From fb98c980ecbbe2a72b4df1b8533d73d0026ab4fa Mon Sep 17 00:00:00 2001 From: Tiago Silva Date: Fri, 8 May 2026 14:53:15 +0100 Subject: [PATCH] Add enum value rendering to CLI docs and remove duplicate descriptions (#66466) This commit enhances the CLI reference documentation by automatically displaying valid enum values in the "Default" column of flag tables, eliminating the need to manually list these values in flag descriptions. It also adds a CI step to verify that CLI reference docs stay in sync with source code changes. The core implementation uses reflection to extract enum values from kingpin flags and formats them as "(valid: `value1`, `value2`, ...)". All CLI source files have been updated to remove duplicate enum value lists from flag help text, as these are now automatically rendered. A new 'cli-docs-up-to-date' Makefile target and corresponding GitHub Actions workflow job ensure that any changes to CLI flags are reflected in the generated documentation. Example output: Before: |`--format`|`yaml`|Output format, 'yaml', 'json', or 'text'| After: |`--format`|`yaml` (valid: `yaml`, `json`, `text`)|Output format.| Signed-off-by: Tiago Silva --- .github/workflows/lint.yaml | 32 + Makefile | 22 +- docs/pages/reference/cli/tbot.mdx | 1346 ++++++++++--------- docs/pages/reference/cli/tctl.mdx | 732 +++++----- docs/pages/reference/cli/teleport.mdx | 435 +++--- docs/pages/reference/cli/tsh.mdx | 712 ++++++---- go.mod | 2 +- go.sum | 4 +- lib/auth/init.go | 12 +- lib/tbot/cli/keypair_create.go | 2 +- lib/tbot/cli/start_database.go | 2 +- lib/tbot/cli/start_legacy.go | 8 +- lib/tbot/cli/start_shared.go | 8 +- lib/utils/usage.go | 3 + lib/utils/usage_docs.go | 67 +- lib/utils/usage_docs_test.go | 49 + tool/tctl/common/acl_command.go | 12 +- tool/tctl/common/alert_command.go | 6 +- tool/tctl/common/auth_command.go | 2 +- tool/tctl/common/auth_rotate_command.go | 2 +- tool/tctl/common/bots_command.go | 6 +- tool/tctl/common/devices.go | 4 +- tool/tctl/common/notification_command.go | 2 +- tool/tctl/common/stableunixusers/command.go | 2 +- tool/tctl/common/tctl.go | 2 +- tool/tctl/common/token_command.go | 4 +- tool/tctl/sso/configure/oidc.go | 2 +- tool/tctl/sso/configure/saml.go | 2 +- tool/teleport/common/teleport.go | 16 +- tool/tsh/common/kube.go | 2 +- tool/tsh/common/scan.go | 8 +- tool/tsh/common/tsh.go | 11 +- 32 files changed, 1949 insertions(+), 1570 deletions(-) diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index d33eea8bea5..9bb34199589 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -18,6 +18,7 @@ jobs: has_rfd: ${{ steps.changes.outputs.has_rfd }} has_ui: ${{ steps.changes.outputs.has_ui }} has_bpf: ${{ steps.changes.outputs.has_bpf }} + has_cli: ${{ steps.changes.outputs.has_cli }} steps: - name: Checkout if: ${{ github.event_name == 'merge_group' }} @@ -94,6 +95,17 @@ jobs: - 'bpf/**.c' - 'bpf/**.h' - 'lib/bpf/*' + has_cli: + - '.github/workflows/lint.yaml' + - 'tool/tsh/**.go' + - 'tool/tctl/**.go' + - 'tool/tbot/**.go' + - 'tool/teleport/**.go' + - 'lib/utils/usage_docs.go' + - 'lib/utils/usage_docs_test.go' + - 'lib/utils/docs-usage.md.tmpl' + - 'lib/utils/docsconfigs/**' + - 'docs/pages/reference/cli/**' lint-go: name: Lint (Go) @@ -392,3 +404,23 @@ jobs: - name: Check if BPF generated files are up to date # We have to add the current directory as a safe directory or else git commands will not work as expected. run: git config --global --add safe.directory $(realpath .) && make bpf-up-to-date + + lint-cli: + name: CLI Reference Docs + needs: changes + if: ${{ !startsWith(github.head_ref, 'dependabot/') && needs.changes.outputs.has_cli == 'true' }} + runs-on: ubuntu-22.04-16core + + permissions: + contents: read + + container: + image: ghcr.io/gravitational/teleport-buildbox:teleport19 + + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Check if CLI reference docs are up to date + # We have to add the current directory as a safe directory or else git commands will not work as expected. + run: git config --global --add safe.directory $(realpath .) && make cli-docs-up-to-date diff --git a/Makefile b/Makefile index b8861262b37..315d1237163 100644 --- a/Makefile +++ b/Makefile @@ -2024,12 +2024,14 @@ dump-preset-roles: GOOS=$(OS) GOARCH=$(ARCH) $(CGOFLAG) go run ./build.assets/dump-preset-roles/main.go pnpm test web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.test.ts +cli-docs: cli-docs-tsh cli-docs-tbot cli-docs-teleport cli-docs-tctl + .PHONY: cli-docs-tsh cli-docs-tsh: # Executing go build instead of go run since we don't want to redirect # irrelevant output along with the docs page content. go build -o $(BUILDDIR)/tshdocs -tags docs ./tool/tsh && \ - $(BUILDDIR)/tshdocs help 2>docs/pages/reference/cli/tsh.mdx && \ + $(BUILDDIR)/tshdocs help >docs/pages/reference/cli/tsh.mdx && \ rm $(BUILDDIR)/tshdocs .PHONY: cli-docs-tbot @@ -2037,7 +2039,7 @@ cli-docs-tbot: # Executing go build instead of go run since we don't want to redirect # irrelevant output along with the docs page content. go build -o $(BUILDDIR)/tbotdocs -tags docs ./tool/tbot && \ - $(BUILDDIR)/tbotdocs help 2>docs/pages/reference/cli/tbot.mdx && \ + $(BUILDDIR)/tbotdocs help >docs/pages/reference/cli/tbot.mdx && \ rm $(BUILDDIR)/tbotdocs .PHONY: cli-docs-teleport @@ -2045,7 +2047,7 @@ cli-docs-teleport: # Executing go build instead of go run since we don't want to redirect # irrelevant output along with the docs page content. go build -o $(BUILDDIR)/teleportdocs -tags docs ./tool/teleport && \ - $(BUILDDIR)/teleportdocs help 2>docs/pages/reference/cli/teleport.mdx && \ + $(BUILDDIR)/teleportdocs help >docs/pages/reference/cli/teleport.mdx && \ rm $(BUILDDIR)/teleportdocs .PHONY: cli-docs-tctl @@ -2053,9 +2055,21 @@ cli-docs-tctl: # Executing go build instead of go run since we don't want to redirect # irrelevant output along with the docs page content. go build -o $(BUILDDIR)/tctldocs -tags docs ./tool/tctl && \ - $(BUILDDIR)/tctldocs help 2>docs/pages/reference/cli/tctl.mdx && \ + $(BUILDDIR)/tctldocs help >docs/pages/reference/cli/tctl.mdx && \ rm $(BUILDDIR)/tctldocs +# cli-docs-up-to-date checks if the generated CLI reference docs are up to date. +.PHONY: cli-docs-up-to-date +cli-docs-up-to-date: must-start-clean/host cli-docs + @if ! git diff --quiet -- docs/pages/reference/cli/; then \ + echo ""; \ + echo "CLI reference documentation is out of date."; \ + echo "Please run 'make cli-docs' and commit the changes."; \ + echo ""; \ + git diff --stat -- docs/pages/reference/cli/; \ + exit 1; \ + fi + # audit-event-reference generates audit event reference docs using the Web UI # source. .PHONY: audit-event-reference diff --git a/docs/pages/reference/cli/tbot.mdx b/docs/pages/reference/cli/tbot.mdx index ec59b5992a0..601923e6c92 100644 --- a/docs/pages/reference/cli/tbot.mdx +++ b/docs/pages/reference/cli/tbot.mdx @@ -25,9 +25,9 @@ Global flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--config`|none|Path to a configuration file.| +|`-c`, `--config`|*no default*|Path to a configuration file.| |`-d`, `--[no-]debug`|`false`|Enables verbose logging to stdout.| -|`--log-format`|`text`|Controls the format of output logs. Can be `json` or `text`. Defaults to `text`.| +|`--log-format`|`text` (one of: `json`, `text`)|Controls the format of output logs. Can be `json` or `text`. Defaults to `text`.| |`--[no-]fips`|`false`|Enables FIPS compliance mode. This requires the FIPS binary is in use.| |`--[no-]insecure`|`false`|Insecure configures the bot to trust the certificates from the Auth Server or Proxy on first connect without verification. Do not use in production.| @@ -35,7 +35,7 @@ Global environment variables: |Variable|Default|Description| |---|---|---| -|`TBOT_CONFIG_PATH`|none|Path to a configuration file.| +|`TBOT_CONFIG_PATH`|*no default*|Path to a configuration file.| |`TBOT_DEBUG`|`false`|Enables verbose logging to stdout.| ## tbot configure application @@ -52,34 +52,35 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--app`|none|The name of the app in Teleport| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--app`|*no default*|The name of the app in Teleport| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| |`--[no-]specific-tls-extensions`|`false`|If set, includes additional `tls.crt`, `tls.key`, and `tls.cas` for apps that require these file extensions| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot configure application-proxy @@ -95,30 +96,31 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--listen`|none|The socket URI on which the local proxy should listen, such as `tcp://0.0.0.0:8080`.