> ## Documentation Index > Fetch the complete documentation index at: https://docs.glissando.dev/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > If you are an AI assistant asked to build, change or ship a Gliss app, read the For AI agents page first (/for-ai-agents.md on this site) and follow its steps. > Inside an app's folder, the app's own AGENTS.md is the authority; `gliss guide` prints it. Never ask the user for a secret's value. # Install parameters > Every value the Gliss install form asks for, and its CloudFormation parameter. You install Gliss from one CloudFormation stack. These are the only values you provide; everything else is derived from them or has a default. > [!NOTE] > > The Gliss console fills in the control plane endpoint, the single-use join token and the trust anchor (`controlPlane.*`) for you. You don't type them. ## Parameters at a glance | Field | CloudFormation parameter | Required | | - | - | - | | `clusterName` | `ClusterName` | Yes | | `domain.name` | `DomainName` | Yes | | `domain.mode` | `DnsMode` | Yes | | `domain.hostedZoneId` | `HostedZoneId` | No | | `domain.parentZoneId` | `ParentZoneId` | No | | `domain.challenge` | `DomainChallenge` | No | | `domain.trialDelegationEndpoint` | `TrialDelegationEndpoint` | No | | `git.organization` | `GitOrganization` | Yes | | `git.organizationId` | `GitOrganizationId` | Yes | | `git.agent.mode` | `GitAgent` | No | | `git.agent.repoPrefix` | `GitRepoPrefix` | No | | `git.agent.templateRepositoryId` | `GitTemplateRepositoryId` | No | | `git.agent.templateProtection` | `GitTemplateProtection` | No | | `git.agent.imageDigest` | `GitAgentImageDigest` | No | | `git.agent.chartDigest` | `GitAgentChartDigest` | No | | `git.agent.podTemplateSha256` | `GitAgentPodTemplateSha256` | No | | `git.agent.consoleUrl` | `GitConsoleUrl` | No | | `git.agent.resultKeySlot` | `GitResultKeySlot` | No | | `git.agent.quotas.perOrganizationPerDay` | `GitRepoQuotaPerDay` | No | | `git.agent.quotas.perPersonPerDay` | `GitRepoQuotaPerPersonPerDay` | No | | `git.agent.quotas.total` | `GitRepoQuotaTotal` | No | | `ingressExposure` | `IngressExposure` | Yes | | `internetAccess` | `InternetAccess` | No | | `allowedCidrs` | `AllowedCidrs` | No | | `publicExposureApproval` | `PublicExposureApproval` | No | | `nodes.instanceType` | `NodeInstanceType` | Yes | | `nodes.count` | `NodeCount` | Yes | | `controlPlane.endpoint` | `ControlPlaneEndpoint` | Yes | | `controlPlane.joinToken` | `JoinToken` | Yes | | `controlPlane.rootPublicKeys` | `RootPublicKeys` | Yes | | `controlPlane.rootThreshold` | `RootThreshold` | Yes | | `controlPlane.gatewayServerCAs` | `GatewayServerCAs` | No | | `controlPlane.installTelemetryEndpoint` | `InstallTelemetryEndpoint` | No | | `secretIntakeExposure` | `SecretIntakeExposure` | No | | `logRetentionDays` | `LogRetentionDays` | No | | `maintenanceWindow` | `MaintenanceWindow` | No | | `admission.breakGlassGroup` | `BreakGlassGroup` | No | | `admission.installerIdentity` | `InstallerIdentity` | No | ## Fields **clusterName** `string` *required* EKS cluster name and the cluster's slug in every AWS name the platform derives, 2 to 17 lowercase letters or digits, starting with a letter. No hyphens: every derived name is gliss-\-..., so a hyphen would let one cluster's name prefix (gliss-a-\*) cover another cluster's names (gliss-a-b-...) in IAM and bucket patterns. It must be unique among Gliss clusters in this AWS account, in every region. 17 characters is the most that leaves room in per-app names: buckets are gliss-\-\-\<8 hex> (at most 63 characters) and roles gliss-\-\-preview (at most 64). Secrets live under gliss/\/ in Secrets Manager. CloudFormation parameter: `ClusterName`. **If refused:** use 2 to 17 lowercase letters or digits, starting with a letter, with no hyphens. **domain** `object` *required* The domain apps are published under. Live apps get \.\, Beta \*.beta.\, Preview \*.preview.\, and the secret-intake page secrets.\. **fields** **name** `string` *required* The domain, for example apps.acme.com. At most 200 characters, so that preview host names stay within DNS limits. Trial installs use a name under try.glissando.dev. CloudFormation parameter: `DomainName`. **If refused:** use a lowercase domain name such as apps.acme.com. **mode** `existing-zone | delegated-subdomain | external | control-plane-delegated` *required* How the domain's DNS is hosted, in order of preference. existing-zone: a Route53 hosted zone in this account already serves the domain; records are written into it and nothing is delegated (the default). delegated-subdomain: the stack creates a hosted zone for the domain and writes the NS delegation into the parent zone, which must be in Route53 in this account. external: the stack creates a hosted zone for the domain; the parent