Environment variable support

[JoshMock]

CI systems often optimize for using environment variables rather than config files or CLI arguments. Some more important values that appear in the CLI's config.yml (namely, URLs and credentials) should be possible to set via environment variables.

[github-actions]

tl;dr: elastic/cli currently does not support environment-variable overrides for context URL/credential fields used by runtime commands, so issue #73 is valid; the clean fix is to add one centralized context-resolution layer that merges env vars with explicit precedence.

Recommendation

Implement environment-variable overrides for active context connection/auth fields via a single resolver in internal/config, and have all runtime command entrypoints use that resolver instead of each duplicating context selection.

Findings

• Config load path is file-only today: internal/config/config.go:52-77 reads YAML and returns contexts; no env merge step.
• Runtime commands resolve context from rootContext/current-context then directly read cfg.Contexts[ctxName], e.g. cmd/esql.go:46-57, and this pattern is repeated in:
  • cmd/api.go:78-85
  • cmd/get_run.go:27-35
  • cmd/kb_dashboard.go:123-131
  • cmd/kb_task_manager.go:46-54
  • cmd/agent_builder.go:40-48
• Client auth/URL construction only consumes config.Context fields:
  • internal/client/client.go:107-131 (elasticsearch_url else cloud_id)
  • internal/client/auth.go:11-21 (api_key else username/password)
• Existing env reads are telemetry-only:
  • internal/telemetry/telemetry.go:68-75 reads TRACEPARENT/TRACESTATE/BAGGAGE.
• Docs already scope env substitution to OTel config, not context auth/URL:
  • docs/config.md:98-100
• docs/auth.md:155 explicitly labels ELASTIC_API_KEY as future behavior.

Verification

I ran targeted checks in the workspace:

$ rg -n "os\.Getenv\(|LookupEnv\(" .
./internal/telemetry/telemetry.go:71:        value := strings.TrimSpace(os.Getenv(key))
...

$ go test ./internal/config ./internal/client ./cmd
ok      github.com/elastic/cli/internal/config   (cached)
ok      github.com/elastic/cli/internal/client   (cached)
ok      github.com/elastic/cli/cmd               (cached)

$ XDG_CONFIG_HOME=/tmp/gh-aw/agent/envcheck ELASTIC_CLOUD_ID='name:...' ELASTIC_API_KEY='abc' go run ./cmd/elastic es cluster health -f json
Error: context must set either elasticsearch_url or cloud_id
exit status 1

That last run demonstrates env vars are currently ignored for context resolution.

Detailed Action Plan

1. Add a resolver in internal/config (e.g. ResolveContext(cfg Config, selected string) (Context, error)) that:
   • chooses context by --context (if set) else current-context
   • merges env overrides into the selected context.
2. Implement env mapping for the issue scope (URLs + credentials), e.g.:
   • ELASTIC_CLOUD_ID
   • ELASTIC_ELASTICSEARCH_URL
   • ELASTIC_KIBANA_URL
   • ELASTIC_API_KEY
   • ELASTIC_USERNAME
   • ELASTIC_PASSWORD
3. Define and document precedence explicitly:
   • explicit command selection (--context) for choosing context
   • env overrides for selected context fields
   • persisted config values as fallback
   • existing client behavior (api_key before basic auth) remains unchanged.
4. Replace duplicated context-selection blocks in command files with the resolver (cmd/esql.go, cmd/api.go, cmd/get_run.go, cmd/kb_dashboard.go, cmd/kb_task_manager.go, cmd/agent_builder.go).
5. Add table-driven tests:
   • resolver precedence tests in internal/config
   • command/client regression tests to ensure URL/auth behavior remains correct after merge.
6. Update docs:
   • docs/config.md and README.md with env var names, precedence, and a CI example.

Related Items

Type	Link	Relevance
Issue	#73	Requested feature
Issue	#75	Adjacent config initialization/validation work
PR	#48	Refactor introduced reusable command/config patterns this should hook into
File	internal/config/config.go:52-77	Current config load path (no env merge)
File	cmd/esql.go:46-57	Representative runtime context selection
File	internal/client/client.go:107-131	URL resolution and failure path
File	internal/client/auth.go:11-21	Credential precedence logic
File	docs/config.md:98-100	Current env behavior docs (OTel-only)

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[JoshMock]

fixed by #143