Skip to content

Conversation

@Jaisheesh-2006
Copy link
Contributor

Description

This PR adds a new guide to the kpt book detailing how to use kpt in CI/CD workflows. The guide covers:

  • The distinction between Developer (authoring) and CI (rendering/actuating) responsibilities.
  • The standard render + validate workflow.
  • Best practices for handling secrets and gated live apply steps.
  • A concrete example using Google Cloud Build.
  • Common anti-patterns to avoid.

Motivation

kpt is frequently used in CI environments, but there was no dedicated documentation explaining the recommended patterns. This guide aims to clarify best practices, specifically regarding the "Configuration as Data" philosophy, and to help users avoid common mistakes like mutating packages during CI runs.

Fixes

Fixes #3756

@netlify
Copy link

netlify bot commented Jan 24, 2026

Deploy Preview for kptdocs ready!

Name Link
🔨 Latest commit a0feca0
🔍 Latest deploy log https://app.netlify.com/projects/kptdocs/deploys/697b1e376928df00081bd04a
😎 Deploy Preview https://deploy-preview-4369--kptdocs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copy link
Contributor

@CsatariGergely CsatariGergely left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this massive documentation pr, looks very good for me.
I would like to get a review from someone who has a better understanding of kpt architecture and philosophy than myself.

weight: 90
---

<!--
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We do not need a manual ToC. I would recommend to delete this even if this is only a comment. It will be dated and non maintained with time.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @CsatariGergely , i have just made the required changes and commited them

4. Observe results and fail fast if any checks fail.
5. Optionally apply the rendered resources when explicit deployment gates are satisfied.

![img](/images/ci-kpt-workflow.png)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you share the source of this figure? Add the editable version to the same /images/ folder using the same name, but proper extension, like ci-kpt-workflow.svg.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just made the required changes and commited them


### Prerequisites

Since kpt functions run as containers, your CI environment must have access to a container runtime (for example,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would rather promote a container runtime which does not need elevation, like Podman.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a short note on why Podman is preferred as well

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file should not take up almost 6 MB and I can't find a reference to it, is this unused?

Copy link
Contributor Author

@Jaisheesh-2006 Jaisheesh-2006 Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @mozesl-nokia , in the latest commit, i deleted that image and pushed its svg version, so at the end it will be squashed and merged right. The png version is unused

Comment on lines +159 to +165
```shell
$ export API_TOKEN=$(vault read -field=token secret/my-api)
```

```shell
$ kpt fn render
```

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe these two can be in the same code block?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will update them and push the new commit

Copy link
Contributor Author

@Jaisheesh-2006 Jaisheesh-2006 Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @mozesl-nokia I was just reviewing the kpt docs style guide, and I noticed it mentions that shell commands should ideally be in shell code blocks with a single command prefixed by $

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this a common convention? I'm not a fan tbh as it means you can't just copy and past the cmd to a terminal without stripping the $
Or am I wrong??

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with @efiacor , whether the convention says it or not, I prefer the $ character not to be there because then if you copy/paste a command into the terminal (especially if its a long one), you end up having to tab back to the beginning of the command to delete the $

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @efiacor, you are absolutely right from a usability perspective. As far as I know, the $ is a standard convention for Unix documentation, which is why I stuck to the current style guide for this PR. I am happy to change it if we decide to go that route, though we would likely need to update the style guide as well to maintain consistency

Comment on lines +172 to +178
```shell
$ echo "$KUBECONFIG_CONTENT" > /tmp/kubeconfig
```

```shell
$ KUBECONFIG=/tmp/kubeconfig kpt live apply
```

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe these two can be in the same code block?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will update them and push the new commit

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @mozesl-nokia I was just reviewing the kpt docs style guide, and I noticed it mentions that shell commands should ideally be in shell code blocks with a single command prefixed by $

Comment on lines +159 to +165
```shell
$ export API_TOKEN=$(vault read -field=token secret/my-api)
```

```shell
$ kpt fn render
```
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

user guide for using kpt in a CI environments such as cloudbuild

5 participants