Azure - Ryvn

Environments define where your services are deployed. Ryvn provisions and manages infrastructure in target Azure subscriptions, including Kubernetes clusters, networking, load balancers, and DNS.

# yaml-language-server: $schema=https://api.ryvn.app/v1/schemas/resources.json
kind: Environment
metadata:
  name: prod-us
spec:
  releaseChannel: production
  provider:
    type: azure
    subscriptionId: 12345678-1234-1234-1234-123456789012
  config:
    region: eastus
    vnet_cidr: 10.1.0.0/16
  platform:
    blueprint: ryvn.app/azure-platform
    inputs:
      - name: logs
        value: true
---
kind: ServiceInstallation
metadata:
  name: api-prod-us
spec:
  service: api
  environment: prod-us

Properties

`name`

string — required Environment identifier. Must be lowercase, alphanumeric with hyphens only.

name: production

`labels`

object — optional Key-value labels for grouping and filtering environments. Use labels to organize environments by team, region, customer, or any other dimension. Constraints:

Maximum 50 labels per environment
Keys must start with an alphanumeric character and contain only alphanumerics, dots, hyphens, and underscores
Keys and values are each limited to 63 characters

metadata:
  name: prod-us
  labels:
    team: platform
    region: eastus
    customer: acme

`releaseChannel`

string — optional Default release channel for installations in this environment. When installations don’t specify a release channel, they use the environment’s channel.

releaseChannel: stable

`maintenanceWindow`

string — optional Maintenance window for this environment. Automated deployments will only occur during specified intervals. This window governs Ryvn deployments only. AKS node image and Kubernetes patch upgrades follow config.maintenance_window_node_os and config.maintenance_window_auto_upgrade.

maintenanceWindow: business-hours

`config`

object — optional Configuration passed to the Ryvn environment provisioner.

config:
  location: eastus
  vnet_cidr: "10.0.0.0/16"
  cluster_version: "1.31"

`config.location`

string — required Azure location where resources will be provisioned.

config:
  location: eastus

`config.internal_root_domain`

string — optional Internal root domain for services using internal networking. If not specified, Ryvn generates an internal domain for the environment, separate from its public domain.

config:
  internal_root_domain: internal.example.com

`config.public_root_domain`

string — optional Public root domain for services using public networking. If not specified, Ryvn generates a default domain in the format {environment}.{org-slug}.ryvn.run.

config:
  public_root_domain: example.com

`config.cluster_version`

string — optional Kubernetes version to use for the AKS cluster. Defaults to 1.31.

config:
  cluster_version: "1.30"

`config.node_os_channel_upgrade`

string — optional How AKS keeps the node OS image up to date: NodeImage, SecurityPatch, Unmanaged or None. Defaults to NodeImage. NodeImage and SecurityPatch upgrades only run during config.maintenance_window_node_os.

config:
  node_os_channel_upgrade: NodeImage

`config.maintenance_window_node_os`

object — optional AKS planned maintenance schedule for node OS image upgrades. Defaults to Sundays 00:00–08:00 UTC. Set to null to let AKS upgrade node images at any time.

Field	Type	Description
`frequency`	`string`	`Daily`, `Weekly`, `AbsoluteMonthly` or `RelativeMonthly`
`interval`	`number`	Repeat every N days, weeks or months, depending on `frequency`
`duration`	`number`	Window length in hours, between 4 and 24
`day_of_week`	`string`	Day the window starts, e.g. `Sunday`. Required for `Weekly` and `RelativeMonthly`
`day_of_month`	`number`	Day of the month the window starts. Required for `AbsoluteMonthly`
`week_index`	`string`	`First`, `Second`, `Third`, `Fourth` or `Last`. Required for `RelativeMonthly`
`start_time`	`string`	Start time in `HH:mm`, in the `utc_offset` timezone
`utc_offset`	`string`	Offset from UTC, e.g. `-05:00`
`start_date`	`string`	Date the schedule takes effect, `YYYY-MM-DD`
`not_allowed`	`array`	Blackout periods, each with RFC 3339 `start` and `end` timestamps

config:
  maintenance_window_node_os:
    frequency: Daily
    interval: 1
    start_time: "22:00"
    utc_offset: "-05:00"
    duration: 6
    not_allowed:
      - start: "2026-12-24T00:00:00Z"
        end: "2026-12-27T00:00:00Z"

Azure can still apply urgent security fixes outside the window.

