Infrastructure as Code

Export projects and apps as manifests, preview changes, apply them, and tear them down.

Infrastructure as Code is opt-in and off by default for each project. Check with stackblaze status and switch it with stackblaze projects iac on|off; plan, apply and destroy refuse when it is off. export works either way.

The manifests are YAML documents with apiVersion: stackblaze.com/v1 and kind StackBlazeProject or StackBlazeApp, in the format stackblaze export writes: one file per project (<project>.project.yaml) and one per app (<project>.<environment>.<app>.app.yaml). A file can also hold several documents separated by ---. An app document names its project and environment with metadata.pipeline and metadata.phase, or with metadata.project and metadata.environment.

A path can be a file or a directory (all .yaml and .yml files, recursively). Projects are applied before their apps and destroyed after them. This is separate from the stackblaze.yaml blueprint file.

Compatibility: manifests written by CLI versions before 1.0.0 (apiVersion: application.kubero.dev/v1alpha1, kinds KuberoPipeline and KuberoApp) are still accepted by plan, apply and destroy.

stackblaze status

Checks that the API is reachable with your credentials and reports whether Infrastructure as Code is enabled. Pass --project (or run in a linked directory) to check one project. With an app in scope it also shows that app's state, for example paused. Exits 0 whether IaC is on or off.

usage

stackblaze status

Also accepts the scope flags (-p, --project, -e, --env, -a, --app) and the output flags (-o, --output, --json), plus --token, --api-url and --org. Common flags

Examples

terminal

stackblaze status -p shop

stackblaze export

Writes one YAML file per project (<project>.project.yaml) and per app (<project>.<environment>.<app>.app.yaml) that plan and apply accept. Secret values are masked as ******** unless you pass --reveal.

usage

stackblaze export [--out <dir>] [-p <project>] [--all] [--reveal]

Masking covers variable values (as in variables list), shared add-on credentials and registry passwords. plan and apply read ******** as "keep the current value", so masked files are safe to commit and apply. With --reveal (or --include-secrets) the values are written in plain text; review those files before committing.

The project's Infrastructure as Code switch is not exported, and apply ignores it in a manifest; change it with stackblaze projects iac.

Platform-injected variables are left out of the app files unless you pass --all. When the output directory still has a <project>.pipeline.yaml from an older CLI, export replaces it with <project>.project.yaml.

Flag	Description
`--out <dir>`	Output directory (default `stackblaze`)
`-p, --project <name>`	Export one project (default: all you can see)
`--all`	Keep platform-injected variables in the app files
`--reveal, --include-secrets`	Write secret values in plain text (default: masked as `********`)

Also accepts the output flags (-o, --output, --json), plus --token, --api-url and --org. Common flags

Examples

terminal

stackblaze export --out ./infra -p shop
# ./infra/shop.project.yaml
# ./infra/shop.production.web.app.yaml

stackblaze plan

Compares the manifests with what is live and prints what apply would create or update, with a diff for updates. Nothing is changed.

usage

stackblaze plan <path>

Also accepts the output flags (-o, --output, --json), plus --token, --api-url and --org. Common flags

Examples

terminal

stackblaze plan ./stackblaze

stackblaze apply

Creates or updates every project and app declared in the manifests, projects first. It never deletes. Exits 1 if any resource failed.

usage

stackblaze apply <path> [--continue-on-error]

Flag	Description
`--continue-on-error`	Keep going after a resource fails (default: stop at the first failure)

Also accepts the output flags (-o, --output, --json), plus --token, --api-url and --org. Common flags

Examples

terminal

stackblaze plan ./stackblaze && stackblaze apply ./stackblaze

stackblaze destroy

Deletes every resource declared in the manifests, apps first, then projects. Lists what will be deleted and asks you to type yes unless -y. Exits 1 if any deletion failed.

usage

stackblaze destroy <path> [-y]

Flag	Description
`-y, --yes`	Do not prompt

Also accepts the output flags (-o, --output, --json), plus --token, --api-url and --org. Common flags

Examples

terminal

stackblaze destroy ./stackblaze -y

← Projects and apps AI agent and MCP →