Configuration

kernstack init and kernstack use write credentials for you. kernstack current shows which account, profile, and project are active.

Credentials file

~/.kernstack/credentials holds one profile per environment:

[my-app.default]
access_key_id = ks_abc123
access_key_secret = ks_secret_xyz
dzone = eu-preview-2

kernstack use qa pins a profile for the project in .kernstack/config.

CI

Skip browser login and pass a key from Settings → Access keys:

export KERNSTACK_ACCESS_KEY_ID=...
export KERNSTACK_ACCESS_KEY_SECRET=...
export KERNSTACK_DZONE=eu-preview-2
kernstack deploy

Or select a saved profile with KERNSTACK_PROFILE=my-app.qa.

Resolution order

1. --profile flag
2. KERNSTACK_PROFILE
3. profile in the project's .kernstack/config
4. Saved default in ~/.kernstack/current_profile
5. [default] in ~/.kernstack/credentials
6. KERNSTACK_ACCESS_KEY_ID / KERNSTACK_ACCESS_KEY_SECRET / KERNSTACK_DZONE

Non-empty KERNSTACK_ACCESS_KEY_* / KERNSTACK_DZONE values override the active profile, except when the project pins a profile — then they only fill empty fields.

The active profile also selects the stack.<env>.json overlay.