`config.maintenance_window_auto_upgrade`

object — optional AKS planned maintenance schedule for Kubernetes patch version upgrades. Takes the same fields as config.maintenance_window_node_os, except that frequency must be Weekly, AbsoluteMonthly or RelativeMonthly. Defaults to Sundays 00:00–08:00 UTC. Set to null to let AKS upgrade at any time.

config:
  maintenance_window_auto_upgrade:
    frequency: Weekly
    interval: 1
    day_of_week: Saturday
    start_time: "00:00"
    utc_offset: "-05:00"
    duration: 8

`config.cluster_bootstrap_perms`

boolean — managed by Ryvn Grants the provisioning identity cluster admin permissions so Ryvn can install the agent and its access RBAC after the cluster is created. Ryvn always sets this to true; a value in config is ignored.

`config.aks_node_pools`

object — optional Map of AKS node pool definitions to create. Values will be merged with defaults if not specified. Default node pools are application and system. Each node pool supports the following properties:

Property	Type	Description
`vm_size`	`string`	Azure VM size (e.g., `Standard_D4s_v5`)
`min_count`	`number`	Minimum node count for autoscaling
`max_count`	`number`	Maximum node count for autoscaling
`node_count`	`number`	Initial node count
`os_disk_size_gb`	`number`	OS disk size in GB
`labels`	`map(string)`	Kubernetes labels to apply to nodes
`taints`	`list(string)`	Kubernetes taints (non-system pools only)

Taints use the standard Kubernetes format: key=value:effect where effect is one of NoSchedule, PreferNoSchedule, or NoExecute.

config:
  aks_node_pools:
    application:
      vm_size: Standard_D4s_v5
      min_count: 2
      max_count: 10
      node_count: 3
      os_disk_size_gb: 100
      labels:
        team: platform
      taints:
        - dedicated=platform:NoSchedule

`config.existing_vnet_id`

string — optional Azure resource ID of a pre-existing virtual network. When set, Ryvn provisions its subnets inside the existing VNet instead of creating a new one. Must be in the same Azure region as the environment.

config:
  existing_vnet_id: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/network/providers/Microsoft.Network/virtualNetworks/prod-us-vnet
  vnet_cidr: "10.0.0.0/19"

`config.vnet_cidr`

string — optional CIDR block for the virtual network. Defaults to 10.0.0.0/16. When config.existing_vnet_id is set, this is the CIDR range within the existing VNet reserved for Ryvn’s subnets.

config:
  vnet_cidr: "10.1.0.0/16"

`config.zones`

array — optional List of availability zones for AKS node pools. If not specified, uses all zones available in the region.

config:
  zones:
    - "1"
    - "3"

`config.control_plane_log_retention_days`

number — optional Retention for AKS control-plane and full audit logs in Log Analytics. Accepts whole days from 30 to 730 and defaults to 30.

config:
  control_plane_log_retention_days: 90

`setup`

string — optional Environment setup type. Controls who provisions the environment infrastructure. Available values:

self - Ryvn Control Plane uses service principal credentials to provision the infrastructure (default)
pre-provisioned - Use existing or externally managed infrastructure

setup: self

`requireApproval`

boolean — optional (default: false) When true, deployments require approval before executing. See Deployment Approvals.

requireApproval: true

`provider`

object — required Azure provider configuration.

provider:
  type: azure
  subscriptionId: 12345678-1234-1234-1234-123456789012

`provider.type`

string — required Must be azure.

provider:
  type: azure

`provider.subscriptionId`

string — optional Azure subscription ID where resources will be provisioned.

