationcontroller web\n \n # List deployments in JSON output format, in the \"v1\" version of the \"apps\" API group\n ksail workload get deployments.v1.apps -o json\n \n # List a single pod in JSON output format\n ksail workload get -o json pod web-pod-13je7\n \n # List a pod identified by type and name specified in \"pod.yaml\" in JSON output format\n ksail workload get -f pod.yaml -o json\n \n # List resources from a directory with kustomization.yaml - e.g. dir/kustomization.yaml\n ksail workload get -k dir/\n \n # Return only the phase value of the specified pod\n ksail workload get -o template pod/web-pod-13je7 --template={{.status.phase}}\n \n # List resource information in custom columns\n ksail workload get pod test-pod -o custom-columns=CONTAINER:.spec.containers[0].name,IMAGE:.spec.containers[0].image\n \n # List all replication controllers and services together in ps output format\n ksail workload get rc,services\n \n # List one or more resources by their type and names\n ksail workload get rc/web service/frontend pods/web-pod-13je7\n \n # List the 'status' subresource for a single pod\n ksail workload get pod web-pod-13je7 --subresource status\n \n # List all deployments in namespace 'backend'\n ksail workload get deployments.apps --namespace backend\n \n # List all pods existing in all namespaces\n ksail workload get pods --all-namespaces\n\nFlags:\n -A, --all-namespaces If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --chunk-size int Return large lists in chunks rather than all at once. Pass 0 to disable. (default 500)\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --field-selector string Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n --ignore-not-found If set to true, suppresses NotFound error for specific objects that do not exist. Using this flag with commands that query for collections of resources has no effect when no resources are found.\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -L, --label-columns strings Accepts a comma separated list of labels that are going to be presented as columns. Names are case-sensitive. You can also use multiple flag options like -L label1 -L label2...\n -n, --namespace string If present, the namespace scope for this CLI request\n --no-headers When using the default or custom-column output format, don't print headers (default print headers).\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file, custom-columns, custom-columns-file, wide). See custom columns [https://kubernetes.io/docs/reference/kubectl/#custom-columns], golang template [http://golang.org/pkg/text/template/#pkg-overview] and jsonpath template [https://kubernetes.io/docs/reference/kubectl/jsonpath/].\n --output-watch-events Output watch event objects when --watch or --watch-only is used. Existing objects are output as initial ADDED events.\n --raw string Raw URI to request from the server. Uses the transport specified by the kubeconfig file.\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --server-print If true, have the server return the appropriate table output. Supports extension APIs and CRDs. (default true)\n --show-kind If present, list the resource type for the requested object(s).\n --show-labels When printing, show all labels as the last column (default hide labels column)\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --sort-by string If non-empty, sort list types using this field specification. The field specification is expressed as a JSONPath expression (e.g. '{.metadata.name}'). The field in the API resource specified by this JSONPath expression must be an integer or a string.\n --subresource string If specified, gets the subresource of the requested object.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n -w, --watch After listing/getting the requested object, watch for changes.\n --watch-only Watch for changes to the requested object(s), without listing/getting first.\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Images\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nList container images required by the configured cluster components.\n\nThe image list is derived from the ksail.yaml configuration and includes\nimages for all enabled components (GitOps engine, CNI, policy engine, etc.).\n\nThis command is useful for:\n - Pre-pulling images before cluster creation\n - Creating offline image archives\n - Understanding infrastructure image requirements\n - CI/CD caching strategies\n\nOutput formats:\n - plain: One image per line (default, suitable for scripting)\n - json: JSON array of image strings\n\nExamples:\n # List all images for current ksail.yaml config\n ksail workload images\n\n # List images as JSON array\n ksail workload images --output=json\n\n # Pipe to docker pull\n ksail workload images | xargs -n1 docker pull\n\n # Save to file for CI caching\n ksail workload images > required-images.txt\n\nUsage:\n ksail workload images [flags]\n\nFlags:\n --cert-manager CertManager Cert-Manager configuration (Enabled: install, Disabled: skip)\n --cni CNI Container Network Interface (CNI) to use\n --csi CSI Container Storage Interface (Default: use distribution, Enabled: install CSI, Disabled: skip CSI)\n -d, --distribution Distribution Kubernetes distribution to use\n -g, --gitops-engine GitOpsEngine GitOps engine to use (None disables GitOps, Flux installs Flux controllers, ArgoCD installs Argo CD) (default None)\n --load-balancer LoadBalancer LoadBalancer support (Default: use distribution × provider, Enabled: install, Disabled: uninstall)\n --metrics-server MetricsServer Metrics Server (Default: use distribution, Enabled: install, Disabled: uninstall)\n -o, --output string Output format: plain, json (default \"plain\")\n --policy-engine PolicyEngine Policy engine (None: skip, Kyverno: install Kyverno, Gatekeeper: install Gatekeeper)\n --provider Provider Infrastructure provider backend (e.g., Docker)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Import\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nImport container images from a tar archive to the cluster's containerd runtime.\n\nImages are imported to all nodes in the cluster, making them available for\npod scheduling without requiring registry pulls.\n\nExamples:\n # Import images from images.tar (default)\n ksail workload import\n\n # Import images from a specific file\n ksail workload import ./backups/my-images.tar\n\n # Import to a specific kubeconfig context\n ksail workload import --context=kind-dev --kubeconfig=~/.kube/config\n\nUsage:\n ksail workload import [] [flags]\n\nFlags:\n -c, --context string Kubernetes context of cluster\n -k, --kubeconfig string Path to kubeconfig file (default \"~/.kube/config\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Install\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nInstall Helm charts to provision workloads through KSail. This command provides native Helm chart installation capabilities.\n\nUsage:\n ksail workload install [NAME] [CHART] [flags]\n\nFlags:\n --atomic if set, the installation deletes on failure\n --create-namespace create the release namespace if not present\n -n, --namespace string namespace scope for the request (default \"default\")\n --timeout duration time to wait for any individual Kubernetes operation (default 5m0s)\n --version string chart version constraint (default: latest)\n --wait wait until resources are ready\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Logs\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nPrint the logs for a container in a pod or specified resource. If the pod has only one container, the container name is optional. Use --tail=N to limit output to the last N lines. Use --previous to get logs from a previous container instance (useful for crash-loop diagnostics). Use --all-containers to get logs from all containers in a pod. For GitOps controller logs, query the controller pods directly (e.g. in flux-system or argocd namespace).\n\nUsage:\n ksail workload logs\n\nExamples:\n # Return snapshot logs from pod nginx with only one container\n ksail workload logs nginx\n \n # Return snapshot logs from pod nginx, prefixing each line with the source pod and container name\n ksail workload logs nginx --prefix\n \n # Return snapshot logs from pod nginx, limiting output to 500 bytes\n ksail workload logs nginx --limit-bytes=500\n \n # Return snapshot logs from pod nginx, waiting up to 20 seconds for it to start running.\n ksail workload logs nginx --pod-running-timeout=20s\n \n # Return snapshot logs from pod nginx with multi containers\n ksail workload logs nginx --all-containers=true\n \n # Return snapshot logs from all pods in the deployment nginx\n ksail workload logs deployment/nginx --all-pods=true\n \n # Return snapshot logs from all containers in pods defined by label app=nginx\n ksail workload logs -l app=nginx --all-containers=true\n \n # Return snapshot logs from all pods defined by label app=nginx, limiting concurrent log requests to 10 pods\n ksail workload logs -l app=nginx --max-log-requests=10\n \n # Return snapshot of previous terminated ruby container logs from pod web-1\n ksail workload logs -p -c ruby web-1\n \n # Begin streaming the logs from pod nginx, continuing even if errors occur\n ksail workload logs nginx -f --ignore-errors=true\n \n # Begin streaming the logs of the ruby container in pod web-1\n ksail workload logs -f -c ruby web-1\n \n # Begin streaming the logs from all containers in pods defined by label app=nginx\n ksail workload logs -f -l app=nginx --all-containers=true\n \n # Display only the most recent 20 lines of output in pod nginx\n ksail workload logs --tail=20 nginx\n \n # Show all logs from pod nginx written in the last hour\n ksail workload logs --since=1h nginx\n \n # Show all logs with timestamps from pod nginx starting from August 30, 2024, at 06:00:00 UTC\n ksail workload logs nginx --since-time=2024-08-30T06:00:00Z --timestamps=true\n \n # Show logs from a kubelet with an expired serving certificate\n ksail workload logs --insecure-skip-tls-verify-backend nginx\n \n # Return snapshot logs from first container of a job named hello\n ksail workload logs job/hello\n \n # Return snapshot logs from container nginx-1 of a deployment named nginx\n ksail workload logs deployment/nginx -c nginx-1\n\nFlags:\n --all-containers Get all containers' logs in the pod(s).