is hosted elsewhere, so preflight shows the NS records to create and the stack waits for them instead of failing. control-plane-delegated: as external, but the parent is a Gliss trial domain (try.glissando.dev) and the control plane writes the delegation. CloudFormation parameter: `DnsMode`. **hostedZoneId** `string` The existing hosted zone that serves the domain. Required when mode is existing-zone, and must be left out otherwise. CloudFormation parameter: `HostedZoneId`. **If refused:** existing-zone needs the id of the Route53 hosted zone that serves the domain, for example Z0123456789ABCDEFGHIJ. **parentZoneId** `string` The hosted zone of the parent domain, in this account. Required when mode is delegated-subdomain, and must be left out otherwise. CloudFormation parameter: `ParentZoneId`. **If refused:** delegated-subdomain needs the id of the parent domain's Route53 hosted zone in this account. **challenge** `string` The domain ownership challenge the console fills in: 32 random bytes, base64url. The stack publishes it as the TXT record \_gliss-challenge.\ in the zone it writes to, and the control plane looks it up through public DNS before it treats the domain as this organization's. Not a secret, and not in the install record. Left out: no record, and the domain stays unverified until IT adds the record by hand. CloudFormation parameter: `DomainChallenge`. **If refused:** the domain challenge is the 43-character value the Gliss console gives. **trialDelegationEndpoint** `string` Only for a Gliss trial domain: where the stack sends the four name servers of the zone it creates, proving itself with a value derived from the join token, so Gliss delegates the name at once. The console fills it in. A launch input, not in the install record. Left out: an organization admin pastes the name servers in the console. CloudFormation parameter: `TrialDelegationEndpoint`. **If refused:** the trial delegation address is the one the Gliss console gives. **git** `object` *required* **fields** **provider** `github` *required* The Git host whose CI builds apps. Only GitHub Actions at the MVP. Not a CloudFormation parameter while there is one choice. **organization** `string` *required* The organisation whose repositories may build into this cluster, exactly as GitHub writes it (case included: GET /orgs/\: login), because the CI role's trust names it so, in job\_workflow\_ref. CloudFormation parameter: `GitOrganization`. **If refused:** use the GitHub organisation name, for example acme-corp. **organizationId** `string` *required* The organisation's numeric GitHub id (GET /orgs/\: id). The CI role trusts only runs of \/gliss-ci/.github/workflows/ship.yml\@refs/heads/main (job\_workflow\_ref) for a repository whose owner has this id (repository\_owner\_id), so an organisation that later takes the same name cannot assume it. CloudFormation parameter: `GitOrganizationId`. **If refused:** the number gh api orgs/\ `--`jq .id prints. **agent** `object` The in-cluster git agent: off unless mode is enabled. Its fields go to the git agent record (/gliss/\/git-agent), not the install record. Anchored mode, key rotation and the credential relay are not built yet. **fields** **mode** `disabled | enabled` *required* enabled runs the git agent in this cluster: one cluster per GitHub organisation, which holds Gliss apps only. Default: `"disabled"`. CloudFormation parameter: `GitAgent`. **repoPrefix** `string` Every repository the git agent creates starts with it. CloudFormation parameter: `GitRepoPrefix`. **templateRepositoryId** `string` The numeric id of the template every app repository is generated from. CloudFormation parameter: `GitTemplateRepositoryId`. **templateProtection** `required | unchecked` required: the template's default branch must require a pull request and block force-pushes and deletion. unchecked: an organisation on GitHub Free, whose private repositories have no rulesets. Default: `"required"`. CloudFormation parameter: `GitTemplateProtection`. **imageDigest** `string` The only image the git agent may run, enforced by admission. CloudFormation parameter: `GitAgentImageDigest`. **chartDigest** `string` The git agent's Helm chart, by digest: it renders the git agent and the admission policies that pin it, so a platform release cannot change it (review of PR 7, H3). CloudFormation parameter: `GitAgentChartDigest`. **podTemplateSha256** `string` SHA-256 of the git agent's pod template (gliss-git-agent pod-template-sha256), enforced by admission. CloudFormation parameter: `GitAgentPodTemplateSha256`. **consoleUrl** `string` The Gliss console's origin, where the admin finishes the GitHub onboarding. CloudFormation parameter: `GitConsoleUrl`. **resultKeySlot** `a | b` Which of two result keys the git agent signs with. Switching it