provider:
  subscriptionId: 12345678-1234-1234-1234-123456789012

`provider.servicePrincipal`

object — optional Azure service principal credentials for authentication. Enter the client secret in the Ryvn dashboard during cloud provider setup, or through the API’s clientSecret field. In YAML, declare only appId and tenantId: the client secret stored for that service principal is kept. Keep servicePrincipal in the YAML once it is configured; the service principal cannot be removed after provisioning has started.

provider:
  servicePrincipal:
    appId: abcdef01-2345-6789-abcd-ef0123456789
    tenantId: fedcba98-7654-3210-fedc-ba9876543210

`provider.servicePrincipal.appId`

string — required Azure application (client) ID.

servicePrincipal:
  appId: abcdef01-2345-6789-abcd-ef0123456789

`provider.servicePrincipal.tenantId`

string — required Azure tenant ID.

servicePrincipal:
  tenantId: fedcba98-7654-3210-fedc-ba9876543210

`namespaces`

array — optional Kubernetes namespaces to create in this environment, with optional labels. Ryvn creates each one, adds its own labels, and reapplies yours on every sync. The default namespace (same name as the environment) exists either way; list it only to label it. Removing an entry does not delete the namespace. See Namespaces.

name (required): a DNS-1123 label, lowercase alphanumerics and hyphens, up to 63 characters
labels (optional): labels to apply to the namespace

namespaces:
  - name: prod-us
    labels:
      pod-security.kubernetes.io/enforce: baseline
  - name: inngest

`platform`

object — optional Platform blueprint used to provision the environment and its inputs. Self-provisioned environments default to the Ryvn-managed platform blueprint for the cloud (ryvn.app/azure-platform); pre-provisioned environments (setup: pre-provisioned) default to ryvn.app/base-platform. See Platform blueprint configuration for the available inputs.

platform:
  blueprint: ryvn.app/azure-platform
  inputs:
    - name: logs
      value: true
    - name: metrics
      value: false

`installations`

array — read-only Present in the API representation of an environment only. Git export emits each deployed installation as a standalone resource, and git sync does not read this field. To deploy into an environment, declare standalone ServiceInstallation or BlueprintInstallation resources whose spec.environment references the environment:

kind: ServiceInstallation
metadata:
  name: api-prod-us
spec:
  service: api
  environment: prod-us
---
kind: BlueprintInstallation
metadata:
  name: observability-stack-prod-us
spec:
  blueprint: observability-stack
  environment: prod-us

Installations listed inline under an Environment’s spec.installations are ignored by git sync. Declare them as separate resources.

See Server, Job, Helm Chart, Terraform, and Blueprint installation documentation for details.

Platform blueprint configuration

The Azure platform blueprint (ryvn.app/azure-platform) accepts the following inputs via the environment’s platform field:

Observability configuration

The Azure provisioner automatically collects AKS API server, controller manager, scheduler, autoscaler, guard, and full kube-audit logs into a Log Analytics workspace in the environment’s resource group. The resource-specific AKSControlPlane and AKSAudit tables keep 30 days by default; configure control_plane_log_retention_days to change retention. Full audit includes read requests, subject to Azure’s managed audit policy. Ingestion and retention incur Azure charges. Query access requires Entra permissions on the workspace. This collection is independent of the workload logs option below and does not install Container Insights or enable additional metrics. The workspace follows the environment’s lifecycle; configure a separate archive for logs that must outlive the environment. After deployment, open the AKS resource’s Diagnostic settings and check ryvn-control-plane-logs. Generate a permitted Kubernetes read and a harmless write, then verify matching records in AKSAudit and control-plane records in AKSControlPlane. Collection starts after attachment and does not backfill prior operations. See AKS control-plane logs.

Input	Type	Default	Description
`logs`	`boolean`	`true`	Collect and forward workload logs.
`logRedaction`	`boolean`	`false`	Enable log redaction to remove sensitive information from logs
`redactionPatterns`	`array`	-	Regex patterns for log redaction (available when logRedaction is enabled)
`metrics`	`boolean`	`true`	Enable metrics collection and forwarding

platform:
  blueprint: ryvn.app/azure-platform
  inputs:
    - name: logs
      value: false
    - name: logRedaction
      value: true
    - name: redactionPatterns
      value:
        - "password=\\S+"
        - "api[_-]?key=\\S+"
    - name: metrics
      value: true

Outputs

Environment outputs are available in service installation configs using template syntax. Reference these values to configure services with infrastructure details provisioned by Ryvn.