\n --all-pods Get logs from all pod(s). Sets prefix to true.\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n -c, --container string Print the logs of this container\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n -f, --follow Specify if the logs should be streamed.\n --ignore-errors If watching / following pod logs, allow for any errors that occur to be non-fatal\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --insecure-skip-tls-verify-backend Skip verifying the identity of the kubelet that logs are requested from. In theory, an attacker could provide invalid log content back. You might want to use this if your kubelet serving certificates have expired.\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n --limit-bytes int Maximum bytes of logs to return. Defaults to no limit.\n --max-log-requests int Specify maximum number of concurrent logs to follow when using by a selector. Defaults to 5. (default 5)\n -n, --namespace string If present, the namespace scope for this CLI request\n --pod-running-timeout duration The length of time (like 5s, 2m, or 3h, higher than zero) to wait until at least one pod is running (default 20s)\n --prefix Prefix each log line with the log source (pod name and container name)\n -p, --previous If true, print the logs for the previous instance of the container in a pod if it exists.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --since duration Only return logs newer than a relative duration like 5s, 2m, or 3h. Defaults to all logs. Only one of since-time / since may be used.\n --since-time string Only return logs after a specific date (RFC3339). Defaults to all logs. Only one of since-time / since may be used.\n --tail int Lines of recent log file to display. Defaults to -1 with no selector, showing all log lines otherwise 10, if a selector is provided. (default -1)\n --timestamps Include timestamps on each line in the log output\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Mirror\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nMirror a Deployment's inbound traffic to the local machine (read-only).\n\nResolves the Deployment to a running pod, injects a read-only tap (an ephemeral\ncontainer holding only CAP_NET_RAW), and streams a tcpdump pcap capture of the\nservice port over the Kubernetes exec channel — no reverse tunnel, no traffic\ninterception, the workload keeps serving untouched.\n\nThe capture runs until interrupted (Ctrl-C). By default it is written to\nmirror.pcap and summarized on stop; --output - streams the raw pcap to stdout\nfor piping into tshark/wireshark.\n\nEphemeral containers cannot be removed, so an already-injected tap on the\ntarget pod is reused rather than treated as an error.\n\nUsage:\n ksail workload mirror [flags]\n\nExamples:\n # Mirror the traffic your app receives on port 8080 into mirror.pcap\n ksail workload mirror my-app --port 8080\n\n # Mirror a specific container of a multi-container Deployment in a namespace\n ksail workload mirror my-app -n prod -c api --port 8080\n\n # Pipe the live capture straight into tshark\n ksail workload mirror my-app --port 8080 --output - | tshark -r -\n\nFlags:\n -c, --container string Container whose traffic is mirrored (required when the Deployment has several)\n --context string Kubeconfig context of the target cluster\n -n, --namespace string Namespace of the target Deployment (default \"default\")\n -o, --output string Destination pcap file, or '-' to stream the raw pcap to stdout (default \"mirror.pcap\")\n -p, --port int Service port to capture TCP traffic on (required)\n --tap-image string Image the injected tap container runs (default \"docker.io/nicolaka/netshoot:v0.16\")\n --tap-timeout duration How long to wait for the tap container to reach Running (default 1m0s)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Network\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nInspect live network traffic flows via Cilium Hubble.\n\nWhen the cluster uses the Cilium CNI, Cilium's eBPF datapath records every\nnetwork flow and exposes them through the Hubble Relay API. This command\nqueries the most recent flows and prints them, so you can debug connectivity,\nspot drops, and see which workloads talk to each other without leaving the\nterminal.\n\nThe command connects to a Hubble Relay address (default localhost:4245).\nPort-forward the in-cluster relay first, e.g.:\n\n kubectl -n kube-system port-forward svc/hubble-relay 4245:80\n\nPass --follow to keep streaming live flows as they happen (like 'kubectl logs\n-f'), until you interrupt with Ctrl-C.\n\nOutput formats:\n - plain: an aligned table (default; one row per flow while following)\n - json: a JSON array of flow records, or newline-delimited JSON (one object\n per line) while following — both fit scripting / AI consumption\n\nExamples:\n # Show the 20 most recent flows\n ksail workload network\n\n # Only flows in the \"default\" namespace, as JSON\n ksail workload network --namespace default --output json\n\n # Only the last 100 TCP flows touching a pod\n ksail workload network --pod my-app --protocol tcp --last 100\n\n # Stream live flows until Ctrl-C\n ksail workload network --follow\n\nUsage:\n ksail workload network [flags]\n\nFlags:\n --cni CNI Container Network Interface (CNI) to use\n -f, --follow Stream flows continuously until interrupted (Ctrl-C)\n --last uint Number of most recent flows to fetch (default 20)\n -n, --namespace string Filter flows by namespace (source or destination)\n -o, --output string Output format: plain, json (default \"plain\")\n --pod string Filter flows by pod-name substring (source or destination)\n --protocol string Filter flows by L4 protocol (TCP, UDP, ICMPv4, ICMPv6, SCTP)\n --server string Hubble Relay address to query (default \"localhost:4245\")\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Push\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nBuild and push local workloads as an OCI artifact to a registry.\n\nThe OCI reference format is: oci://:/[/]:\n\nExamples:\n # Push to auto-detected local registry with defaults\n ksail workload push\n\n # Push specific directory to auto-detected registry\n ksail workload push --path=./manifests\n\n # Push to explicit registry endpoint\n ksail workload push oci://localhost:5050/k8s:dev\n\n # Push to external registry with credentials\n ksail workload push --registry='$USER:$TOKEN@ghcr.io/org/repo'\n\n # Push using KSAIL_REGISTRY environment variable\n KSAIL_REGISTRY='ghcr.io/org/repo' ksail workload push\n\n # Push with variant (subdirectory in repository)\n ksail workload push oci://localhost:5050/my-app/base:v1.0.0 --path=./k8s\n\nAll parts of the OCI reference are optional and will be inferred:\n - host:port: Auto-detected from running local-registry container\n - repository: Derived from source directory name\n - ref: Defaults to \"dev\"\n\nUsage:\n ksail workload push [oci://:/[/]:] [flags]\n\nFlags:\n --path string Source directory containing manifests to push\n --registry string Registry to push to (format: [user:pass@]host[:port][/path]), can also be set via KSAIL_REGISTRY env var\n --validate Validate manifests before pushing\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Reconcile\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nTrigger reconciliation/sync and wait for completion. For Flux, tracks the OCIRepository and each Kustomization individually. For ArgoCD, tracks each Application until synced and healthy.\n\nUsage:\n ksail workload reconcile [flags]\n\nFlags:\n --exclude strings kustomization names to skip during progress monitoring (repeatable, comma-separated)\n --timeout duration timeout for waiting for reconciliation to complete (overrides config timeout)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout History\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nView previous rollout revisions and configurations.\n\nUsage:\n ksail workload rollout history (TYPE NAME | TYPE/NAME) [flags]\n\nExamples:\n # View the rollout history of a deployment\n kubectl rollout history deployment/abc\n \n # View the details of daemonset revision 3\n kubectl rollout history daemonset/abc --revision=3\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --revision int See the details, including podTemplate of the revision specified\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout Pause\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nMark the provided resource as paused.\n\n Paused resources will not be reconciled by a controller. Use \"kubectl rollout resume\" to resume a paused resource. Currently only deployments support being paused.\n\nUsage:\n ksail workload rollout pause RESOURCE\n\nExamples:\n # Mark the nginx deployment as paused\n # Any current state of the deployment will continue its function; new updates\n # to the deployment will not have an effect as long as the deployment is paused\n kubectl rollout pause deployment/nginx\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-rollout\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout Restart\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRestart a resource.\n\n Resource rollout will be restarted.