env

1ctl env manages non-sensitive key-value pairs for your deployments — runtime config like NODE_ENV, PORT, LOG_LEVEL, feature flags, and service hostnames. Environment variables are stored in Kubernetes ConfigMaps, which means their values are visible in plaintext to anyone with read access to the cluster namespace.

you → 1ctl env create → POST /v1/cli/environments → DB row + K8s ConfigMap

If a value is a password, token, or API key, use 1ctl secret instead. The mechanics are similar, but secrets travel through an encrypted path.

1ctl environment is an alias for 1ctl env — both forms are equivalent.

env vs secret — choosing the right tool

	env	secret
Storage	Kubernetes ConfigMap	K8s Secret + AES-256-GCM encrypted DB
Values visible in cluster	Yes — plaintext	Encrypted at rest
Returned by list	Yes, keys and values	Key names only
Use for	NODE_ENV, PORT, LOG_LEVEL, hostnames	Passwords, API keys, tokens, credentials

When in doubt: if you would be uncomfortable pasting the value into a Slack message, put it in 1ctl secret.

Commands

1ctl env create

1ctl env create [--deployment-id <id>] [--config <cfg>] [--name <label>] --env KEY=VALUE ...

Creates a new environment variable group or updates an existing one for a deployment. Repeating --env lets you set multiple keys in one call.

Flags

Flag	Short	Default	Description
--env KEY=VALUE		required	A key-value pair to set. Repeat for multiple keys: --env A=1 --env B=2.
--deployment-id <id>		satusky.toml	Deployment to attach the variables to. Resolved from satusky.toml if omitted.
--name <label>		auto-generated	Human-readable label for this variable group.
--config <name>		satusky.toml	Named config file to use (e.g. staging resolves to satusky.staging.toml).

Under the hood:

1. 1ctl sends POST /v1/cli/environments with the deployment ID, name, and key-value pairs
2. The API writes the group to the environments table in PostgreSQL, linked to the deployment_id
3. The API creates (or patches) a Kubernetes ConfigMap in the deployment’s namespace
4. The pod spec references each ConfigMap key explicitly with configMapKeyRef, and the deployment is updated immediately so Kubernetes rolls out fresh pods with the new values

env create updates the Deployment spec as part of the operation, so Kubernetes starts replacement pods automatically. Running containers still do not hot-reload environment variables in place; the value appears once the rollout completes.

Examples

# Set env vars for the project in the current directory
1ctl env create --env NODE_ENV=production --env LOG_LEVEL=info

# Set for a specific deployment
1ctl env create --deployment-id dep_123abc --env DATABASE_HOST=db.internal

# Multiple vars with a group label
1ctl env create --name "app-config" --env PORT=8080 --env TZ=UTC

# Use a staging config file
1ctl env create --config staging --env API_URL=https://staging.example.com

---

1ctl env list

1ctl env list [--deployment-id <id>]

Lists all environment variable groups for your deployments, including key names and values.

Under the hood: GET /v1/cli/environments reads from the environments table. Because environment variables are not sensitive by design, values are included in the response and displayed in the output.

Flags

Flag	Short	Default	Description
--deployment-id <id>		all deployments	Filter results to a specific deployment.

Example

$ 1ctl env list
GROUP       DEPLOYMENT    KEY           VALUE
app-config  dep_123abc    NODE_ENV      production
app-config  dep_123abc    LOG_LEVEL     info
app-config  dep_123abc    PORT          8080

---

1ctl env unset

1ctl env unset [-d/--deployment-id <id>] [--config <cfg>] -k <key>

Removes a single key from an environment variable group. The key is deleted from the environments table and patched out of the corresponding Kubernetes ConfigMap.

env unset also patches the Deployment spec immediately and triggers a rollout so removed keys disappear from replacement pods.

Flags

Flag	Short	Default	Description
-k <key>		required	The key name to remove.
--deployment-id <id>	-d	satusky.toml	Deployment to target. Resolved from satusky.toml if omitted.
--config <name>		satusky.toml	Named config file to use.

Examples

# Remove a variable from the current project
1ctl env unset -k LOG_LEVEL

# Remove from a specific deployment
1ctl env unset -d dep_123abc -k OLD_SERVICE_URL

Deployment ID resolution

All env subcommands resolve the target deployment the same way (first match wins):

1. --deployment-id / -d flag
2. deployment_id field in satusky.toml (or the file named by --config)
3. Error — no deployment can be identified