`.ryvn.env.name`

The name of the environment.

environment: '{{ .ryvn.env.name }}'

`.ryvn.env.orgId`

The organization ID.

org_id: '{{ .ryvn.env.orgId }}'

`.ryvn.env.defaultNamespace`

The default Kubernetes namespace for the environment (typically same as environment name).

namespace: '{{ .ryvn.env.defaultNamespace }}'

`.ryvn.env.releaseChannel`

The release channel for this environment.

channel: '{{ .ryvn.env.releaseChannel }}'

`.ryvn.env.provider.type`

The provider type (e.g., aws, gcp, azure).

provider_type: '{{ .ryvn.env.provider.type }}'

`.ryvn.env.provider.azure.subscriptionId`

The Azure subscription ID where resources are provisioned.

subscription_id: '{{ .ryvn.env.provider.azure.subscriptionId }}'

`.ryvn.env.config`

Environment configuration as a key-value map. Access custom config values you define in your environment using dot notation.

# Example: Access custom operational settings
debug_mode: '{{ .ryvn.env.config.enable_debug_mode }}'

# Example: Access external service configuration
datadog_site: '{{ .ryvn.env.config.datadog_region }}'

`.ryvn.env.state.cluster.name`

The name of the AKS cluster.

cluster_name: '{{ .ryvn.env.state.cluster.name }}'

`.ryvn.env.state.cluster.id`

Azure resource ID of the AKS cluster.

cluster_id: '{{ .ryvn.env.state.cluster.id }}'

`.ryvn.env.state.cluster.cluster_fqdn`

Fully qualified domain name of the AKS cluster.

cluster_fqdn: '{{ .ryvn.env.state.cluster.cluster_fqdn }}'

`.ryvn.env.state.cluster.location`

Azure location where the AKS cluster is deployed.

location: '{{ .ryvn.env.state.cluster.location }}'

`.ryvn.env.state.cluster.oidc_issuer_url`

URL for the OpenID Connect identity provider on the AKS cluster.

oidc_issuer: '{{ .ryvn.env.state.cluster.oidc_issuer_url }}'

`.ryvn.env.state.ryvn_agent_role.client_id`

Client ID of the managed identity for the Ryvn Agent.

client_id: '{{ .ryvn.env.state.ryvn_agent_role.client_id }}'

`.ryvn.env.state.ryvn_agent_role.tenant_id`

Tenant ID of the managed identity for the Ryvn Agent.

tenant_id: '{{ .ryvn.env.state.ryvn_agent_role.tenant_id }}'

`.ryvn.env.state.ryvn_agent_role.principal_id`

Principal ID of the managed identity for the Ryvn Agent.

principal_id: '{{ .ryvn.env.state.ryvn_agent_role.principal_id }}'

`.ryvn.env.state.ryvn_agent_role.id`

Azure resource ID of the managed identity for the Ryvn Agent.

identity_id: '{{ .ryvn.env.state.ryvn_agent_role.id }}'

`.ryvn.env.state.subscription.subscription_id`

Azure subscription ID where resources are deployed.

subscription_id: '{{ .ryvn.env.state.subscription.subscription_id }}'

`.ryvn.env.state.subscription.client_id`

Client ID for the subscription.

sub_client_id: '{{ .ryvn.env.state.subscription.client_id }}'

`.ryvn.env.state.resource_group.name`

Name of the Azure resource group.

resource_group: '{{ .ryvn.env.state.resource_group.name }}'

`.ryvn.env.state.resource_group.location`

Location of the Azure resource group.

rg_location: '{{ .ryvn.env.state.resource_group.location }}'

`.ryvn.env.state.vnet.id`

Azure resource ID of the virtual network.

vnet_id: '{{ .ryvn.env.state.vnet.id }}'