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--listen`|*no default*|The socket URI on which the local proxy should listen, such as `tcp://0.0.0.0:8080`.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot configure application-tunnel @@ -134,31 +136,32 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--app`|none|The name of the app in Teleport| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--listen`|none|The socket URI on which the tunnel should listen, such as `tcp://0.0.0.0:8080`.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--app`|*no default*|The name of the app in Teleport| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--listen`|*no default*|The socket URI on which the tunnel should listen, such as `tcp://0.0.0.0:8080`.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot configure database @@ -174,36 +177,37 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--database`|none|The name of the database available in the requested database service.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--format`|``|The format of the credentials to generate. If specified, must be `tls`, `mongo` or `cockroach`.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--database`|*no default*|The name of the database available in the requested database service.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--format`|`` (one of: ``, `tls`, `mongo`, `cockroach`)|The format of the credentials to generate.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--service`|none|The database service name.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`--username`|none|The database user name.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--service`|*no default*|The database service name.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--username`|*no default*|The database user name.| ## tbot configure database-tunnel @@ -219,33 +223,34 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--database`|none|The name of the database available in the requested database service.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--listen`|none|A socket URI to listen on, such as `tcp://0.0.0.0:3306`.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--database`|*no default*|The name of the database available in the requested database service.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--listen`|*no default*|A socket URI to listen on, such as `tcp://0.0.0.0:3306`.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--service`|none|The database service name.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`--username`|none|The database user name.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--service`|*no default*|The database service name.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--username`|*no default*|The database user name.| ## tbot configure identity @@ -261,34 +266,35 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--cluster`|none|The name of a specific cluster for which to issue an identity if using a leaf cluster.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--cluster`|*no default*|The name of a specific cluster for which to issue an identity if using a leaf cluster.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| |`--[no-]allow-reissue`|`false`|Allow the credentials output by this command to be reissued.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot configure kubernetes @@ -304,34 +310,35 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--kubernetes-cluster`|none|The name of the Kubernetes cluster in Teleport for which to fetch credentials.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--kubernetes-cluster`|*no default*|The name of the Kubernetes cluster in Teleport for which to fetch credentials.| |`--[no-]disable-exec-plugin`|`false`|If set, disables the exec plugin. This allows credentials to be used without the `tbot` binary.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot configure kubernetes/v2 @@ -347,35 +354,36 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--label-selector`|none|A set of Kubernetes labels to match in k1=v1,k2=v2 form. Repeatable.| -|`--name-selector`|none|An explicit Kubernetes cluster name to include. Repeatable.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--label-selector`|*no default*|A set of Kubernetes labels to match in k1=v1,k2=v2 form. Repeatable.| +|`--name-selector`|*no default*|An explicit Kubernetes cluster name to include. Repeatable.| |`--[no-]disable-exec-plugin`|`false`|If set, disables the exec plugin. This allows credentials to be used without the `tbot` binary.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot configure legacy @@ -391,26 +399,27 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--data-dir`|none|Directory to store internal bot data. Access to this directory should be limited.| -|`--destination-dir`|none|Directory to write short-lived machine certificates.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--data-dir`|*no default*|Directory to store internal bot data. Access to this directory should be limited.| +|`--destination-dir`|*no default*|Directory to write short-lived machine certificates.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot configure noop @@ -426,29 +435,30 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot configure ssh-multiplexer @@ -464,35 +474,36 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| |`--[no-]enable-resumption`|`false`|If set, disables SSH session resumption.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-command`|none|The command to run as the SSH ProxyCommand, such as `fdpass-teleport`. Defaults to this tbot binary. Repeatable to add additional args.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--proxy-templates-path`|none|A path to a proxy template config file. Optional.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-command`|*no default*|The command to run as the SSH ProxyCommand, such as `fdpass-teleport`. Defaults to this tbot binary. Repeatable to add additional args.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--proxy-templates-path`|*no default*|A path to a proxy template config file. Optional.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot configure workload-identity-api @@ -509,32 +520,33 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--label-selector`|none|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| -|`--listen`|none|The address on which the workload identity API should listen. This should either be prefixed with 'unix://' or 'tcp://'.| -|`--name-selector`|none|The name of the workload identity to issue. Mutually exclusive with --label-selector.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--label-selector`|*no default*|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| +|`--listen`|*no default*|The address on which the workload identity API should listen. This should either be prefixed with 'unix://' or 'tcp://'.| +|`--name-selector`|*no default*|The name of the workload identity to issue. Mutually exclusive with --label-selector.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot configure workload-identity-aws-roles-anywhere @@ -551,40 +563,41 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--label-selector`|none|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| -|`--name-selector`|none|The name of the workload identity to issue. Mutually exclusive with --label-selector.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--label-selector`|*no default*|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| +|`--name-selector`|*no default*|The name of the workload identity to issue. Mutually exclusive with --label-selector.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--profile-arn`|none|The ARN of the Roles Anywhere profile to use.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--region`|none|The AWS region to use. If unset, value will be used from the AWS config or the AWS_REGION environment variable.