Configuration

Available

Deployed and supported. The fields and commands described here are stable within version v1alpha1.

The CLI stores its tokens and preferences in a local file. In CI or in a script, environment variables take over.

The file

Default location: ~/.config/stackngo/config.yaml (Linux, macOS), %APPDATA%\stackngo\config.yaml (Windows). --config PATH points to another one.

The file is created by sng config create or by the first command that writes a token (sng sso login). It has mode 0600 in a 0700 directory: readable by you only.

~/.config/stackngo/config.yaml

api_url: https://api.dev.stackngo.fr
cluster: ovh-gra-0
tenant: acme-dev
access_token: "…"      # your identity (sng sso login)
refresh_token: "…"
tenant_token: "…"      # session of the current tenant (sng tenant use)

Key	Role
api_url	API address, without /v1. The binary embeds https://api.dev.stackngo.fr; this key is only used to target another API.
cluster	Targeted cluster (sng config use-cluster). Empty: the default cluster of the API.
tenant	Current tenant (sng tenant use). An environment is a tenant.
access_token, refresh_token	Identity token. The refresh_token is kept but not used: on expiry, run sng sso login again.
tenant_token	Session of the current tenant, renewed automatically.

Do not version this file

It contains your tokens. sng config show displays everything except the tokens, so you can check safely.

Cluster and tenant

The CLI talks to one cluster and one tenant, nothing else: there is no context or region to choose anymore. The manifests you apply, list, or delete are those of the current tenant.

sng config use-cluster ovh-gra-0   # choose the cluster
sng tenant use acme-dev            # choose the tenant (so the environment)

An environment is a tenant: create acme-dev and acme-prod, then switch between them with sng tenant use. Each tenant has its own permissions, quota, and domains. See Environments and restore.

File created by an older version

A file that still contains current_context, contexts, or region is converted on first run: the current context (API, tenant, tokens) is kept, region is dropped, and the original is kept once as config.yaml.bak. After switching cluster, run sng sso login again.

Environment variables

They take precedence over the file. This is how you configure the CLI in CI.

Variable	Replaces	Typical use
STNG_API_URL	api_url	Target another API (without /v1)
STNG_ACCESS_TOKEN	access_token	Identity token provided by the pipeline
STNG_TENANT_TOKEN	tenant_token	Tenant session provided by the pipeline (former name: STNG_SESSION_TOKEN)
STNG_CLUSTER	cluster	Cluster
STNG_TENANT	tenant	Current tenant
STNG_OAUTH_CLIENT_ID	identifier built into the CLI	Client ID for sng sso login --client-credentials (ignored by the browser sign-in)
STNG_OAUTH_CLIENT_SECRET	—	Client secret for sng sso login --client-credentials

The authentication service settings (address, client identifier, organization) are fixed when the binary is compiled and cannot be overridden by the file or the environment.

For a CI with no stored secret at all, prefer OIDC federation over a token in a variable.

Safeguards

• HTTPS required to the API, except for localhost and 127.0.0.1.
• A loopback api_url (http://127.0.0.1:…) left in the file is ignored when the binary targets a remote API: a leftover from local development does not hijack your commands.
• A single token per request: the CLI picks the identity or the session depending on the route. You never have to provide a header yourself.

Check

sng config show

cluster: ovh-gra-0
tenant: acme-dev
api_url: https://api.dev.stackngo.fr