Catalog

The catalog is the menu IT publishes for one Gliss organisation or cluster: which capabilities, sizes and runtimes apps may ask for, how many of each, who an app may be shown to, how Preview and Beta behave when idle, and what Publish to Live requires. Every gliss.yaml is checked against it before anything is built, and refusals name it as <metadata.name>@<metadata.revision>, for example acme@3. Charts, chart versions and the Postgres major version are not in the catalog: they are pinned by the platform release, which IT approves separately. Some values are fixed and appear here as constants so that IT can see them; changing them needs a new contract version, not an edit. Email (SES), connections to SaaS accounts and managed Postgres (RDS) are not offered in v1.

Sections

metadata

string

required

Short name of the catalog, usually the customer, for example acme. Refusals cite it.

integer

required

Increases by one on every published edit. Refusals cite it (acme@3), so a builder’s LLM can tell which menu it was checked against. The control plane rejects a document whose revision is not greater than the one it holds.At least 1.

string

At most 500 characters.

capabilities

Every capability type gliss.yaml v1 can name, and whether this catalog offers it. A type that is not offered is refused with the list of offered ones. Each entry carries the catalog entry’s own version (postgres@1); a platform release that deprecates a version raises a capability-version-eol finding.

object

required

Show fields

boolean

required

integer

required

At least 1.

object

required

Live database sizes this catalog offers. The instance counts are fixed: small is one instance, standard is two for high availability. IT can remove a size and set the storage. Preview and Beta always use the shared stage Postgres.

Show fields

object

Show fields

required

string

required

object

Show fields

required

string

required

small | standard

required

Size used when gliss.yaml leaves size out. Must be one of the offered sizes.

integer

required

From 1 to 3.

object

required

Postgres major versions the platform release supports, each with the extensions an app may ask for. The platform release decides which major a database runs; this list says what is allowed on each.

string

required

The major new databases get, and the one gliss.yaml extensions are checked against. Must be a key of majors.

object

required

An in-cluster Redis cache per stage. Not durable.

Show fields

boolean

required

integer

required

At least 1.

object

required

Show fields

object

Show fields

string

required

object

Show fields

string

required

small | standard

required

integer

required

From 1 to 3.

object

required

Show fields

boolean

required

integer

required

At least 1.

integer

required

From 1 to 10.

object

required

Show fields

boolean

required

integer

required

At least 1.

required

An app has one Live address in v1.

string[]

required

First labels no app may take. Must include secrets; preview and beta are reserved by the stage gateway and are always refused whatever this list says. IT can add more, such as www or mail.If refused: reservedNames must include secrets, which the secret-intake page uses.

object

required

Show fields

boolean

required

integer

required

At least 1.

required

array

required

Live audiences an app may ask for. org: the whole organisation. group: named identity-provider groups (group:<name>). public: anyone; even when allowed here, publishing a public app needs IT approval unless publish.approval says otherwise.

object

required

Show fields

boolean

required

integer

required

At least 1.

required

array

required

Healer levels apps may ask for. auto is allowed only when maintenance.tier is managed. Usually a prefix of observe, propose, auto.

false

required

Maintenance is never on unless the app asks for it in gliss.yaml.

secrets

Limits on declared secrets and secret requests.

integer

required

From 0 to 100.

boolean

required

Whether a request link may be forwarded to a guest outside the organisation. Guests may only ever set credential secrets; endpoint secrets always need a signed-in member.

integer

required

How long a single-use request link works. sets 72 hours; IT may shorten it, not lengthen it.From 1 to 72.

config

Limits on gliss.yaml config values, per stage after overrides are applied.

integer

required

How many config values one stage of an app may have.From 0 to 100.

integer

required

Total size of one stage’s config, counting names and values.From 1024 to 65536.

egress

Rules for the hostnames apps list under gliss.yaml egress. The platform enforces the result with network policy.

integer

required

From 0 to 50.