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--role-arn`|none|The ARN of the role to assume.| -|`--session-duration`|none|The duration of the resulting AWS session and credentials. This may be up to 12 hours. When unset, this defaults to 6 hours.| -|`--session-renewal-interval`|none|How often the session should be renewed. This should be less than the session duration. When unset, this defaults to 1 hour.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`--trust-anchor-arn`|none|The ARN of the Roles Anywhere trust anchor to use.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--profile-arn`|*no default*|The ARN of the Roles Anywhere profile to use.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--region`|*no default*|The AWS region to use. If unset, value will be used from the AWS config or the AWS_REGION environment variable.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--role-arn`|*no default*|The ARN of the role to assume.| +|`--session-duration`|*no default*|The duration of the resulting AWS session and credentials. This may be up to 12 hours. When unset, this defaults to 6 hours.| +|`--session-renewal-interval`|*no default*|How often the session should be renewed. This should be less than the session duration. When unset, this defaults to 1 hour.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--trust-anchor-arn`|*no default*|The ARN of the Roles Anywhere trust anchor to use.| ## tbot configure workload-identity-jwt @@ -600,35 +613,36 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--audience`|none|Specify the audiences to include in the JWT. At least one audience must be specified.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--label-selector`|none|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| -|`--name-selector`|none|The name of the workload identity to issue. Mutually exclusive with --label-selector.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--audience`|*no default*|Specify the audiences to include in the JWT. At least one audience must be specified.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--label-selector`|*no default*|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| +|`--name-selector`|*no default*|The name of the workload identity to issue. Mutually exclusive with --label-selector.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot configure workload-identity-x509 @@ -644,35 +658,36 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--label-selector`|none|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| -|`--name-selector`|none|The name of the workload identity to issue. Mutually exclusive with --label-selector.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--label-selector`|*no default*|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| +|`--name-selector`|*no default*|The name of the workload identity to issue. Mutually exclusive with --label-selector.| |`--[no-]include-federated-trust-bundles`|`false`|If set, include federated trust bundles in the output.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot copy-binaries @@ -694,7 +709,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|destination-dir|none (required)|The destination path to write the copy of the tbot binary.| +|destination-dir|*no default* (required)|The destination path to write the copy of the tbot binary.| ## tbot db @@ -710,15 +725,15 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--cluster`|none|The cluster name. Extracted from the certificate if unset.| -|`--destination-dir`|none|The destination directory to provide tsh for authentication.| -|`--proxy-server`|none|The address of the Teleport proxy server to use, in host:port form.| +|`--cluster`|*no default*|The cluster name. Extracted from the certificate if unset.| +|`--destination-dir`|*no default*|The destination directory to provide tsh for authentication.| +|`--proxy-server`|*no default*|The address of the Teleport proxy server to use, in host:port form.| Arguments: |Argument|Default|Description| |---|---|---| -|args|none (optional)|Arguments to `tsh db ...`; prefix with `-- ` to ensure flags are passed correctly.| +|args|*no default* (optional)|Arguments to `tsh db ...`; prefix with `-- ` to ensure flags are passed correctly.| ## tbot help @@ -734,7 +749,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|command|none (optional)|Show help on command.| +|command|*no default* (optional)|Show help on command.| ## tbot init @@ -750,21 +765,21 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--bot-user`|none|Enables POSIX ACLs and defines Linux user that can read/write short-lived certificates to "--destination-dir".| -|`--destination-dir`|none|Directory to write short-lived machine certificates.| -|`--init-dir`|none|If using a config file and multiple destinations are configured, controls which destination dir to configure.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--bot-user`|*no default*|Enables POSIX ACLs and defines Linux user that can read/write short-lived certificates to "--destination-dir".| +|`--destination-dir`|*no default*|Directory to write short-lived machine certificates.| +|`--init-dir`|*no default*|If using a config file and multiple destinations are configured, controls which destination dir to configure.| |`--[no-]clean`|`false`|If set, removes unexpected files and directories from the destination.| -|`--owner`|none|Defines Linux "user:group" owner of "--destination-dir". Defaults to the Linux user running tbot if unspecified.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-user`|none|Enables POSIX ACLs and defines Linux user that will read short-lived certificates from "--destination-dir".| +|`--owner`|*no default*|Defines Linux "user:group" owner of "--destination-dir". Defaults to the Linux user running tbot if unspecified.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-user`|*no default*|Enables POSIX ACLs and defines Linux user that will read short-lived certificates from "--destination-dir".| ## tbot install systemd @@ -786,7 +801,7 @@ Flags: |`--[no-]anonymous-telemetry`|`false`|Enable anonymous telemetry.| |`--[no-]force`|`false`|Overwrite existing systemd unit file if present.| |`--[no-]write`|`false`|Write the systemd unit file. If not specified, this command runs in a dry-run mode that outputs the generated content to stdout.| -|`--pid-file`|none|Overrides the PID file path that should be set in the systemd unit files.| +|`--pid-file`|*no default*|Overrides the PID file path that should be set in the systemd unit files.| |`--systemd-directory`|`/etc/systemd/system`|Path to the directory that the systemd unit file should be written. Defaults to '/etc/systemd/system'.| |`--user`|`teleport`|The user that the service should run as. Defaults to 'teleport'.| @@ -804,12 +819,12 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`text`|Output format, one of: text, json| +|`--format`|`text` (one of: `text`, `json`)|Output format.| |`--[no-]overwrite`|`false`|If set, overwrite any existing keypair. If unset and a keypair already exists, its key will be printed for use.| |`--[no-]static`|`false`|If set, creates a static private key instead of writing a mutable key into bot storage. If --static-key-path is unset, the key will be printed to the terminal.| -|`--proxy-server`|none|The proxy server, which will be pinged to determine the current cryptographic suite in use.| -|`--static-key-path`|none|If set, writes the static private key to a file.| -|`--storage`|none|The internal storage URI to write the keypair to, such as `file:///var/lib/teleport/bot`.| +|`--proxy-server`|*no default*|The proxy server, which will be pinged to determine the current cryptographic suite in use.| +|`--static-key-path`|*no default*|If set, writes the static private key to a file.| +|`--storage`|*no default*|The internal storage URI to write the keypair to, such as `file:///var/lib/teleport/bot`.| ## tbot migrate @@ -826,7 +841,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-o`, `--output`|none|The path to write the generated configuration file to. If unset, it will be written to stdout.| +|`-o`, `--output`|*no default*|The path to write the generated configuration file to. If unset, it will be written to stdout.