\n\nUsage:\n ksail workload rollout restart RESOURCE\n\nExamples:\n # Restart all deployments in the test-namespace namespace\n kubectl rollout restart deployment -n test-namespace\n \n # Restart a deployment\n kubectl rollout restart deployment/nginx\n \n # Restart a daemon set\n kubectl rollout restart daemonset/abc\n \n # Restart deployments with the app=nginx label\n kubectl rollout restart deployment --selector=app=nginx\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-rollout\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout Resume\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nResume a paused resource.\n\n Paused resources will not be reconciled by a controller. By resuming a resource, we allow it to be reconciled again. Currently only deployments support being resumed.\n\nUsage:\n ksail workload rollout resume RESOURCE\n\nExamples:\n # Resume an already paused deployment\n kubectl rollout resume deployment/nginx\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --field-manager string Name of the manager used to track field ownership. (default \"kubectl-rollout\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nManage the rollout of one or many resources.\n\nUsage:\n ksail workload rollout\n ksail workload rollout [command]\n\nExamples:\n # Rollback to the previous deployment\n ksail workload rollout undo deployment/abc\n \n # Check the rollout status of a daemonset\n ksail workload rollout status daemonset/foo\n \n # Restart a deployment\n ksail workload rollout restart deployment/abc\n \n # Restart deployments with the 'app=nginx' label\n ksail workload rollout restart deployment --selector=app=nginx\n\nAvailable Commands:\n history View rollout history\n pause Mark the provided resource as paused\n restart Restart a resource\n resume Resume a paused resource\n status Show the status of the rollout\n undo Undo a previous rollout\n\nFlags:\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --disable-compression If true, opt-out of response compression for all requests to the server\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -n, --namespace string If present, the namespace scope for this CLI request\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n -s, --server string The address and port of the Kubernetes API server\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload rollout [command] --help\" for more information about a command.\n\n```\n\n### Workload Rollout Status\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nShow the status of the rollout.\n\n By default 'rollout status' will watch the status of the latest rollout until it's done. If you don't want to wait for the rollout to finish then you can use --watch=false. Note that if a new rollout starts in-between, then 'rollout status' will continue watching the latest revision. If you want to pin to a specific revision and abort if it is rolled over by another revision, use --revision=N where N is the revision you need to watch for.\n\nUsage:\n ksail workload rollout status (TYPE NAME | TYPE/NAME) [flags]\n\nExamples:\n # Watch the rollout status of a deployment\n kubectl rollout status deployment/nginx\n\nFlags:\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --revision int Pin to a specific revision for showing its status. Defaults to 0 (last revision).\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --timeout duration The length of time to wait before ending watch, zero means never. Any other values should contain a corresponding time unit (e.g. 1s, 2m, 3h).\n -w, --watch Watch the status of the rollout until it's done. (default true)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Rollout Undo\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRoll back to a previous rollout.\n\nUsage:\n ksail workload rollout undo (TYPE NAME | TYPE/NAME) [flags]\n\nExamples:\n # Roll back to the previous deployment\n kubectl rollout undo deployment/abc\n \n # Roll back to daemonset revision 3\n kubectl rollout undo daemonset/abc --to-revision=3\n \n # Roll back to the previous deployment with dry-run\n kubectl rollout undo --dry-run=server deployment/abc\n\nFlags:\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to get from a server.\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --to-revision int The revision to rollback to. Default to 0 (last revision).\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Root\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nManage workload operations including resource inspection, GitOps reconciliation, and lifecycle management.\n\nRead operations:\n get - List resources with optional -o json for structured output including status/conditions\n describe - Show detailed resource info including events, conditions, and error details\n logs - Print container logs (use --tail=N, --previous for crash diagnostics)\n explain - Show API documentation for a resource kind\n forward - Forward one or more local ports to a pod\n images - List container images required by cluster components\n scan - Run security scans on Kubernetes manifests using Kubescape\n wait - Wait for a specific condition on resources\n\nWrite operations:\n apply, create, debug, delete, edit, exec, export, expose, import, install, push, reconcile, rollout, scale, watch\n cipher - Manage SOPS-encrypted secret files (encrypt, decrypt, edit, import, rotate)\n\nGitOps diagnostics: Use 'get' with Flux resources (kustomization, helmrelease, ocirepository -A -o json) or ArgoCD resources (application -A -o json) to check reconciliation status, health, and errors in a single call.\n\nUsage:\n ksail workload [flags]\n ksail workload [command]\n\nResources:\n apply Apply manifests\n create Create resources\n delete Delete resources\n describe Describe resources\n edit Edit a resource\n explain Get documentation for a resource\n expose Expose a resource as a service\n gen Generate Kubernetes resource manifests\n get Get resources\n scale Scale resources\n wait Wait for a specific condition on one or many resources\n\nImages:\n export Export container images from the cluster\n images List container images required by cluster components\n import Import container images to the cluster\n\nGitOps:\n install Install Helm charts\n push Package and push an OCI artifact to a registry\n reconcile Trigger reconciliation for GitOps workloads\n scan Run security scans on Kubernetes manifests\n validate Validate Kubernetes manifests and kustomizations\n\nDev loop:\n debug Create debugging sessions for troubleshooting workloads and nodes\n exec Execute a command in a container\n forward Forward one or more local ports to a pod\n logs Print container logs\n mirror Mirror a Deployment's inbound traffic locally (read-only pcap capture)\n network Inspect live network traffic flows via Cilium Hubble\n rollout Manage the rollout of a resource\n watch Watch for file changes and auto-apply workloads\n\nSecrets:\n cipher Manage encrypted files with SOPS\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\nUse \"ksail workload [command] --help\" for more information about a command.\n\n```\n\n### Workload Scale\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nSet a new size for a deployment, replica set, replication controller, or stateful set.\n\nUsage:\n ksail workload scale\n\nExamples:\n # Scale a replica set named 'foo' to 3\n ksail workload scale --replicas=3 rs/foo\n \n # Scale a resource identified by type and name specified in \"foo.yaml\" to 3\n ksail workload scale --replicas=3 -f foo.yaml\n \n # If the deployment named mysql's current size is 2, scale mysql to 3\n ksail workload scale --current-replicas=2 --replicas=3 deployment/mysql\n \n # Scale multiple replication controllers\n ksail workload scale --replicas=5 rc/example1 rc/example2 rc/example3\n \n # Scale stateful set named 'web' to 3\n ksail workload scale --replicas=3 statefulset/web\n\nFlags:\n --all Select all resources in the namespace of the specified resource types\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --as string Username to impersonate for the operation. User could be a regular user or a service account in a namespace.\n --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups.\n --as-uid string UID to impersonate for the operation.\n --as-user-extra stringArray User extras to impersonate for the operation, this flag can be repeated to specify multiple values for the same key.\n --cache-dir string Default cache directory (default \"~/.kube/cache\")\n --certificate-authority string Path to a cert file for the certificate authority\n --client-certificate string Path to a client certificate file for TLS\n --client-key string Path to a client key file for TLS\n --cluster string The name of the kubeconfig cluster to use\n --context string The name of the kubeconfig context to use\n --current-replicas int Precondition for current size. Requires that the current size of the resource match this value in order to scale. -1 (default) for no condition. (default -1)\n --disable-compression If true, opt-out of response compression for all requests to the server\n --dry-run string[=\"unchanged\"] Must be \"none\", \"server\", or \"client\". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource. (default \"none\")\n -f, --filename strings Filename, directory, or URL to files identifying the resource to set a new size\n --insecure-skip-tls-verify If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure\n --kubeconfig string Path to the kubeconfig file to use for CLI requests. (default \"~/.kube/config\")\n -k, --kustomize string Process the kustomization directory. This flag can't be used together with -f or -R.\n -n, --namespace string If present, the namespace scope for this CLI request\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.