CLIProxyAPI deployment contract

Public VanillaCore deployment contract for the upstream CLIProxyAPI service.

This repository contains only generic Kubernetes deployment resources:

• pinned CLIProxyAPI and Management Center artifacts;
• persistent configuration/OAuth storage;
• a ClusterIP Service; and
• external Secret schemas.

Ingress, client allowlists, TLS issuers, storage classes, provider-specific Envoy wiring, and cluster NetworkPolicies belong in an environment repository. No internal hostnames, addresses, or cluster assumptions are part of this project.

This is not a fork of CLIProxyAPI. Source fixes belong upstream or in a deliberate fork later.

Render and apply

kubectl kustomize .
kubectl apply -k .

The external Secrets named in deploy/secrets.example.yaml must exist before applying the deployment. An environment integration is responsible for exposing the Service safely.

Upgrade policy

Review upstream release notes and artifact provenance, then update the image or Management Center digest in a reviewed commit. Do not replace pins with mutable tags or put OAuth/API credentials in Git.