Using the Tanzu Service Mesh CLI, you can apply the configuration from a declarative manifest file to your Tanzu Service Mesh tenant. After the configuration is applied, a defined object, such as a global namespace, or a defined policy, such as an access control policy, is created or updated on the clusters that match the selection criteria in the configuration.

To apply a manifest file, the Tanzu Service Mesh CLI sends it to API Gateway, a single entry point into the Tanzu Service Mesh API in Tanzu Service Mesh SaaS.

API Gateway receives the manifest file and applies the configuration to those of your clusters that match the cluster and namespace selection criteria in the manifest file. If an object (such as a global namespace) or a policy (such as an access control policy) with the name defined in the configuration does not exist in a cluster, that object or policy gets created. If an object or a policy with this name exists in a cluster, the object or policy gets updated.

  • This procedure provides instructions on how to apply a manifest manually. If you want the CLI to run automatically whenever changes to the manifest files are merged in the Git repo, set up a CI/CD pipeline. Make sure that you supply the Tanzu Service Mesh CLI to the pipeline runner. On changes to the manifest files, the pipeline will automatically trigger the CLI to apply the configuration changes to your Tanzu Service Mesh tenant.

  • To recreate your entire Tanzu Service Mesh environment, apply all the manifest files (global namespace and policy configurations) at once to Tanzu Service Mesh SaaS.



  1. In a terminal window, change to the local folder where you cloned the manifest files from the Git repository.
  2. To apply the manifest YAML file that you want, run the following CLI command.
    tsm apply -f {manifest YAML file}

    Where {manifest YAML file} is the name of the manifest YAML file.

    To apply a manifest file with a name of my-global-namespace-configuration, run the following command.

    tsm apply -f  my-global-namespace-configuration.yaml


When the object or policy is created as a result of applying the configuration, the command returns {object} created or {policy} created in the output.

When a global namespace configuration is applied, the command returns several created lines for the different configurations that make up the global namespace.


If the configuration from the manifest file was not failed because of an error, the command returns failure. To determine the exact error, run the tsm apply command with the debug flag. For more information, see Debug Problems with a Manifest File.