\n --replicas int The new desired number of replicas. Required.\n --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. (default \"0\")\n --resource-version string Precondition for resource version. Requires that the current resource version match this value in order to scale.\n -l, --selector string Selector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.\n -s, --server string The address and port of the Kubernetes API server\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --timeout duration The length of time to wait before giving up on a scale operation, zero means don't wait. Any other values should contain a corresponding time unit (e.g. 1s, 2m, 3h).\n --tls-server-name string Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used\n --token string Bearer token for authentication to the API server\n --user string The name of the kubeconfig user to use\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Scan\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nRun security scans on Kubernetes manifests using Kubescape.\n\nThis command scans manifests in the specified path against security frameworks\nsuch as NSA-CISA, MITRE ATT&CK, and CIS Benchmarks.\n\nWhen the target directory is a Kustomize root, manifests are rendered before\nscanning (Kustomize build + Flux variable substitution + in-process Helm\ntemplating of HelmReleases), so findings reflect overlay patches and chart output\nrather than the raw files. HelmReleases that cannot be rendered offline are left\nas-is with a warning. Use --no-render to scan the raw files instead.\n\nIf no path is provided, the path is resolved in order:\n 1. spec.workload.sourceDirectory from ksail.yaml (if a config file is found and the field is set)\n 2. The default source directory when spec.workload.sourceDirectory is unset (\"k8s\" directory)\n 3. The current directory (fallback when no ksail.yaml config file is found)\n\nExceptions: pass --exceptions to forward a Kubescape exceptions file (a JSON\narray of PostureExceptionPolicy objects) so justified, runtime-enforced findings\n(e.g. Kyverno admission mutation, Cilium network policies, VPA-managed resources) are\nsuppressed and --compliance-threshold 100 can gate CI. The file loads locally with no\ncloud account and the scan stays offline.\n\nThe frameworks, exceptions file, and compliance threshold can also be set under\nspec.workload.scan in ksail.yaml so 'ksail workload scan' (no args) is a turnkey CI\ngate; a relative exceptions path resolves against the ksail.yaml directory and CLI\nflags override the config.\n\nAvailable frameworks: nsa, mitre, cis, pss (and any other framework supported by Kubescape)\nAvailable output formats: pretty-printer, json, sarif, junit (and any other format supported by Kubescape)\n\nFor more information, see https://github.com/kubescape/kubescape\n\nUsage:\n ksail workload scan [PATH] [flags]\n\nFlags:\n --compliance-threshold float32 Fail if compliance score is below this threshold (0-100) (overrides spec.workload.scan.complianceThreshold from ksail.yaml)\n --exceptions string Path to a Kubescape exceptions file (a JSON array of PostureExceptionPolicy objects) forwarded to Kubescape's --exceptions (overrides spec.workload.scan.exceptions from ksail.yaml)\n --format string Output format (pretty-printer, json, sarif, junit) (default \"pretty-printer\")\n --framework strings Security frameworks to scan against (e.g. nsa, mitre, cis, pss) (overrides spec.workload.scan.frameworks from ksail.yaml) (default [nsa])\n --no-render Scan the raw manifest files instead of the Kustomize + Helm rendered output (skip rendering entirely; restores the pre-rendering behavior)\n -o, --output string Output file path (stdout if empty)\n --verbose Show all resources in output, not just failed ones\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Validate\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nValidate Kubernetes manifest files and kustomizations using kubeconform.\n\nThis command validates individual YAML files and kustomizations in the specified path.\nIf no path is provided, the path is resolved in order:\n 1. spec.workload.sourceDirectory from ksail.yaml (if a config file is found and the field is set)\n 2. The default source directory when spec.workload.sourceDirectory is unset (\"k8s\" directory)\n 3. The current directory (fallback when no ksail.yaml config file is found)\n\nThe validation process:\n1. Validates individual YAML files (patch files referenced in a kustomization file via patches,\n patchesStrategicMerge, or patchesJson6902 are excluded — they are not valid standalone\n Kubernetes resources and are validated as part of the kustomize build output instead)\n2. Validates kustomizations by building them with kustomize and validating the output\n\n\tFlux variable substitutions are resolved before validation using type-aware placeholders:\n - ${VAR} (bare, no default): when a JSON schema type is available, substitutes a typed\n placeholder derived from the schema for the field (\"placeholder\" for strings, 0 for\n integers, true for booleans); when no schema type is available, it falls back to the\n string value \"placeholder\"\n - ${VAR:-default} / ${VAR:=default}: when a schema type is available, uses the default\n value parsed according to the field schema type (e.g., \"3\" → int 3 for integer fields);\n when no schema type is available, the default is parsed using YAML-native type inference\n - Mixed text (e.g., \"prefix.${VAR}\"): substitutes \"placeholder\" in string context\n\nSchema lookups use a local disk cache and require no network access. When no cached\nJSON schema is available, placeholders fall back to strings with YAML-native parsing.\n\nBy default, Kubernetes Secrets are skipped to avoid validation failures due to SOPS fields.\n\nUsage:\n ksail workload validate [PATH] [flags]\n\nFlags:\n --ignore-missing-schemas Ignore resources with missing schemas (default true)\n --schema-location strings Additional kubeconform schema locations (local directory or URL/path template) for CRDs absent from the CRDs-catalog, so they are validated against a supplied schema instead of skipped (merged with spec.workload.validation.schemaLocations from ksail.yaml)\n --skip-helm-render Skip rendering HelmReleases before validation (validate the HelmRelease CR as-is). By default, charts are rendered in-process and the rendered manifests are validated.\n --skip-kinds strings Additional Kubernetes kinds to skip during validation (merged with spec.workload.validation.skipKinds from ksail.yaml)\n --skip-secrets Skip validation of Kubernetes Secrets (default true)\n --strict Enable strict validation mode\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Wait\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nWait for a specific condition on one or many resources. The command takes multiple resources and waits until the specified condition is seen in the Status field of every given resource.\n\nUsage:\n ksail workload wait\n\nExamples:\n # Wait for the pod \"busybox1\" to contain the status condition of type \"Ready\"\n ksail workload wait --for=condition=Ready pod/busybox1\n \n # The default value of status condition is true; you can wait for other targets after an equal delimiter (compared after Unicode simple case folding, which is a more general form of case-insensitivity)\n ksail workload wait --for=condition=Ready=false pod/busybox1\n \n # Wait for the pod \"busybox1\" to contain the status phase to be \"Running\"\n ksail workload wait --for=jsonpath='{.status.phase}'=Running pod/busybox1\n \n # Wait for pod \"busybox1\" to be Ready\n ksail workload wait --for='jsonpath={.status.conditions[?(@.type==\"Ready\")].status}=True' pod/busybox1\n \n # Wait for the service \"loadbalancer\" to have ingress\n ksail workload wait --for=jsonpath='{.status.loadBalancer.ingress}' service/loadbalancer\n \n # Wait for the secret \"busybox1\" to be created, with a timeout of 30s\n ksail workload create secret generic busybox1\n ksail workload wait --for=create secret/busybox1 --timeout=30s\n \n # Wait for the pod \"busybox1\" to be deleted, with a timeout of 60s, after having issued the \"delete\" command\n ksail workload delete pod/busybox1\n ksail workload wait --for=delete pod/busybox1 --timeout=60s\n \n # Wait for pod \"busybox1\" to be created AND reach the \"Ready\" status condition\n ksail workload wait --for=condition=Ready --for=create pod/busybox1\n \n # Wait for pod \"busybox1\" to reach the \"Ready\" status OR for its containers to report a \"False\" readiness state\n until ksail workload wait pod/busybox1 --for=condition=Ready --timeout=1s 2>/dev/null || \\\n ksail workload wait pod/busybox1 --for=condition=ContainersReady=False --timeout=1s 2>/dev/null; \\\n do echo \"Checking conditions...\"; sleep 1; done\n\nFlags:\n --all Select all resources in the namespace of the specified resource types\n -A, --all-namespaces If present, list the requested object(s) across all namespaces. Namespace in current context is ignored even if specified with --namespace.\n --allow-missing-template-keys If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats. (default true)\n --field-selector string Selector (field query) to filter on, supports '=', '==', and '!='.(e.g. --field-selector key1=value1,key2=value2). The server only supports a limited number of field queries per type.\n -f, --filename strings identifying the resource.\n --for stringArray The condition to wait on: [create|delete|condition=condition-name[=condition-value]|jsonpath='{JSONPath expression}'=[JSONPath value]]. The default condition-value is true. Condition values are compared after Unicode simple case folding, which is a more general form of case-insensitivity. Multiple conditions are supported and AND'ed to each other in a sequential order. If --for=create is passed, it is always waited first.