render

Render Kubernetes manifests from nyl components and templates.

Synopsis

nyl render [OPTIONS] <FILE>

Description

The render command generates Kubernetes manifests and writes final YAML to stdout. It never connects to Kubernetes. With --target, a Release renders as render-tree publishes it for its Argo CD Application, including managed Namespaces; resources without a namespace keep none. See Rendering Pipeline for the behavior render, diff, and apply share.

Arguments

• <FILE> - Path to the manifest file to render (required)

Options

Common Options

• --only-source-kind <KIND> - Filter top-level resources by kind (e.g., ConfigMap, Deployment) or by apiVersion/kind (e.g., apps/v1/Deployment) before expansion.
• --only-kind <KIND,...> - Filter final rendered manifests to only include specific kinds (post-render).
• --exclude-kind <KIND,...> - Filter final rendered manifests to exclude specific kinds (post-render, mutually exclusive with --only-kind).
• --target <TARGET> - DeploymentTarget whose Cluster, values, and Kubernetes capabilities are used for rendering. Optional for base rendering.
• --input <NAME=JSON> - Set one Release input, for example --input replicas=3 or --input image='"registry.example.com/api@sha256:…"'. Repeatable; wins over --inputs and target bindings.
• --inputs <FILE> - Read Release inputs from a YAML or JSON object.
• --application-group <NAME> - With --target, apply this ApplicationGroup’s bindings when the Release file is not in exactly one selected group’s local source.
• --defaults-only - With --target, apply no target binding: only Release defaults and overrides.
• --release-only - Settle the Release alone instead of taking it from the compiled target. Faster for large targets, but namespace conflicts with the target’s other Releases go undetected.
• --allow-secret-inputs - Let the project secrets provider and NYL_* environment variables affect the output, as for the tree commands. Without it, templates see neither.
• --max-depth <MAX_DEPTH> - Maximum evaluation depth for recursive resource expansion (default: 10)
• --track-parent - Track parent resource information in annotations
• --refresh - Bypass cached rendering results and replace successful entries.
• --no-cache - Perform no persistent cache reads or writes.

Source and Capability Options

• --offline - Resolve Git charts from cached refs and read fromPublication Release inputs at the cached publication branch head, as with render-tree --offline.
• --kube-version <KUBE_VERSION> - Kubernetes version for a targetless render of Helm charts. With --target, the Cluster’s committed capabilities apply.
• --kube-api-versions <KUBE_API_VERSIONS> - Kubernetes API versions for a targetless render, comma-separated or repeated.
• --context - Deprecated and ignored, since render never connects to Kubernetes; see Deprecations.

Examples

Output

With --target, the Release’s resources come out as its Argo CD Application deploys them: the ConfigMap and Deployment keep no namespace, so the Application’s destination namespace web applies, and the managed Namespace awaits confirmation before it is pruned. Render statistics go to stderr.

$ nyl render --target production applications/web/release.yaml
apiVersion: v1
data:
  greeting: hello
kind: ConfigMap
metadata:
  name: web-config
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - image: nginx:1.27
        name: web
---
apiVersion: v1
kind: Namespace
metadata:
  annotations:
    argocd.argoproj.io/sync-options: Delete=confirm,Prune=confirm
  name: web

Basic Rendering

# Render a manifest file
nyl render manifest.yaml

# Render with a configured target
nyl render --target production manifest.yaml

# Filter top-level input resources
nyl render --only-source-kind ConfigMap manifest.yaml

# Filter by full apiVersion/kind
nyl render --only-source-kind apps/v1/Deployment manifest.yaml

# Filter final rendered output kinds
nyl render --only-kind Deployment,Service manifest.yaml

Capabilities and Cached Sources

# Targetless render of Helm charts with explicit Kubernetes capabilities
nyl render --kube-version 1.30 --kube-api-versions v1,apps/v1 manifest.yaml

# Use the Cluster's committed capabilities and only cached Git refs
nyl render --target production --offline manifest.yaml

Advanced Options

# Limit recursive expansion depth
nyl render --max-depth 5 manifest.yaml

# Track parent resources in annotations
nyl render --track-parent manifest.yaml

# Force source resolution and manifest expansion to run again
nyl render --refresh manifest.yaml

# Combine options
nyl render --target staging --max-depth 3 --track-parent manifest.yaml

Notes

• A Release that declares spec.inputs renders with the same values as render-tree: overrides, then the target binding of the selected ApplicationGroup whose source contains the file, then defaults. See Release inputs. nyl diff and nyl apply accept the same input options.

• Nyl accepts one entry file. Release.spec.include can attach additional relative manifest files and glob matches; directory arguments are not supported.

• Expansion failures report the originating manifest path, document number, and recursive Component or HelmChart resource chain. This provenance is internal and is not added to rendered Kubernetes objects.

• Bundle and Helm rendering use the shared content-addressed render cache. diff and apply reuse the same desired-manifest artifacts before performing their live-cluster operations.

• See Rendering Pipeline for the Release’s Application, namespaces, and filter semantics.

Manifest validation

Use --validate to run project-configured validators. See Manifest validation for automatic validation, captured CRD schemas, inherited Cluster contracts, and offline schema vendoring. Validation failures return a nonzero exit status while still emitting manifests to stdout for inspection. Diagnostics go to stderr.