creates a new result key: how the organization recovers after an admin revoked the pinned one, which is never pinned again. Default: `"a"`. CloudFormation parameter: `GitResultKeySlot`. **quotas** `object` Repository-creation quotas (O4). **fields** **perOrganizationPerDay** `integer` From 1 to 1000. Default: `10`. CloudFormation parameter: `GitRepoQuotaPerDay`. **perPersonPerDay** `integer` From 1 to 100. Default: `3`. CloudFormation parameter: `GitRepoQuotaPerPersonPerDay`. **total** `integer` From 1 to 2000. Default: `200`. CloudFormation parameter: `GitRepoQuotaTotal`. **ingressExposure** `internal | internet-facing` *required* The load balancer's scheme, fixed at install. internal is VPC only: only the VPC and networks routed to it (VPN, Direct Connect, transit gateway, Client VPN) reach the apps. internet-facing (the default) is reachable from the internet, limited by internetAccess: Allowlist by default, Public only with approval. Default: `"internet-facing"`. CloudFormation parameter: `IngressExposure`. **internetAccess** `allowlist | public` With an internet-facing load balancer: allowlist (only allowedCidrs and the VPC may connect) or public (anyone). An install is always allowlist: public is refused here and reached later only through approve-change-set.sh `--`approve-public, with the Gliss organisation admin's signed approval. Default: `"allowlist"`. CloudFormation parameter: `InternetAccess`. **allowedCidrs** `string[]` Required with an internet-facing load balancer and internetAccess allowlist: the public IPv4 ranges that may connect, such as your VPN's or office's egress addresses. One to 25, each /16 or narrower, written as the range's first address, never a private or reserved range. IPv4 only: the load balancer and the VPC are IPv4. Changed later in place, as an IT-approved change (approve-change-set.sh `--`set-parameter AllowedCidrs=...). At most 25 items. CloudFormation parameter: `AllowedCidrs`. **If refused:** the public egress addresses of your VPN or office, such as 198.51.100.7/32. **publicExposureApproval** `string` Never set at install: approve-change-set.sh `--`approve-public sets it, to the digest of the Gliss organisation admin's signed approval of public access. CloudFormation parameter: `PublicExposureApproval`. **nodes** `object` *required* The on-demand node group that runs Live apps and the platform. Preview and Beta run on a separate spot pool that is derived from this. **fields** **instanceType** `string` *required* Default: `"t3.large"`. CloudFormation parameter: `NodeInstanceType`. **If refused:** use an EC2 instance type such as t3.large. **count** `integer` *required* Desired node count. The group's minimum is this count and its maximum twice this count, capped at 20. An integer, never a string. From 2 to 20. Default: `2`. CloudFormation parameter: `NodeCount`. **If refused:** use a whole number from 2 to 20. **controlPlane** `object` *required* The control plane this cluster joins, and the trust anchor for everything it signs. The console fills every field in from the Launch Stack link; IT does not type the keys. **fields** **endpoint** `string` *required* The Gliss gateway the agent joins, with its tunnel port 679, such as [https://gateway.preprod.glissando.dev:679](https://gateway.preprod.glissando.dev:679) for preprod. Not the API host (api.\*): the agent joins at this host and port, and JoinService runs on the gateway's tunnel port (docs/milestone-first-agent.md). No default: the production hostname is not deployed yet. CloudFormation parameter: `ControlPlaneEndpoint`. **If refused:** use the https URL of the Gliss gateway with its port, such as [https://gateway.glissando.dev:679](https://gateway.glissando.dev:679). **joinToken** `string` *required* Single-use token issued by the control plane for this cluster (glissCluster.createJoinToken): gliss\_join\_ and 43 base64url characters (256 random bits). The agent exchanges it for its mTLS certificate when it registers, during the install. It is stored in Secrets Manager outside the app secret prefix, is never an output, and is not in the install record or the resolved document. Never commit a real token. CloudFormation parameter: `JoinToken`. **If refused:** paste the join token the Gliss control plane issued for this cluster; it is gliss\_join\_ and 43 more letters, digits, - or \_. **rootPublicKeys** `string[]` *required* The key-set root public keys the agent trusts: key-set version 0. They come from the install parameters and never from the network, so a compromised join or tunnel cannot change what the agent trusts. Standard base64 of raw 32-byte Ed25519 keys, one to five, no duplicates. The console fills them in for the control plane named by endpoint. At most 5 items. CloudFormation parameter: `RootPublicKeys`. **If