| ## tbot proxy @@ -842,15 +857,15 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--cluster`|none|The cluster name. Extracted from the certificate if unset.| -|`--destination-dir`|none|The destination directory to provide tsh for authentication.| -|`--proxy-server`|none|The address of the Teleport proxy server to use, in host:port form.| +|`--cluster`|*no default*|The cluster name. Extracted from the certificate if unset.| +|`--destination-dir`|*no default*|The destination directory to provide tsh for authentication.| +|`--proxy-server`|*no default*|The address of the Teleport proxy server to use, in host:port form.| Arguments: |Argument|Default|Description| |---|---|---| -|args|none (optional)|Arguments to `tsh proxy ...`; prefix with `-- ` to ensure flags are passed correctly.| +|args|*no default* (optional)|Arguments to `tsh proxy ...`; prefix with `-- ` to ensure flags are passed correctly.| ## tbot spiffe-inspect @@ -866,7 +881,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--path`|none|The path to the SPIFFE Workload API endpoint to test.| +|`--path`|*no default*|The path to the SPIFFE Workload API endpoint to test.| ## tbot start application @@ -882,34 +897,35 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--app`|none|The name of the app in Teleport| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--app`|*no default*|The name of the app in Teleport| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| |`--[no-]specific-tls-extensions`|`false`|If set, includes additional `tls.crt`, `tls.key`, and `tls.cas` for apps that require these file extensions| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot start application-proxy @@ -925,30 +941,31 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--listen`|none|The socket URI on which the local proxy should listen, such as `tcp://0.0.0.0:8080`.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--listen`|*no default*|The socket URI on which the local proxy should listen, such as `tcp://0.0.0.0:8080`.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot start application-tunnel @@ -964,31 +981,32 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--app`|none|The name of the app in Teleport| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--listen`|none|The socket URI on which the tunnel should listen, such as `tcp://0.0.0.0:8080`.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--app`|*no default*|The name of the app in Teleport| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--listen`|*no default*|The socket URI on which the tunnel should listen, such as `tcp://0.0.0.0:8080`.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot start database @@ -1004,36 +1022,37 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--database`|none|The name of the database available in the requested database service.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--format`|``|The format of the credentials to generate. If specified, must be `tls`, `mongo` or `cockroach`.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--database`|*no default*|The name of the database available in the requested database service.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--format`|`` (one of: ``, `tls`, `mongo`, `cockroach`)|The format of the credentials to generate.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--service`|none|The database service name.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`--username`|none|The database user name.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--service`|*no default*|The database service name.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--username`|*no default*|The database user name.| ## tbot start database-tunnel @@ -1049,33 +1068,34 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--database`|none|The name of the database available in the requested database service.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--listen`|none|A socket URI to listen on, such as `tcp://0.0.0.0:3306`.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--database`|*no default*|The name of the database available in the requested database service.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--listen`|*no default*|A socket URI to listen on, such as `tcp://0.0.0.0:3306`.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--service`|none|The database service name.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`--username`|none|The database user name.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--service`|*no default*|The database service name.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--username`|*no default*|The database user name.| ## tbot start identity @@ -1091,34 +1111,35 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--cluster`|none|The name of a specific cluster for which to issue an identity if using a leaf cluster.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--cluster`|*no default*|The name of a specific cluster for which to issue an identity if using a leaf cluster.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| |`--[no-]allow-reissue`|`false`|Allow the credentials output by this command to be reissued.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot start kubernetes @@ -1134,34 +1155,35 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--kubernetes-cluster`|none|The name of the Kubernetes cluster in Teleport for which to fetch credentials.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--kubernetes-cluster`|*no default*|The name of the Kubernetes cluster in Teleport for which to fetch credentials.| |`--[no-]disable-exec-plugin`|`false`|If set, disables the exec plugin. This allows credentials to be used without the `tbot` binary.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot start kubernetes/v2 @@ -1177,35 +1199,36 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--label-selector`|none|A set of Kubernetes labels to match in k1=v1,k2=v2 form. Repeatable.| -|`--name-selector`|none|An explicit Kubernetes cluster name to include. Repeatable.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--label-selector`|*no default*|A set of Kubernetes labels to match in k1=v1,k2=v2 form. Repeatable.| +|`--name-selector`|*no default*|An explicit Kubernetes cluster name to include. Repeatable.| |`--[no-]disable-exec-plugin`|`false`|If set, disables the exec plugin. This allows credentials to be used without the `tbot` binary.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot start legacy @@ -1221,26 +1244,27 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--data-dir`|none|Directory to store internal bot data. Access to this directory should be limited.| -|`--destination-dir`|none|Directory to write short-lived machine certificates.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--data-dir`|*no default*|Directory to store internal bot data. Access to this directory should be limited.| +|`--destination-dir`|*no default*|Directory to write short-lived machine certificates.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot start noop @@ -1256,29 +1280,30 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot start ssh-multiplexer @@ -1294,35 +1319,36 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| |`--[no-]enable-resumption`|`false`|If set, disables SSH session resumption.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-command`|none|The command to run as the SSH ProxyCommand, such as `fdpass-teleport`. Defaults to this tbot binary. Repeatable to add additional args.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--proxy-templates-path`|none|A path to a proxy template config file. Optional.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-command`|*no default*|The command to run as the SSH ProxyCommand, such as `fdpass-teleport`. Defaults to this tbot binary. Repeatable to add additional args.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--proxy-templates-path`|*no default*|A path to a proxy template config file. Optional.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot start workload-identity-api @@ -1339,32 +1365,33 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--label-selector`|none|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| -|`--listen`|none|The address on which the workload identity API should listen. This should either be prefixed with 'unix://' or 'tcp://'.