`.ryvn.env.state.vnet.name`

Name of the virtual network.

vnet_name: '{{ .ryvn.env.state.vnet.name }}'

`.ryvn.env.state.vnet.location`

Location of the virtual network.

vnet_location: '{{ .ryvn.env.state.vnet.location }}'

`.ryvn.env.state.vnet.cidr`

CIDR block of the virtual network.

vnet_cidr: '{{ .ryvn.env.state.vnet.cidr }}'

`.ryvn.env.state.vnet.address_spaces`

List of address spaces for the virtual network.

address_spaces: '{{ .ryvn.env.state.vnet.address_spaces | toJson }}'

`.ryvn.env.state.vnet.subnet_ids`

List of subnet resource IDs.

subnet_ids: '{{ .ryvn.env.state.vnet.subnet_ids | toJson }}'

`.ryvn.env.state.vnet.subnet_names`

List of subnet names.

subnet_names: '{{ .ryvn.env.state.vnet.subnet_names | toJson }}'

`.ryvn.env.state.vnet.network_plugin_mode`

Network plugin mode for the AKS cluster (e.g., “overlay”).

plugin_mode: '{{ .ryvn.env.state.vnet.network_plugin_mode }}'

`.ryvn.env.state.vnet.service_cidr`

Service CIDR for Kubernetes services.

service_cidr: '{{ .ryvn.env.state.vnet.service_cidr }}'

`.ryvn.env.state.vnet.dns_service_ip`

DNS service IP for the cluster.

dns_ip: '{{ .ryvn.env.state.vnet.dns_service_ip }}'

`.ryvn.env.state.outbound_ips`

List of public IPs used for outbound internet traffic from workloads in this environment.

outbound_ips: '{{ .ryvn.env.state.outbound_ips | toJson }}'

`.ryvn.env.state.vnet.outbound_load_balancer_public_ips`

List of public IPs assigned to the AKS outbound load balancer.

outbound_ips: '{{ .ryvn.env.state.vnet.outbound_load_balancer_public_ips | toJson }}'

`.ryvn.env.state.public_domain.name`

Public root domain name for the environment.

domain: '{{ .ryvn.env.state.public_domain.name }}'

`.ryvn.env.state.public_domain.id`

Azure DNS zone resource ID for the public domain.

zone_id: '{{ .ryvn.env.state.public_domain.id }}'

`.ryvn.env.state.public_domain.nameservers`

List of nameservers for the public domain.

nameservers: '{{ .ryvn.env.state.public_domain.nameservers | toJson }}'

`.ryvn.env.state.internal_domain.name`

Internal domain name for the environment.

internal_domain: '{{ .ryvn.env.state.internal_domain.name }}'

`.ryvn.env.state.internal_domain.id`

Azure Private DNS zone resource ID for the internal domain.

internal_zone_id: '{{ .ryvn.env.state.internal_domain.id }}'

`.ryvn.env.state.external_dns_identity.client_id`

Client ID of the managed identity for ExternalDNS (public zones).

external_dns_client_id: '{{ .ryvn.env.state.external_dns_identity.client_id }}'

`.ryvn.env.state.external_dns_private_identity.client_id`

Client ID of the managed identity for ExternalDNS (private zones).

external_dns_private_client_id: '{{ .ryvn.env.state.external_dns_private_identity.client_id }}'

`.ryvn.env.state.cert_manager_identity.client_id`

Client ID of the managed identity for cert-manager.

cert_manager_client_id: '{{ .ryvn.env.state.cert_manager_identity.client_id }}'

