stagesetctl apply

Talks about: cli, and stages

apply renders a StageSet’s stages with the controller’s resolve→fetch→build path and server-side-applies the resulting objects in stage order, under the controller’s field manager and owner labels — so a later reconcile sees no drift. Preview first with diff .

apply materializes the manifests only. It does not run stage actions , migrations , update-window gating, ready checks (beyond --wait), or pruning — those belong to the controller’s reconcile loop. When a controller manages this StageSet it stays the source of truth and reconciles on its own schedule; reach for apply in cluster-free workflows (no controller installed) and break-glass.

stagesetctl apply NAME [flags]

Flag	Default	Description
`--stage`	(all)	Apply only the named stage(s); repeatable.
`--source-dir`	(none)	Use a local artifact tree as `[STAGE=]PATH`; repeatable. Skips the cluster fetch.
`--as-tenant`	`false`	Apply each stage as its effective `serviceAccountName` — the identity the controller applies with (the stage’s own, else `spec.serviceAccountName`). Reads (source resolve, `substituteFrom`) always use your credentials, mirroring the controller, which reads as itself (see multi-cluster and tenancy ).
`--no-cross-namespace-refs`	`false`	Reject a stage `sourceRef` that targets another namespace, matching a controller run with `--no-cross-namespace-refs`, so the preview fails the way the controller would.
`--wait`	`false`	Wait for each stage’s objects to become ready before applying the next stage.
`--timeout`	`5m`	Per-stage readiness timeout with `--wait`.

apply needs apply/patch RBAC for every object it writes. With --as-tenant that RBAC is the tenant ServiceAccount’s, exactly as a reconcile applies — each stage under its own effective serviceAccountName.

Example

stagesetctl diff payments      # preview
stagesetctl apply payments     # then apply

stage "infrastructure":
  created ConfigMap/payments/db-config
  configured Deployment/payments/postgres
stage "application":
  unchanged ConfigMap/payments/web-config
  configured Deployment/payments/web
applied 4 object(s) across 2 stage(s)

Because apply does not prune, removing an object from a stage’s source does not delete it from the cluster — only the controller’s inventory prune does that. Every applied object carries the stages.metio.wtf/stage label, so without a controller you can find and remove a stage’s objects yourself:

kubectl --namespace payments get all,configmap,secret --selector stages.metio.wtf/stage=application