Skip to content
Documentation
Operate
Blueprints

Blueprints

When you want the whole tenant as one versioned, diffable document instead of many imperative calls, use a blueprint. It declares VPCs, clusters (with their add-ons), DNS zones + records, and buckets.

kubrain export   > tenant.yaml          # snapshot live resources as a blueprint
kubrain estimate --file tenant.yaml      # price the whole document
kubrain plan     --file tenant.yaml      # diff spec vs. live (read-only)
kubrain apply    --file tenant.yaml      # converge (additive by default)
kubrain apply    --file tenant.yaml --prune   # also delete undeclared resources

The workflow

  1. export snapshots current resources as an intent spec — only the fields you choose. Allocated IPs, versions, and cost are status and left out, so re-applying an unedited export is a no-op.
  2. plan diffs the document against live state, classifying each resource as create / update / delete / no-op. Read it and show it before applying.
  3. apply converges live state to the document. Default is additive (creates + updates, leaves undeclared resources alone). --prune also deletes resources absent from the document — destructive, confirm first.

Example 

version: 1
vpcs:
  - {name: prod-net, region: gra}
clusters:
  - name: shop
    vpc: prod-net
    tier: ha
    ram_gib: 16
    workers: 3
    k8s_version: v1.30.2
    addons:
      ingress-nginx: v1.15.1
      cert-manager:  v1.14.4
dns:
  - name: shop.example.com
    records:
      - {name: "@", type: A, ttl: 300, values: ["${cluster.shop.ingress_ip}"]}
      - {name: www, type: CNAME, ttl: 300, values: ["shop.example.com."]}
buckets:
  - {name: assets, region: gra, public: true}

Rules that matter

  • Runtime references. A record value can reference a cluster’s ingress IP with ${cluster.<name>.ingress_ip} — resolved at apply time; a value that isn’t resolvable yet defers and completes on a later apply.
  • In-place vs. replace. Changing workers, ram_gib, or k8s_version maps to scale / resize / upgrade. Changing tier or vpc is a replace and is refused — delete and recreate deliberately instead.
  • Managing add-ons. An explicit addons: {} means “manage add-ons: remove any not listed.” Omitting addons means “don’t manage add-ons on this cluster.”

See also

Alerting