boolean

required

Whether an app may list *.example.com.

boolean

required

Whether an app may list IP addresses or ranges.

array | null

required

null: any public hostname not blocked is approved. A list: only these hostnames, or hostnames under a listed *.domain, are approved.

string[]

required

Hostnames, or *.domain patterns, no app may list.

runtimes

Runtimes a component may name. A runtime with a dev variant reloads in Preview through Git-backed sync; one without rebuilds on each change. Each entry in runtimes has:

string

required

any

required

quotas

integer

required

From 1 to 20.

integer

Optional cap on live Preview namespaces per builder, across apps.At least 1.

object

required

The ResourceQuota each stage namespace gets.

Show fields

object

required

Show fields

integer

required

At least 1.

string

required

string

required

string

required

string

required

object

required

Show fields

integer

required

At least 1.

string

required

string

required

string

required

string

required

object

required

Show fields

integer

required

At least 1.

string

required

string

required

string

required

string

required

stages

Lifecycle defaults per stage. Scale-to-zero for Preview and Beta is mandatory and cannot be switched off, only tuned.

object

required

Show fields

integer

required

From 5 to 240. Default: 30.

integer

required

From 1 to 30. Default: 7.

mock | request

required

Default: "mock".

object

required

Show fields

integer

required

From 5 to 240. Default: 30.

mock | request

required

Default: "request".

object

required

Show fields

request

required

Every secret declared for Live is requested, and must be set before Publish.

publish

What Publish (Beta to Live) requires. The gates marked const are fixed. The approval policy is the organisation default; IT can tighten or loosen it per app in the console.

object

required

Show fields

true

required

integer

required

How long Beta must have run the release and stayed healthy before it can be published. Default 10 minutes; IT can change it.From 0 to 10080. Default: 10.

true

required

true

required

object

required

Show fields

owner | it

required

owner: the app owner publishes their own app. it: every Publish needs IT approval.

object

required

Cases that need IT approval even when the default is owner. defaults all three to true.

Show fields

boolean

required

The app’s audience is public.

boolean

required

The app declares an endpoint secret.

boolean

required

The project is at level 2 (custom charts).

levels

Which levels projects may use. Level 0 (gliss.yaml only) is always on.

object

required

Level 1: gliss.yaml plus garden.yml using Gliss action types. Validated against this same catalog.

Show fields

boolean

required

object

required

Level 2: the team’s own charts, checked against IT’s policy instead of the catalog. Post-MVP. Off by default, and enabled per project by IT or a system owner.

Show fields

boolean

required

string[]

required

Repositories (<organisation>/<repository>) that may use level 2. Must be empty while offered is false.

maintenance

Which maintenance tier the customer has. Set from the subscription; IT cannot raise it by editing the catalog.

self-maintained | managed

required

self-maintained: IT’s LLM or people act on findings. managed: Gliss maintenance bots do. The healer level auto needs managed.

Example

The example catalog acme@3, which every gliss.yaml example in these docs is checked against.