\n --local If true, annotation will NOT contact api-server but run locally.\n -o, --output string Output format. One of: (json, yaml, kyaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).\n -R, --recursive Process the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory. (default true)\n -l, --selector string Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1=value1,key2=value2)\n --show-managed-fields If true, keep the managedFields when printing objects in JSON or YAML format.\n --template string Template string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].\n --timeout duration The length of time to wait before giving up. Zero means check once and don't wait, negative means wait for a week. (default 30s)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n### Workload Watch\n\n{/* This page is auto-generated by go generate ./docs/... — DO NOT EDIT */}\n\n```text\nWatch a directory for file changes and automatically apply workloads.\n\nWhen files in the watched directory are created, modified, or deleted,\nthe command debounces changes (~500ms) then scopes the apply to the\nnearest directory containing a kustomization file recognized by kubectl\n(kustomization.yaml, kustomization.yml, or Kustomization), walking up\nfrom the changed file to the watch root. If no kustomization boundary is\nfound, or the boundary is the watch root, it applies the full root\ndirectory. This scoping ensures only the affected Kustomize layer is\nre-applied, making iteration faster in monorepo-style layouts.\n\nEach reconcile prints a timestamped status line showing the changed file,\nthe outcome (success or failure), and the elapsed time for the apply.\nPress Ctrl+C to stop the watcher.\n\nUse --initial-apply to synchronize the cluster with the current state of\nthe watch directory before entering the watch loop. This is useful after\nediting manifests offline or when starting a fresh session.\n\nUse --hook to run shell commands before each apply (e.g. docker build).\nHooks execute sequentially; if any hook fails the apply is skipped for\nthat cycle. Hooks can also be configured in ksail.yaml under\nspec.workload.watch.hooks. CLI --hook flags are appended after config hooks.\n\nExamples:\n # Watch the default k8s/ directory\n ksail workload watch\n\n # Watch and apply once on startup before entering the loop\n ksail workload watch --initial-apply\n\n # Watch a custom directory\n ksail workload watch --path=./manifests\n\n # Run a build before each apply\n ksail workload watch --hook \"docker build -t myapp:latest .\"\n\n # Chain multiple hooks\n ksail workload watch --hook \"make generate\" --hook \"docker build -t myapp .\"\n\nUsage:\n ksail workload watch [flags]\n\nFlags:\n --debug Show diagnostic output for file events and polling (useful for troubleshooting watch behavior)\n --hook stringArray Shell command to run before each apply (repeatable; appended after spec.workload.watch.hooks)\n --initial-apply Apply all workloads once immediately on startup before entering the watch loop\n --path string Directory to watch for changes (default: k8s/ or spec.workload.sourceDirectory from ksail.yaml)\n\nGlobal Flags:\n --benchmark Show per-activity benchmark output\n --config string Path to config file (default: ksail.yaml found via directory traversal)\n\n```\n\n> For image rebuild automation and local↔remote traffic bridging, see the [Companion Tools](/integrations/companion-tools/) guide.\n\n### Gateway Api\n\nKSail clusters using the **Cilium** CNI option come Gateway API–ready out of the box. When you select `cni: Cilium`, KSail automatically:\n\n1. **Installs Gateway API CRDs** (experimental channel, v1.4.1) before the Cilium Helm chart.\n2. **Enables Cilium's Gateway API controller** (`gatewayAPI.enabled: true`) in the Helm values.\n3. **Creates a `GatewayClass`** named `cilium` via the Cilium controller.\n\nYou don't need to install any additional controllers or CRD bundles manually.\n\n> [!NOTE]\n> This guide assumes you are using **Cilium** as your CNI. Gateway API is not automatically enabled on the Default (kindnet) CNI. If you initialized your cluster without specifying `--cni`, run `ksail project init --cni Cilium` to get a Cilium-enabled cluster.\n\n## Prerequisites\n\n- [KSail CLI](/installation/) installed\n- Docker running\n- A cluster initialized with Cilium:\n\n ```bash\n ksail project init --cni Cilium\n ksail cluster create\n ```\n\n Or update an existing `ksail.yaml` to set `spec.cluster.cni: Cilium` and run `ksail cluster update`.\n\n- `kubectl` accessible (KSail writes the kubeconfig context — see [Companion Tools](/integrations/companion-tools/) for context names per distribution).\n\n## Verify Gateway API Is Ready\n\nAfter cluster creation, confirm the `GatewayClass` exists and is ready:\n\n```bash\nkubectl get gatewayclass\n```\n\nExpected output:\n\n```\nNAME CONTROLLER ACCEPTED AGE\ncilium io.cilium/gateway-controller True 2m\n```\n\nIf `ACCEPTED` is `False`, wait a few seconds for Cilium to finish initializing. You can also check:\n\n```bash\nkubectl get crd gateways.gateway.networking.k8s.io\n```\n\n## Expose a Service with HTTPRoute\n\nThe Gateway API request path is: **`GatewayClass` → `Gateway` → `HTTPRoute` → `Service`**.\n\n\n1. **Deploy a sample app**\n\n ```bash\n kubectl create deployment httpbin \\\n --image=kennethreitz/httpbin:latest \\\n --port=80\n kubectl expose deployment httpbin --port=80\n ```\n\n2. **Create a Gateway**\n\n ```yaml\n # gateway.yaml\n apiVersion: gateway.networking.k8s.io/v1\n kind: Gateway\n metadata:\n name: my-gateway\n namespace: default\n spec:\n gatewayClassName: cilium\n listeners:\n - name: http\n port: 80\n protocol: HTTP\n ```\n\n ```bash\n kubectl apply -f gateway.yaml\n kubectl get gateway my-gateway\n ```\n\n Wait until `PROGRAMMED` is `True`:\n\n ```\n NAME CLASS ADDRESS PROGRAMMED AGE\n my-gateway cilium True 30s\n ```\n\n > [!NOTE]\n > On Docker-based clusters (Vanilla, K3s, VCluster) **without an external LoadBalancer** (such as MetalLB), KSail configures Cilium's Gateway API integration to use `hostNetwork` mode — the Gateway does not get its own external IP and traffic reaches it via the node's host ports. When you enable an external LoadBalancer, `hostNetwork` is not applied and Gateways may receive an IP via a `Service`. For Hetzner and Omni cloud providers, the Gateway receives a real external IP. KWOK has no real network dataplane, so Gateway API traffic routing does not function even though the configuration objects are accepted by the API server.\n\n3. **Create an HTTPRoute**\n\n ```yaml\n # httproute.yaml\n apiVersion: gateway.networking.k8s.io/v1\n kind: HTTPRoute\n metadata:\n name: httpbin-route\n namespace: default\n spec:\n parentRefs:\n - name: my-gateway\n hostnames:\n - \"httpbin.local\"\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: httpbin\n port: 80\n ```\n\n ```bash\n kubectl apply -f httproute.yaml\n kubectl get httproute httpbin-route\n ```\n\n4. **Test the route**\n\n For local Docker clusters, port-forward the Cilium Gateway Service to test:\n\n ```bash\n # Port-forward the Cilium Envoy listener Service created for the Gateway\n kubectl -n kube-system port-forward svc/cilium-gateway-my-gateway 8080:80 &\n\n # Send a request that matches the HTTPRoute hostname\n curl -H \"Host: httpbin.local\" http://localhost:8080/get\n ```\n\n\n\n## Path-Based Routing\n\nSplit traffic between services based on URL path prefix:\n\n```yaml\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: api-route\n namespace: default\nspec:\n parentRefs:\n - name: my-gateway\n rules:\n - matches:\n - path:\n type: PathPrefix\n value: /api\n backendRefs:\n - name: backend-api\n port: 8080\n - matches:\n - path:\n type: PathPrefix\n value: /\n backendRefs:\n - name: frontend\n port: 3000\n```\n\n## Header-Based Routing\n\nRoute requests based on HTTP headers — useful for canary deployments or A/B testing:\n\n```yaml\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: canary-route\n namespace: default\nspec:\n parentRefs:\n - name: my-gateway\n rules:\n - matches:\n - headers:\n - name: X-Version\n value: canary\n backendRefs:\n - name: my-app-canary\n port: 80\n - backendRefs:\n - name: my-app\n port: 80\n```\n\n## TLS Termination\n\nTerminate TLS at the Gateway using a Kubernetes `Secret`:\n\n```yaml\n# tls-gateway.yaml\napiVersion: gateway.networking.k8s.io/v1\nkind: Gateway\nmetadata:\n name: my-tls-gateway\n namespace: default\nspec:\n gatewayClassName: cilium\n listeners:\n - name: https\n port: 443\n protocol: HTTPS\n tls:\n mode: Terminate\n certificateRefs:\n - name: my-tls-secret # a kubernetes.io/tls Secret\n---\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n name: my-tls-route\n namespace: default\nspec:\n parentRefs:\n - name: my-tls-gateway\n hostnames:\n - \"myapp.example.com\"\n rules:\n - backendRefs:\n - name: my-app\n port: 80\n```\n\n> [!TIP]\n> Use [cert-manager](https://cert-manager.io/) to automatically provision TLS certificates. Install it with `ksail workload install cert-manager jetstack/cert-manager` and configure an `Issuer` or `ClusterIssuer` to populate the secret automatically.