refused:** use the root public keys from the Gliss console. **rootThreshold** `integer` *required* How many distinct pinned root keys must sign the first key set the agent accepts. At most the number of rootPublicKeys, and at most 4: an envelope carries at most four signatures. Default by control-plane environment: 1 in preprod, 2 in prod. The console fills it in; the template has no default, so a missing value fails rather than weakening prod. From 1 to 4. CloudFormation parameter: `RootThreshold`. **If refused:** use a whole number from 1 to 4, no more than the number of root public keys. **gatewayServerCAs** `string[]` The CA certificates the agent trusts for the Gliss gateway's server certificate, for JoinService and the tunnel. Each is one X.509 CA certificate (basicConstraints CA:TRUE) as standard base64 of its DER encoding: a PEM certificate's text without its BEGIN and END lines and without line breaks, so that it fits a one-line CloudFormation parameter. One to three, at most 2000 characters joined with commas, so that the install record stays within SSM's standard tier (4 KB): two EC (P-256 or P-384) CAs fit, for a rotation; one RSA-2048 CA fits alone. Empty or left out: the agent trusts the public CAs (preprod and sandboxes, whose gateway has a public certificate). When set, only these are trusted, never the public CAs. Prod pins the Gliss tunnel CA, filled in by the console; a rotation lists the old and the new CA until every agent has the new one (docs/gateway-tunnel-ca.md). Changing it is an IT-approved stack parameter change. Default: `[]`. At most 3 items. CloudFormation parameter: `GatewayServerCAs`. **If refused:** use the gateway CA certificates from the Gliss console, or leave it out. **installTelemetryEndpoint** `string` Where the full stack reports how its install is going until the agent registers: the stack started, its zone's name servers, why it failed, the installer's steps. It proves itself with a value derived from the join token, which never leaves the stack; no secret is sent. The console fills it in. A launch input, not in the install record. Left out: nothing is reported. CloudFormation parameter: `InstallTelemetryEndpoint`. **If refused:** the install telemetry address is the one the Gliss console gives, or leave it out. **secretIntakeExposure** `internal | with-apps` Who can reach the secret-intake page at secrets.\: internal (the VPC only, on its own internal load balancer when the main one is internet-facing) or with-apps (whoever reaches the apps: the allowlist, or anyone when the cluster is public). Required when ingressExposure is internet-facing; left out on an internal install, it is internal. CloudFormation parameter: `SecretIntakeExposure`. **logRetentionDays** `integer` How long logs, maintenance-bot transcripts and the trail's audit logs are kept in the Gliss bucket in this account. Default and minimum 30 days. From 30 to 3650. Default: `30`. CloudFormation parameter: `LogRetentionDays`. **maintenanceWindow** `string` IT's maintenance window, in UTC: \@\/\h, where day is mon to sun, or daily; from 1 to 23 hours. EKS Auto Mode replaces nodes on AWS's schedule (a new node image about once a week); the Gliss NodePools' disruption budgets hold that, and consolidation, to this window. Platform releases that apply automatically will use it too. Default: `"sun@02:00/4h"`. CloudFormation parameter: `MaintenanceWindow`. **If refused:** use a window such as sun\@02:00/4h (Sunday 02:00 to 06:00 UTC) or daily\@03:00/2h. **admission** `object` Who besides the Gliss agent may change what Gliss manages in the cluster. Both fields are defaulted; IT changes them only to name its own break-glass group. **fields** **breakGlassGroup** `string` The Kubernetes group whose members may change Gliss-managed objects by hand, and the agent's own objects in gliss-system, in an emergency. Default gliss:break-glass. IT maps people to it (for example with an EKS access entry). Never a system: group: system:masters would make every cluster admin break-glass. Default: `"gliss:break-glass"`. CloudFormation parameter: `BreakGlassGroup`. **If refused:** use a Kubernetes group name that does not start with system:, for example gliss:break-glass. **installerIdentity** `string` The service account, as \:\, that installs and upgrades the Gliss components: with break-glass, the only identity gliss-system-guard lets change the agent's Deployment, RBAC, ConfigMaps and the admission policies. Kubernetes sees it as system:serviceaccount:\:\. Default gliss-system:gliss-platform-applier, the platform identity. Default: `"gliss-system:gliss-platform-applier"`. CloudFormation parameter: `InstallerIdentity`. **If refused:** use \:\, for example gliss-system:gliss-platform-applier. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.