example.catalog.json

{
  "apiVersion": "gliss.dev/catalog/v1",
  "kind": "Catalog",
  "metadata": {
    "name": "acme",
    "revision": 3,
    "description": "Example catalog for a design partner at the MVP. The gliss.yaml fixtures are checked against it."
  },
  "capabilities": {
    "postgres": {
      "offered": true,
      "version": 1,
      "sizes": {
        "small": {
          "instances": 1,
          "storage": "10Gi"
        },
        "standard": {
          "instances": 2,
          "storage": "20Gi"
        }
      },
      "defaultSize": "small",
      "maxPerApp": 1,
      "majors": {
        "17": {
          "extensions": ["vector", "pg_trgm", "uuid-ossp", "pgcrypto", "citext", "hstore"]
        },
        "16": {
          "extensions": ["vector", "pg_trgm", "uuid-ossp", "pgcrypto", "citext"]
        }
      },
      "defaultMajor": "17"
    },
    "redis": {
      "offered": true,
      "version": 1,
      "sizes": {
        "small": {
          "memory": "256Mi"
        },
        "standard": {
          "memory": "1Gi"
        }
      },
      "defaultSize": "small",
      "maxPerApp": 1
    },
    "bucket": {
      "offered": true,
      "version": 1,
      "maxPerApp": 3
    },
    "hostname": {
      "offered": true,
      "version": 1,
      "maxPerApp": 1,
      "reservedNames": ["secrets", "www", "mail"]
    },
    "sso": {
      "offered": true,
      "version": 1,
      "maxPerApp": 1,
      "audiences": ["org", "group", "public"]
    },
    "healer": {
      "offered": true,
      "version": 1,
      "maxPerApp": 1,
      "levels": ["observe", "propose"],
      "defaultEnabled": false
    }
  },
  "secrets": {
    "maxPerApp": 20,
    "guestLinks": true,
    "requestLinkTtlHours": 72
  },
  "config": {
    "maxPerApp": 50,
    "maxTotalBytes": 16384
  },
  "egress": {
    "maxPerApp": 20,
    "allowWildcards": false,
    "allowIpAddresses": false,
    "approvedDomains": null,
    "blockedDomains": ["pastebin.com", "*.ngrok.io", "*.ngrok-free.app", "transfer.sh"]
  },
  "runtimes": [
    {
      "name": "python",
      "devVariant": {
        "reload": "uvicorn --reload",
        "reinstallOn": ["requirements.txt", "pyproject.toml"]
      }
    },
    {
      "name": "vite",
      "devVariant": {
        "reload": "Vite hot module replacement",
        "reinstallOn": ["package.json"]
      }
    },
    {
      "name": "node",
      "devVariant": null
    },
    {
      "name": "go",
      "devVariant": null
    },
    {
      "name": "static",
      "devVariant": null
    }
  ],
  "quotas": {
    "componentsPerApp": 6,
    "previewsPerBuilder": 5,
    "namespace": {
      "preview": {
        "pods": 4,
        "cpu": "2",
        "memory": "4Gi",
        "containerCpu": "1",
        "containerMemory": "1Gi"
      },
      "beta": {
        "pods": 8,
        "cpu": "4",
        "memory": "8Gi",
        "containerCpu": "2",
        "containerMemory": "2Gi"
      },
      "live": {
        "pods": 8,
        "cpu": "4",
        "memory": "8Gi",
        "containerCpu": "2",
        "containerMemory": "2Gi"
      }
    }
  },
  "stages": {
    "preview": {
      "scaleToZeroAfterIdleMinutes": 30,
      "deleteAfterIdleDays": 7,
      "secretsDefault": "mock"
    },
    "beta": {
      "scaleToZeroAfterIdleMinutes": 30,
      "secretsDefault": "request"
    },
    "live": {
      "secretsDefault": "request"
    }
  },
  "publish": {
    "gates": {
      "ciGreen": true,
      "betaHealthyMinutes": 10,
      "noBlockingFindings": true,
      "liveSecretsSet": true
    },
    "approval": {
      "default": "owner",
      "itApprovalWhen": {
        "publicAudience": true,
        "endpointSecrets": true,
        "customLevel": true
      }
    }
  },
  "levels": {
    "composed": {
      "offered": true
    },
    "custom": {
      "offered": false,
      "enabledProjects": []
    }
  },
  "maintenance": {
    "tier": "self-maintained"
  }
}

Files

Tools

Sections

metadata

capabilities

secrets

config

egress

runtimes

quotas

stages

publish

levels

maintenance

Example

​Sections

​metadata

​capabilities

​secrets

​config

​egress

​runtimes

​quotas

​stages

​publish

​levels

​maintenance

​Example

Sections

metadata

capabilities

secrets

config

egress

runtimes

quotas

stages

publish

levels

maintenance

Example