ReferenceDeploymentTarget

DeploymentTarget

k8s.gitops.nyl/v1

Kubernetes GitOps Resources · Download JSON Schema · Usage guide

Binds a Kubernetes Cluster to render values, ApplicationGroup selection, and Git publication coordinates.

A target owns one independently renderable publication slice. It is compiler configuration and does not represent a general infrastructure environment.

When needed

Required for target-aware Kubernetes GitOps operations. It supplies workload Cluster selection and publication coordinates.

If omitted

Operations requiring a target fail when none are declared. If exactly one target exists, Nyl selects it without --target; with multiple targets, select one explicitly. Target selection never creates a DeploymentTarget.

Example

apiVersion: k8s.gitops.nyl/v1
kind: DeploymentTarget
metadata:
  name: production
spec:
  argocdRef:
    name: primary
  clusterRef:
    name: primary
  publication:
    pathPrefix: targets/production
    repositoryRef:
      name: deploy
    revision: deploy

Fields

Required means required within the containing object. Optional and nullable are distinct; contextual defaults and requirements are explained with each field.

Unknown fields are rejected.

apiVersion

Required · string

API group and version defining this resource.

const: "k8s.gitops.nyl/v1"

kind

Required · string

Resource kind within the API group.

const: "DeploymentTarget"

metadata

Required · object

Resource identity and metadata.

Unknown fields are rejected.

metadata.labels

Optional · object

Literal labels used for organization and target selection.

metadata.labels[key]

Optional · string

metadata.name

Required · string

Project-local identity, validated by the resource kind; remains static during discovery.

spec

Required · object

Configuration for this resource.

Unknown fields are rejected.

spec.applicationGroupSelector

Optional · object

Matches literal ApplicationGroup metadata labels before rendering their specs. An empty selector matches all groups.

default: {}

Unknown fields are rejected.

spec.applicationGroupSelector.matchLabels

Optional · object

Exact label matches, combined with AND. An empty map selects every ApplicationGroup.

spec.applicationGroupSelector.matchLabels[key]

Optional · string

spec.argocdRef

Optional · object or null

Project-local ArgoCDInstance. Required when any explicit instance exists; otherwise Nyl uses a target-local instance in the workload Cluster and argocd namespace.

Unknown fields are rejected.

spec.argocdRef.name

Required · string

Project-local name of the referenced resource; its kind and API group are determined by the containing field.

spec.catalogApplication

Optional · object

Target-specific catalog Application settings. Unspecified policy inherits from the ArgoCDInstance.

default: {"enabled":true}

Unknown fields are rejected.

spec.catalogApplication.annotations

Optional · object

Annotations added to generated Applications.

spec.catalogApplication.annotations[key]

Optional · string

spec.catalogApplication.applicationDeletionPolicy

Optional · string or null

Application deletion override; inherits the instance default when omitted.

Allowed values:

Value	Meaning
`"Foreground"`	Cascade deletion in the foreground using the Argo CD resources finalizer.
`"Background"`	Cascade deletion in the background using the Argo CD background finalizer.
`"Orphan"`	Omit the finalizer and leave workload resources in place.
`null`

spec.catalogApplication.enabled

Optional · boolean

Whether to generate a catalog Application recursively sourcing _nyl/catalog.

default: true

spec.catalogApplication.labels

Optional · object

Labels added to generated Applications.

spec.catalogApplication.labels[key]

Optional · string

spec.catalogApplication.name

Optional · string or null

Catalog Application name. Defaults to the target name; names must be unique within the Argo CD instance.

spec.catalogApplication.project

Optional · string or null

Argo CD project override; inherits the instance catalog default when omitted.

spec.catalogApplication.selfPrunePolicy

Optional · string or null

Self-pruning override; inherits the instance default when omitted.

Allowed values:

Value	Meaning
`"Automatic"`	Allow pruning or deletion without additional restrictions.
`"Confirm"`	Require confirmation through the Argo CD Prune or Delete sync option.
`"Retain"`	Set the Argo CD Prune or Delete sync option to false.
`null`

spec.catalogApplication.syncPolicy

Optional · object or null

Catalog synchronization override; inherits the instance default when omitted.