\n\n## Migration from Ingress\n\nGateway API replaces the Kubernetes `Ingress` resource. Here is a side-by-side comparison of a common pattern:\n\n| Concern | Ingress | HTTPRoute |\n|---------|---------|-----------|\n| Entry point | `Ingress` | `Gateway` + `HTTPRoute` |\n| Path routing | `spec.rules[].http.paths` | `spec.rules[].matches[].path` |\n| Host routing | `spec.rules[].host` | `spec.hostnames[]` |\n| TLS | `spec.tls[]` | `Gateway` listener `tls` section |\n| Annotation-based features | Varies by controller | Native spec fields |\n\nReplace each `Ingress` with a `Gateway` (one per entry point) and one or more `HTTPRoute` resources. See [Expose a Service with HTTPRoute](#expose-a-service-with-httproute) for a complete example. For a detailed migration walkthrough, see the [Kubernetes Gateway API migration guide](https://gateway-api.sigs.k8s.io/guides/migrating-from-ingress/).\n\n## Using Gateway API in GitOps\n\nWhen using KSail with Flux or ArgoCD, place Gateway and HTTPRoute manifests in your source directory alongside other workload manifests:\n\n```text\nk8s/\n├── kustomization.yaml\n├── gateway.yaml # Gateway resource\n└── my-app/\n ├── deployment.yaml\n ├── service.yaml\n └── httproute.yaml # HTTPRoute resource\n```\n\nThe Gateway API CRDs and the `cilium` GatewayClass are managed by KSail (installed during `cluster create`). Your manifests only need to declare `Gateway` and `HTTPRoute` resources — no CRD or GatewayClass manifest is needed in your source directory.\n\n```bash\nksail workload apply -f k8s/\n# or with GitOps\nksail workload push\nksail workload reconcile\n```\n\n## Troubleshooting\n\n**GatewayClass `ACCEPTED` is `False`:**\n\n```bash\nkubectl describe gatewayclass cilium\n```\n\nCilium's controller may still be starting. Wait for Cilium pods to be ready:\n\n```bash\nkubectl get pods -n kube-system -l k8s-app=cilium\n```\n\n**Gateway `PROGRAMMED` is `False`:**\n\n```bash\nkubectl describe gateway my-gateway\n```\n\nCheck for port conflicts or missing CRDs. On Docker clusters without an external LoadBalancer, confirm Cilium is running with `gatewayAPI.hostNetwork.enabled: true` (KSail sets this automatically for Docker providers when no LoadBalancer is configured).\n\n**HTTPRoute not routing traffic:**\n\n```bash\nkubectl get httproute my-route -o yaml\n```\n\nCheck `status.parents[].conditions` for `Accepted` and `ResolvedRefs` — both must be `True`. If `ResolvedRefs` is `False`, the backend `Service` may not exist or the port may be wrong.\n\n**CRDs not found:**\n\nGateway API CRDs are installed by KSail during `cluster create` for Cilium clusters. If you're seeing `No resources found` for `gateway.networking.k8s.io`:\n\n```bash\nkubectl get crd | grep gateway.networking.k8s.io\n```\n\nRe-run `ksail cluster update` to reinstall CRDs if they are missing.\n\n## Related\n\n- [Cilium Gateway API docs](https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gateway-api/) — upstream reference\n- [Kubernetes Gateway API docs](https://gateway-api.sigs.k8s.io/) — spec reference\n- [Multi-Environment Workflows](/guides/multi-environment/) — managing clusters across environments\n- [PR Preview Clusters](/guides/pr-preview-clusters/) — ephemeral clusters in CI with GitOps\n\n### Loadbalancer\n\nLoadBalancer services expose applications to external traffic. KSail supports LoadBalancer across all distributions with distribution-specific implementations for each platform.\n\n## Overview\n\nLoadBalancer support varies by Kubernetes distribution and infrastructure provider:\n\n| Distribution | Provider | Implementation | Default Behavior | Configuration Required |\n| --------------- | -------- | --------------------------------- | ---------------- | ---------------------- |\n| Vanilla (Kind) | Docker | Cloud Provider KIND | Disabled | Yes |\n| K3s (K3d) | Docker | ServiceLB (Klipper) | Enabled | No |\n| Talos | Docker | MetalLB | Disabled | Yes |\n| Talos | Hetzner | hcloud-cloud-controller-manager | Enabled | No |\n| VCluster (Vind) | Docker | Delegated to host cluster | N/A | N/A |\n\nVCluster delegates LoadBalancer to the host cluster — `spec.cluster.loadBalancer` has no effect and never triggers a cluster update. Use the `--load-balancer` flag or `spec.cluster.loadBalancer` in `ksail.yaml` with values `Default`, `Enabled`, or `Disabled`.\n\n## Platform-Specific Configuration\n\n### Vanilla (Kind) on Docker\n\nVanilla clusters use the [Cloud Provider KIND](https://github.com/kubernetes-sigs/cloud-provider-kind) controller, which runs as an external Docker container and allocates LoadBalancer IPs from the Docker bridge network.\n\n#### Enable LoadBalancer Support\n\n**CLI:**\n\n```bash\nksail project init \\\n --name my-cluster \\\n --distribution Vanilla \\\n --load-balancer Enabled\n```\n\n**ksail.yaml:**\n\n```yaml\nspec:\n cluster:\n distribution: Vanilla\n loadBalancer: Enabled\n```\n\n#### How It Works\n\nCloud Provider KIND runs as a single Docker container named `ksail-cloud-provider-kind` on the `kind` network, mounting the Docker socket to watch for `type: LoadBalancer` services. For each service it creates a dedicated `cpk--` container that routes traffic from an IP on the `kind` network bridge subnet (typically `172.18.0.0/16`) to the service's pods. `ksail cluster delete` removes the controller and all `cpk-*` containers.\n\n### K3s on Docker\n\nK3s includes [ServiceLB](https://docs.k3s.io/networking/networking-services#service-load-balancer) by default, assigning the cluster node's IP as the external IP and forwarding traffic via `iptables`. No configuration needed:\n\n```bash\nksail project init --name my-cluster --distribution K3s\nksail cluster create\n```\n\nTo disable: use `--load-balancer Disabled` (CLI) or set `loadBalancer: Disabled` in `ksail.yaml`.\n\n### Talos on Docker\n\nTalos on Docker uses [MetalLB](https://metallb.universe.tf/) to provide LoadBalancer services. MetalLB operates in Layer 2 mode and allocates IPs from a pre-configured pool.\n\n#### Enable LoadBalancer Support\n\n**CLI:**\n\n```bash\nksail project init \\\n --name my-cluster \\\n --distribution Talos \\\n --load-balancer Enabled\n```\n\n**ksail.yaml:**\n\n```yaml\nspec:\n cluster:\n distribution: Talos\n provider: Docker\n loadBalancer: Enabled\n```\n\nKSail configures MetalLB with a default IP pool of `172.18.255.200–172.18.255.250` in Layer 2 (ARP/NDP) mode on the Docker bridge network, chosen to avoid conflicts with typical Docker allocations.\n\n#### How It Works\n\nKSail installs MetalLB via Helm, configures an `IPAddressPool` and `L2Advertisement` automatically, and MetalLB assigns IPs from the pool via ARP on the Docker network.\n\n#### Custom IP Pool\n\nTo use a custom IP range, you'll need to create custom MetalLB resources after cluster creation:\n\n```yaml\napiVersion: metallb.io/v1beta1\nkind: IPAddressPool\nmetadata:\n name: custom-pool\n namespace: metallb-system\nspec:\n addresses:\n - 172.18.100.1-172.18.100.254\n---\napiVersion: metallb.io/v1beta1\nkind: L2Advertisement\nmetadata:\n name: custom-l2\n namespace: metallb-system\nspec:\n ipAddressPools:\n - custom-pool\n```\n\n### Talos on Hetzner\n\nTalos on Hetzner Cloud uses the [Hetzner Cloud Controller Manager](https://github.com/hetznercloud/hcloud-cloud-controller-manager) to provision real cloud load balancers. LoadBalancer is **enabled by default** — KSail automatically installs hcloud-ccm when `loadBalancer` is `Default` or `Enabled`.\n\n**Prerequisites:** Set `HCLOUD_TOKEN` to a Hetzner API token with read/write permissions for Load Balancers.\n\n```bash\nexport HCLOUD_TOKEN=your-token-here\nksail project init \\\n --name my-cluster \\\n --distribution Talos \\\n --provider Hetzner\nksail cluster create\n```\n\nThe Hetzner CCM provisions a real cloud load balancer with a public IP in 30–60 seconds (subject to Hetzner billing).\n\n```bash\nkubectl get svc my-app -w # EXTERNAL-IP appears after 30–60 seconds\n```\n\n#### Annotations\n\nYou can customize Hetzner Load Balancer behavior using annotations:\n\n```yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: my-app\n annotations:\n load-balancer.hetzner.cloud/location: nbg1\n load-balancer.hetzner.cloud/use-private-ip: \"true\"\n load-balancer.hetzner.cloud/health-check-interval: \"15s\"\nspec:\n type: LoadBalancer\n selector:\n app: my-app\n ports:\n - port: 80\n targetPort: 8080\n```\n\nSee the [Hetzner CCM documentation](https://github.com/hetznercloud/hcloud-cloud-controller-manager#service) for all available annotations.\n\n## Troubleshooting\n\n### LoadBalancer Service Stuck in Pending\n\n**Symptom:** `EXTERNAL-IP` shows ``.\n\n**Diagnosis:**\n\n```bash\n# Check loadBalancer setting (absent field = Default; Default auto-enables on K3s and Talos×Hetzner):\ngrep 'loadBalancer:' ksail.yaml || echo \"(not set — effective value: Default)\"\n# Vanilla: docker logs ksail-cloud-provider-kind\n# Talos: kubectl logs -n metallb-system -l app.kubernetes.io/component=controller\n# Hetzner: kubectl logs -n kube-system -l app=hcloud-cloud-controller-manager\n```\n\n**Common fixes:** LoadBalancer disabled → re-init with `--load-balancer Enabled`. Cloud Provider KIND not running → delete and recreate cluster. MetalLB IP pool exhausted → expand the pool (see below). Hetzner → ensure `HCLOUD_TOKEN` is set during cluster creation.\n\n### Cannot Access LoadBalancer IP\n\n**Symptom:** Service has an external IP but connections fail.\n\n**Diagnosis:**\n\n```bash\nkubectl get pods -l app=my-app # verify pods are Running\nkubectl get endpoints my-app # check endpoint IPs are populated\nkubectl logs -l app=my-app # review pod logs\n# Test from within the cluster:\nkubectl run test --rm -it --restart=Never --image=curlimages/curl -- curl http://my-app.default.svc.cluster.local\n```\n\n**Common fixes:** Wrong `targetPort` → match the container port. Network policy blocking traffic → inspect `NetworkPolicy` resources. Application not listening on `0.0.0.0` → fix app bind address.\n\n### MetalLB IP Pool Exhausted\n\n**Symptom:** New LoadBalancer services remain `` after many allocations (default pool has 51 IPs: `172.18.255.200–172.18.255.250`).