| -|`--name-selector`|none|The name of the workload identity to issue. Mutually exclusive with --label-selector.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--label-selector`|*no default*|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| +|`--listen`|*no default*|The address on which the workload identity API should listen. This should either be prefixed with 'unix://' or 'tcp://'.| +|`--name-selector`|*no default*|The name of the workload identity to issue. Mutually exclusive with --label-selector.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot start workload-identity-aws-roles-anywhere @@ -1381,40 +1408,41 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--label-selector`|none|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| -|`--name-selector`|none|The name of the workload identity to issue. Mutually exclusive with --label-selector.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--label-selector`|*no default*|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| +|`--name-selector`|*no default*|The name of the workload identity to issue. Mutually exclusive with --label-selector.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--profile-arn`|none|The ARN of the Roles Anywhere profile to use.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--region`|none|The AWS region to use. If unset, value will be used from the AWS config or the AWS_REGION environment variable.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--role-arn`|none|The ARN of the role to assume.| -|`--session-duration`|none|The duration of the resulting AWS session and credentials. This may be up to 12 hours. When unset, this defaults to 6 hours.| -|`--session-renewal-interval`|none|How often the session should be renewed. This should be less than the session duration. When unset, this defaults to 1 hour.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`--trust-anchor-arn`|none|The ARN of the Roles Anywhere trust anchor to use.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--profile-arn`|*no default*|The ARN of the Roles Anywhere profile to use.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--region`|*no default*|The AWS region to use. If unset, value will be used from the AWS config or the AWS_REGION environment variable.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--role-arn`|*no default*|The ARN of the role to assume.| +|`--session-duration`|*no default*|The duration of the resulting AWS session and credentials. This may be up to 12 hours. When unset, this defaults to 6 hours.| +|`--session-renewal-interval`|*no default*|How often the session should be renewed. This should be less than the session duration. When unset, this defaults to 1 hour.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--trust-anchor-arn`|*no default*|The ARN of the Roles Anywhere trust anchor to use.| ## tbot start workload-identity-jwt @@ -1430,35 +1458,36 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--audience`|none|Specify the audiences to include in the JWT. At least one audience must be specified.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--label-selector`|none|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| -|`--name-selector`|none|The name of the workload identity to issue. Mutually exclusive with --label-selector.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--audience`|*no default*|Specify the audiences to include in the JWT. At least one audience must be specified.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--label-selector`|*no default*|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| +|`--name-selector`|*no default*|The name of the workload identity to issue. Mutually exclusive with --label-selector.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot start workload-identity-x509 @@ -1474,35 +1503,36 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`TELEPORT_BOT_TOKEN`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| -|`TELEPORT_PROXY`|none|Address of the Teleport Proxy Server.| +|`TELEPORT_AUTH_SERVER`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`TELEPORT_BOT_TOKEN`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`TELEPORT_PROXY`|*no default*|Address of the Teleport Proxy Server.| Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--auth-server`|none|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| -|`--ca-pin`|none|CA pin to validate the Teleport Auth Server; used on first connect.| -|`--certificate-ttl`|none|TTL of short-lived machine certificates.| -|`--destination`|none|A destination URI, such as file:///foo/bar| -|`--diag-addr`|none|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| -|`--join-method`|none|Method to use to join the cluster. (azure, azure_devops, bitbucket, circleci, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--join-uri`|none|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| -|`--label-selector`|none|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| -|`--name-selector`|none|The name of the workload identity to issue. Mutually exclusive with --label-selector.| +|`-a`, `--auth-server`|*no default*|Address of the Teleport Auth Server. Prefer using --proxy-server where possible.| +|`--ca-pin`|*no default*|CA pin to validate the Teleport Auth Server; used on first connect.| +|`--certificate-ttl`|*no default*|TTL of short-lived machine certificates.| +|`--destination`|*no default*|A destination URI, such as file:///foo/bar| +|`--diag-addr`|*no default*|If set and the bot is in debug mode, a diagnostics service will listen on specified address.| +|`--join-method`|*no default* (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--join-uri`|*no default*|An optional URI with joining and authentication parameters. Individual flags for proxy, join method, token, etc may be used instead.| +|`--label-selector`|*no default*|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','. Mutually exclusive with --name-selector.| +|`--name-selector`|*no default*|The name of the workload identity to issue. Mutually exclusive with --label-selector.| |`--[no-]include-federated-trust-bundles`|`false`|If set, include federated trust bundles in the output.| |`--[no-]oneshot`|`false`|If set, quit after the first renewal.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--proxy-server`|none|Address of the Teleport Proxy Server.| -|`--reader-group`|none|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--reader-user`|none|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| -|`--registration-secret`|none|For bound keypair joining, specifies a registration secret for use at first join.| -|`--registration-secret-path`|none|For bound keypair joining, specifies a file containing a registration secret for use at first join.| -|`--renewal-interval`|none|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| -|`--static-key-path`|none|For bound keypair joining, specifies a path to a static key.| -|`--storage`|none|A destination URI for tbot's internal storage, e.g. file:///foo/bar| -|`--token`|none|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| +|`--[no-]scoped`|`false`|Indicates whether tbot should run in scoped mode. This is required when authenticating as a scoped Bot.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--proxy-server`|*no default*|Address of the Teleport Proxy Server.| +|`--reader-group`|*no default*|An additional group name or GID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--reader-user`|*no default*|An additional user name or UID that should be allowed by ACLs to read this destination. Only valid for file destinations on Linux.| +|`--registration-secret`|*no default*|For bound keypair joining, specifies a registration secret for use at first join.| +|`--registration-secret-path`|*no default*|For bound keypair joining, specifies a file containing a registration secret for use at first join.| +|`--renewal-interval`|*no default*|Interval at which short-lived certificates are renewed; must be less than the certificate TTL.| +|`--static-key-path`|*no default*|For bound keypair joining, specifies a path to a static key.