Quick start: configuration repository

Use this workflow when you have a Git repository containing configuration packages and want to work against an existing tSM application. You do not need Docker, a local backend or a runtime profile.

First install the CLI, clone your configuration repository and open its directory. In the tSM GUI, create an API key on your user detail, API Keys tab.

Connect once

tsm context create

The interactive command asks for the missing settings and proposes defaults:

Project [tsm]:
Environment [dev]:
Application URL: https://tsm-dev.k8s.datalite.cz
Context name [tsm-dev]:
Account [personal]:
Log in with API key? (yes/no) [yes]:
API key: ********
Use as default (workspace/global/none) [workspace]:

Project comes from tsm-project.yaml or a registered workspace when available; otherwise enter it. An existing environment supplies its URL. An existing account keeps its stored credentials, so the key prompt is skipped. Tenant defaults to default; use --tenant NAME for another tenant.

Select workspace to bind the context to this repository. The workspace name defaults to the directory name; no runtime profile is assigned. Without a project manifest or registered workspace the proposed scope is global; choose workspace explicitly to register an ordinary configuration checkout. Global selection is never changed when choosing workspace scope. Configuration is personal in home; credentials use the selected credential backend, OS vault by default. No key is written to the Git repository.

tsm auth whoami
tsm context show

If login fails, the context remains saved. Retry with tsm --context tsm-dev auth login. Re-running create with the same context name reports a duplicate; use context use, context update or auth login for existing contexts.

Review and install a package

Choose the existing package directory in your repository; AllConfig below is an example. Review its changes before installation:

tsm package info --package-yaml ./AllConfig/package.yaml
tsm package validate ./AllConfig
tsm package diff ./AllConfig

After reviewing the diff, install explicitly:

tsm package install ./AllConfig

Install changes the selected application/tenant. Validate and diff read it. Use --context NAME to select another target explicitly without changing the workspace default. Continue with packages, or use the command builder to prepare a command.

Scripts: no prompts

All choices can be supplied explicitly. For example, run this from the configuration checkout with TSM_API_KEY supplied by your secret manager or CI secret variable:

printf '%s\n' "$TSM_API_KEY" | tsm context create tsm-dev --project tsm --env dev --endpoint https://tsm-dev.k8s.datalite.cz --account personal --tenant default --api-key-stdin --non-interactive --use workspace

--non-interactive disables prompts even in a terminal. Without a console or with JSON/YAML output, prompts are also disabled. Missing required values fail before configuration writes. --api-key-stdin reads one line, validates it against the application and saves it in the configured credential backend. Do not enable shell tracing around secret input. Configure a credential backend usable by the runner; an OS vault may require an unlocked desktop session.

For scripts that only register the connection, omit credentials and use --no-login. --use none leaves all defaults unchanged; --use global changes only the global context; --use workspace --workspace-name NAME explicitly names the current workspace. Without --use, non-interactive create leaves defaults unchanged. --workspace NAME_OR_PATH selects a different workspace directory explicitly.

Explicit Basic (--user plus --password) and Bearer (--token) inputs are also supported and imply login. Do not combine authentication modes or credentials with --no-login. Without credential inputs, non-interactive create never logs in implicitly. Existing environments cannot be silently redirected by --endpoint; change their URL with cli config environment update explicitly.