\n\n**Fix:** Create an additional `IPAddressPool` in `metallb-system`:\n\n```yaml\napiVersion: metallb.io/v1beta1\nkind: IPAddressPool\nmetadata:\n name: expanded-pool\n namespace: metallb-system\nspec:\n addresses:\n - 172.18.255.200-172.18.255.254 # Expanded from .250 to .254\n```\n\n### Workload Validate\n\n`ksail workload validate` runs [kubeconform](https://github.com/yannh/kubeconform) against your Kubernetes manifests to catch schema errors before they reach the cluster. When your manifests use [Flux postBuild substitutions](https://fluxcd.io/flux/components/kustomize/kustomizations/#post-build-variable-substitution) (`${VAR}`, `${VAR:-default}`, `${VAR:=default}`), the validator needs concrete values to produce valid YAML for schema checking.\n\nThis guide explains how the expansion works, why environment variables are not read, and how to write substitutions that validate cleanly.\n\n## Why Local Environment Variables Are Not Used\n\n`workload validate` is designed to be **deterministic** — the same manifests should produce the same validation result regardless of the machine, user, or environment they are run on. Reading from local environment variables would break this:\n\n- A manifest that validates on a developer's machine (because `$REPLICA_COUNT` is set) might fail in CI (where it is not set).\n- Conversely, an incorrectly typed default (`replicas: \"3\"` instead of `replicas: 3`) might slip through validation on a machine where the env var overrides the bad default.\n\nInstead, KSail uses **typed schema-aware placeholders** derived from the Kubernetes JSON schema. Validation catches type mismatches at schema-check time, not at deploy time.\n\n> [!NOTE]\n> Commands that deploy or push manifests (`workload apply`, `workload push`, `workload reconcile`) do **not** expand Flux `${VAR}` substitutions from your local environment. They pass manifests through (or trigger GitOps reconciliation), and Flux performs substitution **in-cluster** via Kustomization `postBuild.substitute` / `substituteFrom`. Only `workload validate` simulates substitutions client-side, using deterministic placeholders instead of reading environment variables.\n\n## Expansion Rules\n\n### `${VAR}` — Bare Variable Reference (No Default)\n\nA bare `${VAR}` is replaced with a **typed placeholder** based on the JSON schema type of the field it occupies.\n\n| Schema type | Placeholder value |\n|-------------|------------------|\n| `string` | `\"placeholder\"` |\n| `integer` | `0` |\n| `number` | `0.0` |\n| `boolean` | `true` |\n| unknown / no schema | `\"placeholder\"` |\n\n**Example:**\n\n```yaml\nspec:\n replicas: ${REPLICA_COUNT} # integer field → 0\n image: ${IMAGE_REF} # string field → \"placeholder\"\n enableFeature: ${FEATURE_ON} # boolean field → true\n```\n\nAfter expansion:\n\n```yaml\nspec:\n replicas: 0\n image: placeholder\n enableFeature: true\n```\n\n### `${VAR:-default}` and `${VAR:=default}` — Variable With Default\n\nWhen a default is provided (either `:-` or `:=` syntax), the default value is used as-is and coerced to the schema type.\n\n```yaml\nspec:\n replicas: ${REPLICA_COUNT:-3} # integer field → 3 (not \"3\")\n name: ${APP_NAME:-my-app} # string field → \"my-app\"\n debug: ${DEBUG_MODE:-false} # boolean field → false\n```\n\n> [!NOTE]\n> Coercion only applies to scalar-only substitutions (when the entire field value is a single `${VAR:-...}`). In mixed-text contexts (e.g., `prefix-${VAR}-suffix`), the result is always a string: bare `${VAR}` references are replaced with the string placeholder `\"placeholder\"`, while `${VAR:-default}` / `${VAR:=default}` expand to the provided default text.\n\n### Mixed-Text Substitution\n\nWhen a variable reference is embedded inside a larger string, the result is always a string:\n\n```yaml\nspec:\n hostname: ${ENV}-app.example.com # → \"placeholder-app.example.com\"\n image: myrepo/${IMAGE_NAME:-nginx}:latest # → \"myrepo/nginx:latest\"\n```\n\n## Schema Inference\n\nKSail loads JSON schemas from the kubeconform disk cache (populated on previous `workload validate` runs). Schema files are looked up from the OS user cache directory (for example `~/.cache/ksail/kubeconform/`), or from `${TMPDIR}/ksail/kubeconform` when the user cache directory is unavailable (such as in some CI environments).\n\n- **Core Kubernetes resources** (Deployment, Service, ConfigMap, …): typed via [kubernetes-json-schema](https://github.com/yannh/kubernetes-json-schema) **when the relevant schema is present in the kubeconform disk cache**\n- **CRDs** (FluxCD, cert-manager, …): typed via the [CRDs-catalog](https://github.com/datreeio/CRDs-catalog) **when their schemas are present in the kubeconform disk cache**\n- **Resources without a cached schema** (including core kinds or CRDs whose schemas have not yet been cached): all bare `${VAR}` expand to `\"placeholder\"` (string)\n\n> [!NOTE]\n> Placeholder type inference reads schemas **only from the local kubeconform cache** — it does not itself make any network requests while deciding how to type `${VAR}` placeholders.\n> Kubeconform may still download missing schemas from its configured remote schema locations on a cache miss (typically the first time it sees a given kind), and then caches them under the same directory for subsequent validations.\n\n## Practical Guidance\n\n### Avoid False Validation Failures\n\nIf `workload validate` reports a type error for a field that uses `${VAR}` without a default, add a meaningful default of the correct type:\n\n```yaml\n# Before — bare ${VAR} expands to \"placeholder\" (string), fails integer validation\nspec:\n replicas: ${REPLICA_COUNT}\n\n# After — default 2 is correctly typed as an integer\nspec:\n replicas: ${REPLICA_COUNT:-2}\n```\n\n### Verify Your Defaults Are Well-Typed\n\nWhen using `${VAR:-default}`, ensure the default value matches the field's expected type. Incorrect defaults will cause validation failures even if the env var is always set at runtime:\n\n```yaml\n# This will fail validation: \"2\" is a string, but replicas expects an integer\nspec:\n replicas: ${REPLICA_COUNT:-\"2\"}\n\n# Correct: unquoted numeric default\nspec:\n replicas: ${REPLICA_COUNT:-2}\n```\n\n### Skip Validation for Specific Kinds\n\n`workload validate` checks each resource against its JSON schema from the [CRDs-catalog](https://github.com/datreeio/CRDs-catalog). When a CRD's catalog schema is **stale or missing**, kubeconform can reject otherwise-valid manifests — for example flagging a newer field as `additional properties ... not allowed`. (Kubernetes `Secret`s are already skipped by default to avoid SOPS-related failures.)\n\nSkip such kinds with the `--skip-kinds` flag:\n\n```bash\nksail workload validate --skip-kinds Coroot,SealedSecret\n```\n\n…or, so it also applies in CI (the `ksail-cluster` action with `validate: \"true\"`), via `ksail.yaml`:\n\n```yaml\nspec:\n workload:\n validation:\n skipKinds:\n - Coroot\n```\n\nThe flag and the configured kinds are merged. Skip only the kinds whose schema is genuinely unavailable — skipped resources are not validated at all.\n\n### Use `workload validate` Before Pushing\n\nCombine `workload validate` with `workload push` in your workflow to catch schema errors before they enter the GitOps pipeline:\n\n```bash\n# Validate first, then push if clean\nksail workload validate && ksail workload push\n```\n\nThis is the same pattern the `ksail-cluster` composite GitHub Action uses when `validate: \"true\"` is set. See [PR Preview Clusters](/guides/pr-preview-clusters/) for the full CI/CD workflow.\n\n### Multi-Environment Validation\n\nUse `--config` to validate against the settings of a specific environment:\n\n```bash\n# Validate against staging schema/constraints\nksail --config ksail.staging.yaml workload validate\n\n# Validate against production\nksail --config ksail.prod.yaml workload validate\n```\n\nSee [Multi-Environment Workflows](/guides/multi-environment/) for how to structure per-environment config files.\n\n## Supported Substitution Syntax\n\nKSail supports the standard Flux postBuild variable syntax:\n\n| Syntax | Behavior during validation |\n|--------|---------------------------|\n| `${VAR}` | Typed placeholder (schema-derived) |\n| `${VAR:-default}` | `default` value, coerced to schema type |\n| `${VAR:=default}` | `default` value, coerced to schema type |\n| `${VAR}` in mixed text | Replaced with `\"placeholder\"` (string) |\n\nOther Flux substitution forms (e.g., shell-style `$VAR` without braces, `$(VAR)` command substitution) are **not** expanded by KSail and are left as-is.