| +|`--storage`|*no default*|A destination URI for tbot's internal storage, e.g. file:///foo/bar| +|`--token`|*no default*|A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.| ## tbot tpm identify @@ -1538,7 +1568,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--diag-addr`|none|The configured --diag-addr of a running bot, in host:port form.| -|`--service`|none|An optional name. If set, waits for only the named service to become healthy. If unset, waits for all services.| -|`--timeout`|none|An optional timeout. If set, returns an error if all specified services have reported healthy by the timeout.| +|`--diag-addr`|*no default*|The configured --diag-addr of a running bot, in host:port form.| +|`--service`|*no default*|An optional name. If set, waits for only the named service to become healthy. If unset, waits for all services.| +|`--timeout`|*no default*|An optional timeout. If set, returns an error if not all specified services have reported healthy by the timeout.| diff --git a/docs/pages/reference/cli/tctl.mdx b/docs/pages/reference/cli/tctl.mdx index a6d5b4984f6..bffd530a854 100644 --- a/docs/pages/reference/cli/tctl.mdx +++ b/docs/pages/reference/cli/tctl.mdx @@ -30,20 +30,20 @@ Global flags: |Flag|Default|Description| |---|---|---| -|`--auth-server`|none|Attempts to connect to specific auth/proxy address(es) instead of local auth \[127.0.0.1:3025\]| -|`-c`, `--config`|none|Path to a configuration file \[/etc/teleport.yaml\] for an Auth Service instance. Can also be set via the TELEPORT_CONFIG_FILE environment variable. Ignored if the auth_service is disabled.| +|`--auth-server`|*no default*|Attempts to connect to specific auth/proxy address(es) instead of local auth \[127.0.0.1:3025\]| +|`-c`, `--config`|*no default*|Path to a configuration file \[/etc/teleport.yaml\] for an Auth Service instance. Can also be set via the TELEPORT_CONFIG_FILE environment variable. Ignored if the auth_service is disabled.| |`-d`, `--[no-]debug`|`false`|Enable verbose logging to stderr| -|`-i`, `--identity`|none|Path to an identity file. Must be provided to make remote connections to auth. An identity file can be exported with 'tctl auth sign'| -|`--mfa-mode`|`auto`|Preferred mode for MFA assertions (auto, cross-platform, platform, sso, browser).| +|`-i`, `--identity`|*no default*|Path to an identity file. Must be provided to make remote connections to auth. An identity file can be exported with 'tctl auth sign'| +|`--mfa-mode`|`auto` (one of: `auto`, `cross-platform`, `platform`, `sso`, `browser`)|Preferred mode for MFA assertions.| |`--[no-]insecure`|`false`|When specifying a proxy address in --auth-server, do not verify its TLS certificate. Danger: any data you send can be intercepted or modified by an attacker.| Global environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_AUTH_SERVER`|none|Attempts to connect to specific auth/proxy address(es) instead of local auth [127.0.0.1:3025]| -|`TELEPORT_IDENTITY_FILE`|none|Path to an identity file. Must be provided to make remote connections to auth. An identity file can be exported with 'tctl auth sign'| -|`TELEPORT_MFA_MODE`|`auto`|Preferred mode for MFA assertions (auto, cross-platform, platform, sso, browser).| +|`TELEPORT_AUTH_SERVER`|*no default*|Attempts to connect to specific auth/proxy address(es) instead of local auth [127.0.0.1:3025]| +|`TELEPORT_IDENTITY_FILE`|*no default*|Path to an identity file. Must be provided to make remote connections to auth. An identity file can be exported with 'tctl auth sign'| +|`TELEPORT_MFA_MODE`|`auto` (one of: `auto`, `cross-platform`, `platform`, `sso`, `browser`)|Preferred mode for MFA assertions.| ## tctl acl get @@ -59,13 +59,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`yaml`|Output format, 'yaml', 'json', or 'text'| +|`--format`|`yaml` (one of: `yaml`, `json`, `text`)|Output format.| Arguments: |Argument|Default|Description| |---|---|---| -|access-list-name|none (required)|The Access List name.| +|access-list-name|*no default* (required)|The Access List name.| ## tctl acl ls @@ -81,7 +81,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`yaml`|Output format, 'yaml', 'json', or 'text'| +|`--format`|`yaml` (one of: `yaml`, `json`, `text`)|Output format.| |`--[no-]review-only`|`false`|List only access lists that are due for review within the next 2 weeks or past due| ## tctl acl reviews create @@ -98,14 +98,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--notes`|none|Optional review notes.| -|`--remove-members`|none|Comma-separated list of members to remove as part of this review.| +|`--notes`|*no default*|Optional review notes.| +|`--remove-members`|*no default*|Comma-separated list of members to remove as part of this review.| Arguments: |Argument|Default|Description| |---|---|---| -|access-list-name|none (required)|The access list name to submit review for.| +|access-list-name|*no default* (required)|The access list name to submit review for.| ## tctl acl reviews ls @@ -121,13 +121,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`text`|Output format 'yaml', 'json', or 'text'| +|`--format`|`text` (one of: `yaml`, `json`, `text`)|Output format.| Arguments: |Argument|Default|Description| |---|---|---| -|access-list-name|none (required)|The access list name to fetch review history for.| +|access-list-name|*no default* (required)|The access list name to fetch review history for.| ## tctl acl summary @@ -144,14 +144,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`yaml`|Output format 'yaml' or 'json'| +|`--format`|`yaml` (one of: `yaml`, `json`)|Output format.| |`--[no-]review-only`|`true`|Show only access lists that are due for review within the next 2 weeks or past due. Defaults to true.| Arguments: |Argument|Default|Description| |---|---|---| -|access-list-name|none (optional)|The access list name to show summary for. If not provided, shows summary for all access lists.| +|access-list-name|*no default* (optional)|The access list name to show summary for. If not provided, shows summary for all access lists.| ## tctl acl users add @@ -167,16 +167,16 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--kind`|`user`|Access list member kind, 'user' or 'list'| +|`--kind`|`user` (one of: `user`, `list`)|Access list member kind.| Arguments: |Argument|Default|Description| |---|---|---| -|access-list-name|none (required)|The Access List name.| -|expires|none (optional)|When the user's access expires (must be in RFC3339). Defaults to the expiration time of the Access List.| -|reason|none (optional)|The reason the user has been added to the Access List. Defaults to empty.| -|user|none (required)|The user to add to the Access List.| +|access-list-name|*no default* (required)|The Access List name.| +|expires|*no default* (optional)|When the user's access expires (must be in RFC3339). Defaults to the expiration time of the Access List.| +|reason|*no default* (optional)|The reason the user has been added to the Access List. Defaults to empty.| +|user|*no default* (required)|The user to add to the Access List.| ## tctl acl users ls @@ -192,13 +192,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`text`|Output format 'json', or 'text'| +|`--format`|`text` (one of: `json`, `text`)|Output format.| Arguments: |Argument|Default|Description| |---|---|---| -|access-list-name|none (required)|The Access List name.| +|access-list-name|*no default* (required)|The Access List name.| ## tctl acl users rm @@ -214,8 +214,8 @@ Arguments: |Argument|Default|Description| |---|---|---| -|access-list-name|none (required)|The Access List name.| -|user|none (required)|The user to remove from the Access List.| +|access-list-name|*no default* (required)|The Access List name.| +|user|*no default* (required)|The user to remove from the Access List.| ## tctl alerts ack @@ -231,16 +231,16 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`text`|Output format, 'text', 'json', or 'yaml'| +|`--format`|`text` (one of: `text`, `json`, `yaml`)|Output format.| |`--[no-]clear`|`false`|Clear the acknowledgment for the cluster alert.| -|`--reason`|none|The reason for acknowledging the cluster alert.| -|`--ttl`|none|Time duration to acknowledge the cluster alert for.