Examples

Multi-environment setup:

kind: Environment
metadata:
  name: staging
spec:
  releaseChannel: staging
  provider:
    type: azure
    subscriptionId: 87654321-4321-4321-4321-210987654321
    servicePrincipal:
      appId: 12345678-abcd-efab-cdef-123456789012
      tenantId: fedcba98-7654-3210-fedc-ba9876543210
  config:
    location: westus
    vnet_cidr: "10.1.0.0/16"
---
kind: Environment
metadata:
  name: prod-us
spec:
  releaseChannel: production
  provider:
    type: azure
    subscriptionId: 12345678-1234-1234-1234-123456789012
    servicePrincipal:
      appId: abcdef01-2345-6789-abcd-ef0123456789
      tenantId: fedcba98-7654-3210-fedc-ba9876543210
  config:
    location: eastus
    vnet_cidr: "10.0.0.0/16"
    aks_node_pools:
      application:
        vm_size: Standard_D4s_v5
        min_count: 3
        max_count: 10
---
kind: Environment
metadata:
  name: prod-eu
spec:
  releaseChannel: production
  provider:
    type: azure
    subscriptionId: 12345678-1234-1234-1234-123456789012
    servicePrincipal:
      appId: abcdef01-2345-6789-abcd-ef0123456789
      tenantId: fedcba98-7654-3210-fedc-ba9876543210
  config:
    location: northeurope
    vnet_cidr: "10.2.0.0/16"
    aks_node_pools:
      application:
        vm_size: Standard_D4s_v5
        min_count: 3
        max_count: 10
---
kind: ServiceInstallation
metadata:
  name: api-staging
spec:
  service: api
  environment: staging
---
kind: ServiceInstallation
metadata:
  name: frontend-staging
spec:
  service: frontend
  environment: staging

Installations for the other environments follow the same pattern. With custom domains:

kind: Environment
metadata:
  name: production
spec:
  releaseChannel: production
  provider:
    type: azure
    subscriptionId: 12345678-1234-1234-1234-123456789012
    servicePrincipal:
      appId: abcdef01-2345-6789-abcd-ef0123456789
      tenantId: fedcba98-7654-3210-fedc-ba9876543210
  config:
    location: eastus
    internal_root_domain: internal.example.com
    public_root_domain: example.com
---
kind: ServiceInstallation
metadata:
  name: api-production
spec:
  service: api
  environment: production

Pre-provisioned environment:

kind: Environment
metadata:
  name: customer-prod
spec:
  releaseChannel: stable
  setup: pre-provisioned
  provider:
    type: azure
    subscriptionId: aaaabbbb-cccc-dddd-eeee-ffffgggghhh
    servicePrincipal:
      appId: 11111111-2222-3333-4444-555555555555
      tenantId: 66666666-7777-8888-9999-000000000000
---
kind: ServiceInstallation
metadata:
  name: api-customer-prod
spec:
  service: api
  environment: customer-prod

