Promoting configuration with keenauth config promote

keenauth config promote copies the configuration of one environment to another, for example from staging to production. It runs the same steps you would run by hand with config export, config plan and config apply, without writing the document to a file:

1. Exports the configuration document of the --from environment.
2. Creates a plan for that document in the --to environment.
3. Prints the diff: + create, ~ update, - delete; unchanged resources are only counted.
4. Applies the plan after you confirm.

The two environments may be in different regions. The regions never call each other: the document passes through your machine, in memory only.

Before you start

The command uses your dashboard sign-in, because it needs access to both environments. Sign in with keenauth login (see Signing in with keenauth login); you need a dashboard role in both environments that allows reading the configuration of the source and writing the configuration of the target. An API key belongs to one environment, so the command refuses to run while KEENAUTH_API_KEY is set and exits with code 2.

Usage

keenauth config promote --from env_01j9z3k4m5n6p7q8r9s0t1stg0 --to env_01j9z3k4m5n6p7q8r9s0t1prd0

On a terminal (table), the diff is printed to stdout, the question to stderr, and after the apply one line with the plan ID, its status and the number of changes. With json or yaml, the diff goes to stderr and stdout holds only the applied plan, so a script can read it. If the target already matches the source, the command prints nothing to promote and applies nothing.

When standard input is not a terminal and --yes is missing, the command exits with code 2 before it sends any request.

Secrets are never promoted

The exported document never holds a secret value: a connection's client secret appears as a secret_ref placeholder (for example KEENAUTH_CONNECTION_GOOGLE_CLIENT_SECRET). A change in the target that needs a secret is shown with [needs a client secret].

Such a plan is not applied unless you give the secret yourself: set the environment variable the error names and run the command again with --secrets-from-env. The value is read from your local environment and sent only in the body of the apply request. It is never printed, never written to a file, and never read from the source environment.

export KEENAUTH_CONNECTION_GOOGLE_CLIENT_SECRET=...   # the production client secret
keenauth config promote --from env_01j9z3k4m5n6p7q8r9s0t1stg0 --to env_01j9z3k4m5n6p7q8r9s0t1prd0 --secrets-from-env

Enterprise OIDC and social connections

The OIDC settings of an enterprise connection (spec.oidc: issuer, client ID, client authentication method and provider profile) are promoted with the connection. When the target does not have these settings yet, the apply creates them and fixes the callback URL from the target's host, so pass --sp-host with the host your users sign in on in the target environment. The host is not part of the document, because it differs between environments.

The client secret of a social connection cannot be applied from a plan yet: when the plan needs one, the apply is refused with 501 not_implemented even with --secrets-from-env, and nothing is changed. Promote the other kinds with --kinds, or leave the social connection out of the source until it is supported.

Errors

The plan is valid for one hour. If a resource of the target changes between the plan and the apply, the apply is refused with 409 config_conflict and nothing is changed; run the command again. The other apply errors are the same as for config apply.

Exit codes