Plan and Apply a Few Resources
Show the whole prompt
Read https://intentius.io/chant/guide/resource-targeting/.
Pick one terraform-apply or kubectl-apply component in this project and one address it declares.
Run `npx chant components fan-out --base origin/main --target <component>:<address> --wave-gate review --dry-run` and show me what it would plan, then the same without `--target`.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.Optional: hand this page to your coding agent
Read https://intentius.io/chant/guide/resource-targeting/.Pick one terraform-apply or kubectl-apply component in this project and one address it declares.Run `npx chant components fan-out --base origin/main --target <component>:<address> --wave-gate review --dry-run` and show me what it would plan, then the same without `--target`.Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.--member and --wave pick whole components. --target goes one step finer and picks resources inside a component (#4300). Use it to apply one fix to a big root, or to roll one object of a manifest ahead of the rest.
The flag and the targets field on a capability need chant 0.124.42 or newer, and the verbs of a lexicon built against an older core refuse every target because they set no targets field.
Name the targets
Section titled “Name the targets”Pass --target <component>:<address> to chant components fan-out or chant run --components. Repeat it for more addresses. The address is everything after the first colon, so an address may hold colons of its own (source).
chant components fan-out --base origin/main --env prod --wave-gate release \ --target network:aws_vpc.main --target network:aws_subnet.privatechant run --components web --env dev --target web:Deployment/dev/webA target must name a component the run selects. One it does not select refuses the run before anything plans (fan-out, run). Components with no --target plan and apply in full.
Which steps accept targets
Section titled “Which steps accept targets”Each capability says whether it can narrow. A component given addresses refuses before it plans or runs when any of its steps can’t. The refusal names the verb and says why (source). A verb that says nothing refuses too (source).
| Verb | Targets | What an address names |
|---|---|---|
terraform-apply | accepts | A resource or module address, passed to plan as -target (source). The saved plan holds those addresses and what they depend on, and the apply applies that file. A choudoufu root plans with plan -target, not as a one-root set (source). |
kubectl-apply | accepts | One object, Kind/namespace/name or Kind/name. The plan and the apply send only the named documents (source). The prune is off, since a prune over a narrowed set would delete every owned object the targets leave out (source). An address the manifest does not declare refuses. |
cfn-deploy | refuses | A change set covers the whole stack (source). |
helm-upgrade | refuses | helm upgrade applies the whole release (source). |
Any other verb refuses until its capability sets targets: "accept" and narrows its plan and run.
What an approval covers
Section titled “What an approval covers”The addresses join the digest a gate binds, so an approval of a narrowed plan covers that plan and no other.
Under --wave-gate, each member’s digest is the digest over its plan’s digest and its sorted addresses (source). A plan that does not give back the addresses it was asked for refuses (source). Under --gate, the set’s digest takes in every component’s addresses (source). The --resume record keys on the same digest (source), so a record made with other addresses does not carry over. A gate step inside a component binds them too (source).
A run without --target has the digests it had before. An approval of the full plan never covers a narrowed run, and the reverse holds too. Approve the digest the narrowed run prints.
Limits
Section titled “Limits”chant components pr-plan and pr-apply take no --target yet. The generated pull-request jobs plan every component in full.