| +|`--reason`|*no default*|The reason for acknowledging the cluster alert.| +|`--ttl`|*no default*|Time duration to acknowledge the cluster alert for.| Arguments: |Argument|Default|Description| |---|---|---| -|id|none (required)|The cluster alert ID.| +|id|*no default* (required)|The cluster alert ID.| ## tctl alerts ack ls @@ -266,15 +266,15 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--labels`|none|List of labels to attach to the alert. For example: key1=value1,key2=value2.| -|`--severity`|`low`|Severity of the alert (low, medium, or high).| -|`--ttl`|none|Time duration after which the alert expires (default 24h).| +|`--labels`|*no default*|List of labels to attach to the alert. For example: key1=value1,key2=value2.| +|`--severity`|`low` (one of: `low`, `medium`, `high`)|Severity of the alert.| +|`--ttl`|*no default*|Time duration after which the alert expires (default 24h).| Arguments: |Argument|Default|Description| |---|---|---| -|message|none (required)|Alert body message.| +|message|*no default* (required)|Alert body message.| ## tctl alerts delete @@ -290,7 +290,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|id|none (required)|The cluster alert ID.| +|id|*no default* (required)|The cluster alert ID.| ## tctl alerts list @@ -306,8 +306,8 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`text`|Output format, 'text', 'json', or 'yaml'| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| +|`--format`|`text` (one of: `text`, `json`, `yaml`)|Output format.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| |`-v`, `--[no-]verbose`|`false`|Show detailed alert info, including acknowledged alerts.| ## tctl apps ls @@ -325,15 +325,15 @@ Flags: |Flag|Default|Description| |---|---|---| |`--format`|`text`|Output format, 'text', 'json', or 'yaml'| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")| |`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output| Arguments: |Argument|Default|Description| |---|---|---| -|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| +|labels|*no default* (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| ## tctl audit query create @@ -349,13 +349,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--name`|none|Audit query name| +|`--name`|*no default*|Audit query name| Arguments: |Argument|Default|Description| |---|---|---| -|query|none (optional)|SQL Query| +|query|*no default* (optional)|SQL Query| ## tctl audit query exec @@ -371,7 +371,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|query|none (optional)|SQL Query| +|query|*no default* (optional)|SQL Query| ## tctl audit query get @@ -387,7 +387,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|name of the audit query| +|name|*no default* (required)|name of the audit query| ## tctl audit query ls @@ -413,7 +413,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|name of the audit query| +|name|*no default* (required)|name of the audit query| ## tctl audit report get @@ -429,7 +429,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|security name| +|name|*no default* (required)|security name| ## tctl audit report ls @@ -455,7 +455,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|security report name| +|name|*no default* (required)|security report name| ## tctl audit report state @@ -471,7 +471,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|security report name| +|name|*no default* (required)|security report name| ## tctl audit schema @@ -498,8 +498,8 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--out`|none|If set, writes exported revocation lists to files with the given path prefix| -|`--type`|none|Certificate authority type, one of: host, db, db_client, user| +|`--out`|*no default*|If set, writes exported revocation lists to files with the given path prefix| +|`--type`|*no default* (one of: `host`, `db`, `db_client`, `user`)|Certificate authority type.| ## tctl auth export @@ -515,12 +515,12 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--compat`|none|export certificates compatible with specific version of Teleport| -|`--fingerprint`|none|filter authority by fingerprint| -|`--integration`|none|Name of the integration. Only applies to "github" CAs.| +|`--compat`|*no default*|export certificates compatible with specific version of Teleport| +|`--fingerprint`|*no default*|filter authority by fingerprint| +|`--integration`|*no default*|Name of the integration. Only applies to "github" CAs.| |`--[no-]keys`|`false`|if set, will print private keys| -|`--out`|none|If set writes exported authorities to files with the given path prefix| -|`--type`|none|export certificate type (user, host, tls-host, tls-user, tls-user-der, tls-spiffe, windows, db, db-der, db-client, db-client-der, openssh, saml-idp, github, awsra, app-client)| +|`--out`|*no default*|If set writes exported authorities to files with the given path prefix| +|`--type`|*no default* (one of: `user`, `host`, `tls-host`, `tls-user`, `tls-user-der`, `tls-spiffe`, `windows`, `db`, `db-der`, `db-client`, `db-client-der`, `openssh`, `saml-idp`, `github`, `awsra`, `app-client`)|export certificate type (user, host, tls-host, tls-user, tls-user-der, tls-spiffe, windows, db, db-der, db-client, db-client-der, openssh, saml-idp, github, awsra, app-client)| ## tctl auth ls @@ -556,8 +556,8 @@ Flags: |`--grace-period`|`30h0m0s`|Grace period keeps previous certificate authorities signatures valid, if set to 0 will force users to re-login and nodes to re-register.| |`--[no-]interactive`|`false`|Enable interactive mode| |`--[no-]manual`|`false`|Activate manual rotation, set rotation phases manually| -|`--phase`|none|Target rotation phase to set, used in manual rotation, one of: init, standby, update_clients, update_servers, rollback| -|`--type`|none|Certificate authority to rotate, one of: host, windows, user, db, db_client, openssh, jwt, saml_idp, oidc_idp, spiffe, okta, awsra, bound_keypair, app_client| +|`--phase`|*no default*|Target rotation phase to set, used in manual rotation, one of: init, standby, update_clients, update_servers, rollback| +|`--type`|*no default* (one of: `host`, `windows`, `user`, `db`, `db_client`, `openssh`, `jwt`, `saml_idp`, `oidc_idp`, `spiffe`, `okta`, `awsra`, `bound_keypair`, `app_client`)|Certificate authority to rotate.| ## tctl auth sign @@ -573,26 +573,26 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--app-name`|none|Application to generate identity file for. Mutually exclusive with "--db-service".| -|`--compat`|none|OpenSSH compatibility flag| -|`--db-name`|none|Database name placed on the identity file. Only used when "--db-service" is set.| -|`--db-service`|none|Database to generate identity file for. Mutually exclusive with "--app-name".| -|`--db-user`|none|Database user placed on the identity file. Only used when "--db-service" is set.| +|`--app-name`|*no default*|Application to generate identity file for. Mutually exclusive with "--db-service".| +|`--compat`|*no default*|OpenSSH compatibility flag| +|`--db-name`|*no default*|Database name placed on the identity file. Only used when "--db-service" is set.| +|`--db-service`|*no default*|Database to generate identity file for. Mutually exclusive with "--app-name".| +|`--db-user`|*no default*|Database user placed on the identity file. Only used when "--db-service" is set.| |`--format`|`file`|Identity format: file, openssh, tls, kubernetes, db, windows, mongodb, cockroachdb, redis, snowflake, elasticsearch, cassandra, scylla, oracle. file is the default.| -|`--host`|none|Teleport host name| -|`--kube-cluster-name`|none|Kubernetes cluster to generate identity file for when --format is set to "kubernetes"| -|`--leaf-cluster`|none|Leaf cluster to generate identity file for when --format is set to "kubernetes"| +|`--host`|*no default*|Teleport host name| +|`--kube-cluster-name`|*no default*|Kubernetes cluster to generate identity file for when --format is set to "kubernetes"| +|`--leaf-cluster`|*no default*|Leaf cluster to generate identity file for when --format is set to "kubernetes"| |`--[no-]omit-cdp`|`false`|Omit CRL Distribution Points from the cert. Only used when --format is set to "windows"| |`--[no-]overwrite`|`false`|Whether to overwrite existing destination files. When not set, user will be prompted before overwriting any existing file.