Unknown fields are rejected.

spec.catalogApplication.syncPolicy.automated

Optional · object or null

Presence enables automated synchronization unless enabled is false.

Unknown fields are rejected.

spec.catalogApplication.syncPolicy.automated.enabled

Optional · boolean or null

Whether automated sync is enabled. Omission enables it when the automated block is present.

spec.catalogApplication.syncPolicy.automated.prune

Optional · boolean

Allow Argo CD to prune resources removed from desired manifests.

default: false

spec.catalogApplication.syncPolicy.automated.selfHeal

Optional · boolean

Allow Argo CD to repair live drift automatically.

default: false

spec.catalogApplication.syncPolicy.syncOptions

Optional · array

Argo CD sync options. Generated Applications add ApplyOutOfSyncOnly=true and ServerSideApply=true unless an option with the same key is supplied.

spec.catalogApplication.syncPolicy.syncOptions[]

Required · string

spec.clusterRef

Optional · object or null

Project-local workload Cluster. Defaults to the target name when omitted.

Unknown fields are rejected.

spec.clusterRef.name

Required · string

Project-local name of the referenced resource; its kind and API group are determined by the containing field.

spec.publication

Required · object

Git repository, revision, and path prefix owned by this target. Targets on the same repository revision must have disjoint prefixes.

Unknown fields are rejected.

Choose exactly one variant:

repositoryRef — Publishes to the coordinates of the named GitRepository.
repository — Publishes to the inline coordinates declared here.

spec.publication.pathPrefix

Optional · string or null

Normalized repository-relative output prefix. Defaults to the target name.

spec.publication.repository

Optional · object or null

Inline Git coordinates. Exactly one of repositoryRef and repository is required.

Unknown fields are rejected.

spec.publication.repository.publishURL

Optional · string or null

Optional Git write URL. Publication uses repoURL when omitted.

spec.publication.repository.repoURL

Required · string

Credential-free Git read URL used by renderers and generated Applications.

spec.publication.repositoryRef

Optional · object or null

Project-local GitRepository identity in gitops.nyl/v1. Exactly one of repositoryRef and repository is required.

Unknown fields are rejected.

spec.publication.repositoryRef.name

Required · string

Project-local name of the referenced resource; its kind and API group are determined by the containing field.

spec.publication.revision

Required · string

Publication branch or revision for this target.

spec.releaseInputs

Optional · object

Release input bindings, keyed by <applicationGroup>/<release> and then input name. Each binding sets exactly one source and replaces the Release default whole. Keys of selected but disabled groups are ignored; other keys must name a rendered Release and inputs it declares. Not visible to templates as target.spec.releaseInputs.

spec.releaseInputs[key]

Optional · object

spec.releaseInputs[key][key]

Optional · object

Where one Release input’s value comes from. Set exactly one field.

Unknown fields are rejected.

Choose exactly one variant:

value — Binds an inline literal value.
fromFile — Reads the value from a YAML or JSON file of this repository.
fromGit — Reads the value from a file of a Git repository at a locked commit.
fromPublication — Reads the value from a state file in this target’s publication branch.
fromUnit — Reserved for orchestration: reads a recorded unit output or artifact field.
fromPromotion — Reserved for orchestration: reads a value recorded through a PromotionPath.

spec.releaseInputs[key][key].fromFile

Optional · object or null

A YAML or JSON file of this repository.

Unknown fields are rejected.

spec.releaseInputs[key][key].fromFile.path

Required · string

File path relative to the directory containing nyl.toml, or from the Git worktree root with a leading /. The file must contain a single YAML or JSON document.

spec.releaseInputs[key][key].fromFile.pointer

Optional · string

JSON Pointer selecting the value inside the document; the whole document when empty.

spec.releaseInputs[key][key].fromGit

Optional · object or null

A YAML or JSON file of a Git repository at a locked commit.

Unknown fields are rejected.