\n" diff --git a/pkg/svc/installer/clusterautoscaler/installer.go b/pkg/svc/installer/clusterautoscaler/installer.go index a767f2239e..d2f52da99c 100644 --- a/pkg/svc/installer/clusterautoscaler/installer.go +++ b/pkg/svc/installer/clusterautoscaler/installer.go @@ -148,6 +148,18 @@ type chartExtraArgs struct { // see no values drift. CapacityBufferControllerEnabled bool `json:"capacity-buffer-controller-enabled,omitempty"` CapacityBufferPodInjectionEnabled bool `json:"capacity-buffer-pod-injection-enabled,omitempty"` + // IgnoreDaemonsetsUtilization drops DaemonSet pods from a node's utilization + // when the autoscaler evaluates it for scale-down (upstream + // --ignore-daemonsets-utilization). omitempty keeps it out of the rendered + // values unless enabled, so existing releases see no values drift. + IgnoreDaemonsetsUtilization bool `json:"ignore-daemonsets-utilization,omitempty"` + // SkipNodesWithLocalStorage and SkipNodesWithSystemPods mirror the upstream + // flags of the same name (both default true). They are pointers so a nil + // (unset) value leaves the flag out of the rendered values — inheriting the + // autoscaler default — while an explicit true/false is rendered verbatim + // (omitempty drops only the nil pointer, never a non-nil *bool to false). + SkipNodesWithLocalStorage *bool `json:"skip-nodes-with-local-storage,omitempty"` + SkipNodesWithSystemPods *bool `json:"skip-nodes-with-system-pods,omitempty"` // KubeAPIContentType forces the autoscaler's Kubernetes client to negotiate the // given content type. capacity-buffers require application/json: the CapacityBuffer // controller's client would otherwise negotiate protobuf (the autoscaler default for @@ -281,13 +293,16 @@ func buildChartValues( CloudProvider: "hetzner", AutoscalingGroups: groups, ExtraArgs: chartExtraArgs{ - Expander: expandersToHelmValue(cfg.Expander), - ScaleDownUnneededTime: scaleDownTime, - MaxNodesTotal: cfg.MaxNodesTotal, - ScaleDownAfterAdd: "5m", - ScaleDownAfterDelete: "2m", - OkTotalUnreadyCount: defaultOkTotalUnreadyCount, - V: "4", + Expander: expandersToHelmValue(cfg.Expander), + ScaleDownUnneededTime: scaleDownTime, + MaxNodesTotal: cfg.MaxNodesTotal, + ScaleDownAfterAdd: "5m", + ScaleDownAfterDelete: "2m", + OkTotalUnreadyCount: defaultOkTotalUnreadyCount, + V: "4", + IgnoreDaemonsetsUtilization: cfg.IgnoreDaemonsetsUtilization, + SkipNodesWithLocalStorage: cfg.SkipNodesWithLocalStorage, + SkipNodesWithSystemPods: cfg.SkipNodesWithSystemPods, }, ExtraEnv: extraEnv, ExtraEnvSecrets: buildExtraEnvSecrets(), diff --git a/pkg/svc/installer/clusterautoscaler/installer_test.go b/pkg/svc/installer/clusterautoscaler/installer_test.go index 1295ee3470..61c86890a2 100644 --- a/pkg/svc/installer/clusterautoscaler/installer_test.go +++ b/pkg/svc/installer/clusterautoscaler/installer_test.go @@ -649,6 +649,113 @@ func TestClusterAutoscalerInstaller_ValuesYaml_MaxNodesTotalOmittedWhenZero(t *t require.NoError(t, err) } +// TestClusterAutoscalerInstaller_ValuesYaml_IgnoreDaemonsetsUtilization verifies +// that the ignore-daemonsets-utilization extraArg is rendered only when the knob +// is enabled, and omitted (upstream default) otherwise so existing releases see +// no values drift. +func TestClusterAutoscalerInstaller_ValuesYaml_IgnoreDaemonsetsUtilization(t *testing.T) { + t.Parallel() + + t.Run("enabled renders the flag", func(t *testing.T) { + t.Parallel() + assertAutoscalerValuesYaml(t, + v1alpha1.NodeAutoscalerConfig{IgnoreDaemonsetsUtilization: true}, + []string{"ignore-daemonsets-utilization: true"}, nil) + }) + + t.Run("disabled omits the flag", func(t *testing.T) { + t.Parallel() + assertAutoscalerValuesYaml(t, + v1alpha1.NodeAutoscalerConfig{IgnoreDaemonsetsUtilization: false}, + nil, []string{"ignore-daemonsets-utilization"}) + }) +} + +// assertAutoscalerValuesYaml installs with cfg and asserts the rendered chart +// ValuesYaml contains every wantContain substring and none of the wantOmit ones. +func assertAutoscalerValuesYaml( + t *testing.T, + cfg v1alpha1.NodeAutoscalerConfig, + wantContain, wantOmit []string, +) { + t.Helper() + + client := helm.NewMockInterface(t) + client.EXPECT(). + GetReleaseStorageLabels(mock.Anything, mock.Anything, mock.Anything). + Return(nil, nil) + expectAddRepository(t, client, nil) + client.EXPECT(). + InstallOrUpgradeChart(mock.Anything, mock.MatchedBy(func(spec *helm.ChartSpec) bool { + for _, want := range wantContain { + assert.Contains(t, spec.ValuesYaml, want) + } + + for _, omit := range wantOmit { + assert.NotContains(t, spec.ValuesYaml, omit) + } + + return true + })). + Return(nil, nil) + + installer, err := clusterautoscalerinstaller.NewInstaller( + client, 5*time.Second, cfg, false, true, true, + ) + require.NoError(t, err) + require.NoError(t, installer.Install(context.Background())) +} + +// TestClusterAutoscalerInstaller_ValuesYaml_SkipNodesFlags verifies that the +// skip-nodes-with-local-storage / skip-nodes-with-system-pods pointer knobs are +// omitted when nil (inheriting the upstream default true) and rendered verbatim +// when set to an explicit true or false. +func TestClusterAutoscalerInstaller_ValuesYaml_SkipNodesFlags(t *testing.T) { + t.Parallel() + + ptr := func(b bool) *bool { return &b } + + tests := []struct { + name string + localStore, systemPods *bool + wantContain, wantOmit []string + }{ + { + name: "nil omits both flags", + wantOmit: []string{"skip-nodes-with-local-storage", "skip-nodes-with-system-pods"}, + }, + { + name: "explicit false renders both", + localStore: ptr(false), + systemPods: ptr(false), + wantContain: []string{ + "skip-nodes-with-local-storage: false", + "skip-nodes-with-system-pods: false", + }, + }, + { + name: "explicit true renders both", + localStore: ptr(true), + systemPods: ptr(true), + wantContain: []string{ + "skip-nodes-with-local-storage: true", + "skip-nodes-with-system-pods: true", + }, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + + assertAutoscalerValuesYaml(t, v1alpha1.NodeAutoscalerConfig{ + SkipNodesWithLocalStorage: test.localStore, + SkipNodesWithSystemPods: test.systemPods, + }, test.wantContain, test.wantOmit) + }) + } +} + // TestClusterAutoscalerInstaller_ValuesYaml_CapacityBuffers verifies that // enabling capacityBuffers renders the two feature flags, the buffer // controller's RBAC rules (CapacityBuffer CRs plus the Deployment and diff --git a/schemas/ksail-config.schema.json b/schemas/ksail-config.schema.json index b9bffcfe7a..718026f0f9 100644 --- a/schemas/ksail-config.schema.json +++ b/schemas/ksail-config.schema.json @@ -535,6 +535,18 @@ "capacityBuffers": { "type": "boolean", "description": "Enable the Cluster Autoscaler capacity-buffers feature: KSail installs the CapacityBuffer CRD (capacitybuffers.autoscaling.x-k8s.io) and enables the buffer controller and pod-injection flags. CapacityBuffer resources then reserve scale-up headroom as virtual (pod-less) chunks simulated in autoscaler memory — a native replacement for low-priority balloon-pod overprovisioning. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true)" + }, + "ignoreDaemonsetsUtilization": { + "type": "boolean", + "description": "Exclude DaemonSet pods from a node's resource-utilization calculation when the Cluster Autoscaler decides whether a node is unneeded (upstream --ignore-daemonsets-utilization, off by default). Enable this when DaemonSets are system components (CNI, CSI, observability, security agents) whose per-node overhead should not keep an otherwise-empty node above the scale-down utilization threshold. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true)." + }, + "skipNodesWithLocalStorage": { + "type": "boolean", + "description": "Whether the Cluster Autoscaler refuses to scale down a node running a pod with local storage (emptyDir, hostPath, or a local PersistentVolume). Upstream --skip-nodes-with-local-storage defaults to true. Set false to let nodes whose only local storage is ephemeral scratch (emptyDir) be removed — required for overflow nodes to drain, since emptyDir is pervasive. Ensure durable data lives on real PVCs first. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true)." + }, + "skipNodesWithSystemPods": { + "type": "boolean", + "description": "Whether the Cluster Autoscaler refuses to scale down a node running a non-DaemonSet kube-system pod that has no controlling PodDisruptionBudget. Upstream --skip-nodes-with-system-pods defaults to true. Set false to let overflow nodes hosting movable system Deployments drain — confirm those components tolerate eviction and carry PDBs first. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true)." } }, "additionalProperties": false, diff --git a/web/ui/src/generated/ksail-config.ts b/web/ui/src/generated/ksail-config.ts index 13982e4cb8..da51b97592 100644 --- a/web/ui/src/generated/ksail-config.ts +++ b/web/ui/src/generated/ksail-config.ts @@ -265,6 +265,18 @@ export interface KSailClusterConfiguration { * Enable the Cluster Autoscaler capacity-buffers feature: KSail installs the CapacityBuffer CRD (capacitybuffers.autoscaling.x-k8s.io) and enables the buffer controller and pod-injection flags. CapacityBuffer resources then reserve scale-up headroom as virtual (pod-less) chunks simulated in autoscaler memory — a native replacement for low-priority balloon-pod overprovisioning. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true) */ capacityBuffers?: boolean; + /** + * Exclude DaemonSet pods from a node's resource-utilization calculation when the Cluster Autoscaler decides whether a node is unneeded (upstream --ignore-daemonsets-utilization, off by default). Enable this when DaemonSets are system components (CNI, CSI, observability, security agents) whose per-node overhead should not keep an otherwise-empty node above the scale-down utilization threshold. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true). + */ + ignoreDaemonsetsUtilization?: boolean; + /** + * Whether the Cluster Autoscaler refuses to scale down a node running a pod with local storage (emptyDir, hostPath, or a local PersistentVolume). Upstream --skip-nodes-with-local-storage defaults to true. Set false to let nodes whose only local storage is ephemeral scratch (emptyDir) be removed — required for overflow nodes to drain, since emptyDir is pervasive. Ensure durable data lives on real PVCs first. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true). + */ + skipNodesWithLocalStorage?: boolean; + /** + * Whether the Cluster Autoscaler refuses to scale down a node running a non-DaemonSet kube-system pod that has no controlling PodDisruptionBudget. Upstream --skip-nodes-with-system-pods defaults to true. Set false to let overflow nodes hosting movable system Deployments drain — confirm those components tolerate eviction and carry PDBs first. Ignored unless the node autoscaler is installed (Talos on Hetzner with enabled: true). + */ + skipNodesWithSystemPods?: boolean; }; }; /**