⌘I

​Properties

​name

​labels

​releaseChannel

​maintenanceWindow

​config

​config.location

​config.internal_root_domain

​config.public_root_domain

​config.cluster_version

​config.node_os_channel_upgrade

​config.maintenance_window_node_os

​config.maintenance_window_auto_upgrade

​config.cluster_bootstrap_perms

​config.aks_node_pools

​config.existing_vnet_id

​config.vnet_cidr

​config.zones

​config.control_plane_log_retention_days

​setup

​requireApproval

​provider

​provider.type

​provider.subscriptionId

​provider.servicePrincipal

​provider.servicePrincipal.appId

​provider.servicePrincipal.tenantId

​namespaces

​platform

​installations

​Platform blueprint configuration

​Observability configuration

​Outputs

​.ryvn.env.name

​.ryvn.env.orgId

​.ryvn.env.defaultNamespace

​.ryvn.env.releaseChannel

​.ryvn.env.provider.type

​.ryvn.env.provider.azure.subscriptionId

​.ryvn.env.config

​.ryvn.env.state.cluster.name

​.ryvn.env.state.cluster.id

​.ryvn.env.state.cluster.cluster_fqdn

​.ryvn.env.state.cluster.location

​.ryvn.env.state.cluster.oidc_issuer_url

​.ryvn.env.state.ryvn_agent_role.client_id

​.ryvn.env.state.ryvn_agent_role.tenant_id

​.ryvn.env.state.ryvn_agent_role.principal_id

​.ryvn.env.state.ryvn_agent_role.id

​.ryvn.env.state.subscription.subscription_id

​.ryvn.env.state.subscription.client_id

​.ryvn.env.state.resource_group.name

​.ryvn.env.state.resource_group.location

​.ryvn.env.state.vnet.id

​.ryvn.env.state.vnet.name

​.ryvn.env.state.vnet.location

​.ryvn.env.state.vnet.cidr

​.ryvn.env.state.vnet.address_spaces

​.ryvn.env.state.vnet.subnet_ids

​.ryvn.env.state.vnet.subnet_names

​.ryvn.env.state.vnet.network_plugin_mode

​.ryvn.env.state.vnet.service_cidr

​.ryvn.env.state.vnet.dns_service_ip

​.ryvn.env.state.outbound_ips

​.ryvn.env.state.vnet.outbound_load_balancer_public_ips

​.ryvn.env.state.public_domain.name

​.ryvn.env.state.public_domain.id

​.ryvn.env.state.public_domain.nameservers

​.ryvn.env.state.internal_domain.name

​.ryvn.env.state.internal_domain.id

​.ryvn.env.state.external_dns_identity.client_id

​.ryvn.env.state.external_dns_private_identity.client_id

​.ryvn.env.state.cert_manager_identity.client_id

​Examples

Properties

`name`

`labels`

`releaseChannel`

`maintenanceWindow`

`config`

`config.location`

`config.internal_root_domain`

`config.public_root_domain`

`config.cluster_version`

`config.node_os_channel_upgrade`

`config.maintenance_window_node_os`

`config.maintenance_window_auto_upgrade`

`config.cluster_bootstrap_perms`

`config.aks_node_pools`

`config.existing_vnet_id`

`config.vnet_cidr`

`config.zones`

`config.control_plane_log_retention_days`

`setup`

`requireApproval`

`provider`

`provider.type`

`provider.subscriptionId`

`provider.servicePrincipal`

`provider.servicePrincipal.appId`

`provider.servicePrincipal.tenantId`

`namespaces`

`platform`

`installations`

Platform blueprint configuration

Observability configuration

Outputs

`.ryvn.env.name`

`.ryvn.env.orgId`

`.ryvn.env.defaultNamespace`

`.ryvn.env.releaseChannel`

`.ryvn.env.provider.type`

`.ryvn.env.provider.azure.subscriptionId`

`.ryvn.env.config`

`.ryvn.env.state.cluster.name`

`.ryvn.env.state.cluster.id`

`.ryvn.env.state.cluster.cluster_fqdn`

`.ryvn.env.state.cluster.location`

`.ryvn.env.state.cluster.oidc_issuer_url`

`.ryvn.env.state.ryvn_agent_role.client_id`

`.ryvn.env.state.ryvn_agent_role.tenant_id`

`.ryvn.env.state.ryvn_agent_role.principal_id`

`.ryvn.env.state.ryvn_agent_role.id`

`.ryvn.env.state.subscription.subscription_id`

`.ryvn.env.state.subscription.client_id`

`.ryvn.env.state.resource_group.name`

`.ryvn.env.state.resource_group.location`

`.ryvn.env.state.vnet.id`

`.ryvn.env.state.vnet.name`

`.ryvn.env.state.vnet.location`

`.ryvn.env.state.vnet.cidr`

`.ryvn.env.state.vnet.address_spaces`

`.ryvn.env.state.vnet.subnet_ids`

`.ryvn.env.state.vnet.subnet_names`

`.ryvn.env.state.vnet.network_plugin_mode`

`.ryvn.env.state.vnet.service_cidr`

`.ryvn.env.state.vnet.dns_service_ip`

`.ryvn.env.state.outbound_ips`

`.ryvn.env.state.vnet.outbound_load_balancer_public_ips`

`.ryvn.env.state.public_domain.name`

`.ryvn.env.state.public_domain.id`

`.ryvn.env.state.public_domain.nameservers`

`.ryvn.env.state.internal_domain.name`

`.ryvn.env.state.internal_domain.id`

`.ryvn.env.state.external_dns_identity.client_id`

`.ryvn.env.state.external_dns_private_identity.client_id`

`.ryvn.env.state.cert_manager_identity.client_id`

Examples