Choose exactly one variant:

repositoryRef — Reads from the named GitRepository.
repository — Reads from the inline coordinates declared here.

spec.releaseInputs[key][key].fromGit.commit

Required · string

Full 40-character lowercase commit ID that is read, refreshed by nyl update source-locks.

spec.releaseInputs[key][key].fromGit.path

Required · string

Path in the repository. In this repository it follows the local path rule: relative to the directory containing nyl.toml, may begin with .. segments, or starts with / to name a path from the Git worktree root, and never leaves the worktree. In a remote repository it is relative to the checkout root, with an optional leading /.

spec.releaseInputs[key][key].fromGit.pointer

Optional · string

JSON Pointer selecting the value inside the document; the whole document when empty.

spec.releaseInputs[key][key].fromGit.repository

Optional · object or null

Inline repository coordinates to read from. Mutually exclusive with repositoryRef.

Unknown fields are rejected.

spec.releaseInputs[key][key].fromGit.repository.repoURL

Required · string

Git read URL. Source checkouts never publish to this repository.

spec.releaseInputs[key][key].fromGit.repositoryRef

Optional · object or null

Project-local gitops.nyl/v1 GitRepository to read from. Mutually exclusive with inline repository.

Unknown fields are rejected.

spec.releaseInputs[key][key].fromGit.repositoryRef.name

Required · string

Project-local name of the referenced resource; its kind and API group are determined by the containing field.

spec.releaseInputs[key][key].fromGit.revision

Required · string

Human-readable branch or tag that nyl update source-locks resolves.

spec.releaseInputs[key][key].fromPromotion

Optional · object or null

Reserved for orchestration: a value recorded through a PromotionPath. Rejected outside orchestrated execution.

Unknown fields are rejected.

spec.releaseInputs[key][key].fromPromotion.path

Optional · string or null

PromotionPath the value must come from.

spec.releaseInputs[key][key].fromPromotion.value

Required · string

Promoted value name, as declared by a PromotionPath.

spec.releaseInputs[key][key].fromPublication

Optional · object or null

A state file in this target’s publication branch, read at the publication base commit.

Unknown fields are rejected.

spec.releaseInputs[key][key].fromPublication.carryFileFromWorktree

Optional · string or null

Untracked working-tree file of this run, under the local path rule. When present, Nyl renders from it and writes its bytes to path in the publication commit; otherwise the base copy is written back. With carryFileFromWorktree, path is owned by this target.

spec.releaseInputs[key][key].fromPublication.path

Required · string

State file path relative to the target’s publication path prefix. It must lie outside every directory a generated Argo CD Application syncs: workload Release directories and _nyl.

spec.releaseInputs[key][key].fromPublication.pointer

Optional · string

JSON Pointer selecting the value inside the document; the whole document when empty.

spec.releaseInputs[key][key].fromUnit

Optional · object or null

Reserved for orchestration: a recorded unit output or artifact field. Rejected outside orchestrated execution.

Unknown fields are rejected.

spec.releaseInputs[key][key].fromUnit.artifact

Optional · string or null

Published artifact name. Set exactly one of output and artifact.

spec.releaseInputs[key][key].fromUnit.attestations

Optional · array

Required attestations.

spec.releaseInputs[key][key].fromUnit.attestations[]

Required · string

spec.releaseInputs[key][key].fromUnit.environment

Optional · string or null

Environment of the unit, for cross-environment references.

spec.releaseInputs[key][key].fromUnit.evidence

Optional · string or null

Required evidence level: published or attested.

spec.releaseInputs[key][key].fromUnit.kind

Optional · string or null

Expected artifact kind.

spec.releaseInputs[key][key].fromUnit.output

Optional · string or null

Declared output name. Set exactly one of output and artifact.

spec.releaseInputs[key][key].fromUnit.pointer

Optional · string or null

JSON Pointer inside the output or artifact.

spec.releaseInputs[key][key].fromUnit.unit

Required · string

Producing unit name.

spec.releaseInputs[key][key].value

Optional · any value

Inline literal value. DeploymentTargets are static, so it is never templated.

spec.values

Optional · object

Target values recursively overlaid on Cluster values and exposed as template inputs.

Additional keys may contain any value.