Deploy an App and verify it end-to-end. Use KUBECONFIG=infra/local/bex.kubeconfig if no other cluster is targeted.
Requires BEX_API_URL and BEX_API_TOKEN in the environment (scripts/app-apply.sh reads them and fails with set BEX_API_URL if unset — both are client-supplied, not in .env.example; BEX_API_PUBLIC_URL in .env.example is the unrelated backend DeployHook origin). BEX_API_TOKEN is the Hydra-issued Bearer token (API key minted via /v1/api-keys), not the removed static shared secret. Optional BEX_OWNER_ID, BEX_REPO, BEX_BRANCH narrow the deploy.
- If
$ARGUMENTSis a path to arender.yaml(or legacybex.ymlalias — canonical isrender.yaml, seescripts/app-apply.sh), apply it withDRY_RUN=1 bash scripts/app-apply.sh $ARGUMENTSfirst and show the generated App CR, thenbash scripts/app-apply.sh $ARGUMENTSto deploy. If$ARGUMENTSis a directory, pass the directory — the script discoversrender.yamlthenbex.ymlinside it. Otherwise apply the sample:kubectl apply -f examples/whoami-app.yaml. - Watch until ready: poll
kubectl get apps.app.bex.co <name> -o jsonpath='{.status.phase} {.status.revision} {.status.url}'until phase isReady(timeout ~3 minutes; on timeout, showkubectl describe apps.app.bex.co <name>and the operator logskubectl -n bex-system logs deploy/bex-controller-manager --tail=50). - If
status.urlis set and resolvable,curl -fsSit (use--resolve/-konly if the local mock has no real DNS/TLS) and show the response status. - Report: App name, phase, revision, url, and where the pods landed (
kubectl get pods -l app.bex.co/app=<name> -o wide).