Skip to content

config.yaml

Runtime identity, Auth Engine providers, and the binary→auth-provider map.

Location: <Runtime Home>/config.yaml, or $RUNTIME_CONFIG_FILE. Ownership: yours. Seeded once, never overwritten by an upgrade.

The seeded file

runtime:
  name: engineering-runtime
  log_level: info

# Auth Engine configuration. Engineering Runtime never replaces platform
# authentication; it only validates credentials that already exist on the
# machine, using each platform's own tooling.
authentication:
  provider: github

  github:
    enabled: true
    base_url: https://api.github.com
    token_env: RUNTIME_GITHUB_TOKEN

  gcp:
    enabled: false
    binary: gcloud

  kubernetes:
    enabled: false
    kubeconfig_path: ""     # defaults to $KUBECONFIG or ~/.kube/config

  openshift:
    enabled: false
    binary: oc
    server: ""

# Maps a `runtime command run <binary>` binary to the Auth Engine provider
# it validates against before executing.
command_providers:
  gh: github
  gcloud: gcp
  gsutil: gcp
  bq: gcp
  kubectl: kubernetes
  oc: openshift
  helm: kubernetes
  flux: kubernetes
  istioctl: kubernetes

Key reference

runtime

Key Type Default Meaning
runtime.name string engineering-runtime Display/logical name of this runtime instance
runtime.log_level string info Verbosity: debug, info, warn, error

authentication

Key Type Default Meaning
authentication.provider string github Fallback Auth Engine provider when nothing else declares one. A Runtime Provider normally declares its own

authentication.github

Key Type Default Meaning
enabled bool true Whether the GitHub auth provider participates
base_url string https://api.github.com REST API base URL. Change for GitHub Enterprise Server
token_env string RUNTIME_GITHUB_TOKEN Name of the env var holding the token — never the token itself

authentication.gcp

Key Type Default Meaning
enabled bool false Enable once gcloud auth application-default login has been run
binary string gcloud Binary name or path used for ADC validation

authentication.kubernetes

Key Type Default Meaning
enabled bool false Whether the Kubernetes auth provider participates
kubeconfig_path string "" Explicit kubeconfig path. When empty, falls back to $KUBECONFIG, then ~/.kube/config

Validation reads the kubeconfig's current context directly — no kubectl binary required.

authentication.openshift

Key Type Default Meaning
enabled bool false Enable once oc login has been run
binary string oc Binary name or path used for oc whoami validation
server string "" Optional API server hint. Login itself still happens with oc login, outside the runtime

command_providers

Maps a runtime command run <binary> binary to the Auth Engine provider it should validate against before executing.

A binary with no entry here skips the Auth Engine entirely — it is assumed to manage its own credentials (Terraform's provider blocks, Docker's registry logins, Vault's own token). That is a deliberate design decision, not a gap.

command_providers:
  gh: github
  terraform: none      # explicit "no auth provider" is also valid

helm, flux and istioctl all map to kubernetes because they read the same active kubeconfig context kubectl does, and the Kubernetes auth provider validates that file directly.

command_providers is not a Runtime Provider list

These are Auth Engine providers — credential sources. A Runtime Provider (github, files) is an operation surface, and lives in the binary, not in this file. See Providers.

Never put tokens in this file

config.yaml stores the name of an environment variable, not its value:

token_env: RUNTIME_GITHUB_TOKEN     # correct

Change the name if a pipeline already exports a differently named token:

export RUNTIME_AUTHENTICATION_GITHUB_TOKEN_ENV=MY_EXISTING_PAT
export MY_EXISTING_PAT=ghp_xxx

Environment overrides

Every key here is overridable as RUNTIME_<KEY> with dots replaced by underscores. The environment wins over the file — useful when the file is read-only or absent in CI.

export RUNTIME_AUTHENTICATION_GITHUB_BASE_URL=https://ghe.example.com/api/v3
export RUNTIME_AUTHENTICATION_GCP_ENABLED=true
export RUNTIME_RUNTIME_LOG_LEVEL=debug

Nested maps like command_providers are awkward through a single variable — edit the file for those. Full list: Environment Variables.

GitHub Enterprise Server

authentication:
  github:
    enabled: true
    base_url: https://ghe.example.com/api/v3
    token_env: RUNTIME_GITHUB_TOKEN

Or without editing the file at all:

export RUNTIME_AUTHENTICATION_GITHUB_BASE_URL=https://ghe.example.com/api/v3
export RUNTIME_GITHUB_TOKEN=ghp_xxx
runtime auth status

The REST and GraphQL Engines verify that an assembled URL still points at the configured base URL's scheme and host, so a crafted path cannot redirect your bearer token to another host.

Verify a change

runtime config validate

The report shows every auth provider's enabled state, whether its CLI binary is installed, and its live auth status — so a wrong base_url or a missing token shows up as a failed check rather than as a confusing error mid-operation.