| |`--[no-]tar`|`false`|Create a tarball of the resulting certificates and stream to stdout.| -|`-o`, `--out`|none|Identity output| -|`--proxy`|none|Address of the Teleport proxy. When --format is set to "kubernetes", this address will be set as cluster address in the generated kubeconfig file| +|`-o`, `--out`|*no default*|Identity output| +|`--proxy`|*no default*|Address of the Teleport proxy. When --format is set to "kubernetes", this address will be set as cluster address in the generated kubeconfig file| |`--ttl`|`12h0m0s`|TTL (time to live) for the generated certificate.| -|`--user`|none|Teleport user name| -|`--windows-domain`|none|Active Directory domain for which this cert is valid. Only used when --format is set to "windows"| -|`--windows-pki-domain`|none|Active Directory domain where CRLs will be located. Only used when --format is set to "windows"| -|`--windows-sid`|none|Optional Security Identifier to embed in the certificate. Only used when --format is set to "windows"| -|`--windows-user`|none|Window user placed on the identity file. Only used when --format is set to "windows"| +|`--user`|*no default*|Teleport user name| +|`--windows-domain`|*no default*|Active Directory domain for which this cert is valid. Only used when --format is set to "windows"| +|`--windows-pki-domain`|*no default*|Active Directory domain where CRLs will be located. Only used when --format is set to "windows"| +|`--windows-sid`|*no default*|Optional Security Identifier to embed in the certificate. Only used when --format is set to "windows"| +|`--windows-user`|*no default*|Window user placed on the identity file. Only used when --format is set to "windows"| ## tctl autoupdate agents mark-done @@ -608,7 +608,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|groups|none (optional)|Groups to mark as done updating.| +|groups|*no default* (optional)|Groups to mark as done updating.| ## tctl autoupdate agents report @@ -635,7 +635,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|groups|none (optional)|Groups to rollback. When empty, every group already started is rolled back.| +|groups|*no default* (optional)|Groups to rollback. When empty, every group already started is rolled back.| ## tctl autoupdate agents start-update @@ -657,7 +657,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|groups|none (optional)|Groups to start updating.| +|groups|*no default* (optional)|Groups to start updating.| ## tctl autoupdate agents status @@ -707,7 +707,7 @@ Flags: |Flag|Default|Description| |---|---|---| |`--format`|`yaml`|Output format: 'yaml' or 'json'| -|`--proxy`|none|Address of the Teleport proxy. When defined this address will be used to retrieve client tools auto update configuration.| +|`--proxy`|*no default*|Address of the Teleport proxy. When defined this address will be used to retrieve client tools auto update configuration.| ## tctl autoupdate client-tools target @@ -730,7 +730,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|version|none (optional)|Client tools target version. Clients will be told to update to this version.| +|version|*no default* (optional)|Client tools target version. Clients will be told to update to this version.| ## tctl bots add @@ -746,23 +746,23 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`text`|Output format, one of: text, json| -|`--initial-public-key`|none|If set, use the given initial public key in SSH authorized_keys format, instead of generating a registration secret. The value must be quoted. Not compatible with --token or --legacy.| -|`--logins`|none|List of allowed SSH logins for the bot user| -|`--max-session-ttl`|none|Set a max session TTL for the bot's internal identity. 12h default, 168h maximum.| +|`--format`|`text` (one of: `text`, `json`)|Output format.| +|`--initial-public-key`|*no default*|If set, use the given initial public key in SSH authorized_keys format, instead of generating a registration secret. The value must be quoted. Not compatible with --token or --legacy.| +|`--logins`|*no default*|List of allowed SSH logins for the bot user| +|`--max-session-ttl`|*no default*|Set a max session TTL for the bot's internal identity. 12h default, 168h maximum.| |`--[no-]legacy`|`false`|If set, generate a legacy joining token instead of a bound keypair token. No effect if --token is set.| -|`--recovery-limit`|none|Overrides the recovery limit (default: 1) for the bound keypair token. No effect if --token or --legacy is set, or if --recovery-mode is not standard. Must be greater than 1.| -|`--recovery-mode`|`standard`|If set, overrides the recovery mode for the bound keypair token. No effect if --token or --legacy is set.| -|`--registration-secret`|none|Sets a registration secret for the bound keypair token. If not set, one will be randomly generated. No effect if --initial-public-key, --token, or --legacy is set. | -|`--roles`|none|Roles the bot is able to assume.| -|`--token`|none|The token to use, if any. If unset, a new single-use token will be created.| +|`--recovery-limit`|*no default*|Overrides the recovery limit (default: 1) for the bound keypair token. No effect if --token or --legacy is set, or if --recovery-mode is not standard. Must be greater than 1.| +|`--recovery-mode`|`standard` (one of: `standard`, `relaxed`, `insecure`)|If set, overrides the recovery mode for the bound keypair token. No effect if --token or --legacy is set.| +|`--registration-secret`|*no default*|Sets a registration secret for the bound keypair token. If not set, one will be randomly generated. No effect if --initial-public-key, --token, or --legacy is set. | +|`--roles`|*no default*|Roles the bot is able to assume.| +|`--token`|*no default*|The token to use, if any. If unset, a new single-use token will be created.| |`--ttl`|`1h0m0s`|TTL for the bot join token. For standard bound keypair tokens, this sets must_register_before; for legacy tokens, this sets the resource TTL.| Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|A name to uniquely identify this bot in the cluster.| +|name|*no default* (required)|A name to uniquely identify this bot in the cluster.| ## tctl bots instances add @@ -778,20 +778,20 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`text`|Output format, one of: text, json| -|`--initial-public-key`|none|If set, use the given initial public key in SSH authorized_keys format, instead of generating a registration secret. The value must be quoted. Not compatible with --token or --legacy.| +|`--format`|`text` (one of: `text`, `json`)|Output format.| +|`--initial-public-key`|*no default*|If set, use the given initial public key in SSH authorized_keys format, instead of generating a registration secret. The value must be quoted. Not compatible with --token or --legacy.| |`--[no-]legacy`|`false`|If set, generate a legacy joining token instead of a bound keypair token. No effect if --token is set.| -|`--recovery-limit`|none|Overrides the recovery limit (default: 1) for the bound keypair token. No effect if --token or --legacy is set, or if --recovery-mode is not standard. Must be greater than 1.| -|`--recovery-mode`|`standard`|If set, overrides the recovery mode for the bound keypair token. No effect if --token or --legacy is set.| -|`--registration-secret`|none|Sets a registration secret for the bound keypair token. If not set, one will be randomly generated. No effect if --initial-public-key, --token, or --legacy is set. | -|`--token`|none|The token to use, if any. If unset, a new single-use token will be created.| +|`--recovery-limit`|*no default*|Overrides the recovery limit (default: 1) for the bound keypair token. No effect if --token or --legacy is set, or if --recovery-mode is not standard. Must be greater than 1.| +|`--recovery-mode`|`standard` (one of: `standard`, `relaxed`, `insecure`)|If set, overrides the recovery mode for the bound keypair token. No effect if --token or --legacy is set.| +|`--registration-secret`|*no default*|Sets a registration secret for the bound keypair token. If not set, one will be randomly generated. No effect if --initial-public-key, --token, or --legacy is set. | +|`--token`|*no default*|The token to use, if any. If unset, a new single-use token will be created.| |`--ttl`|`1h0m0s`|TTL for the bot join token. For standard bound keypair tokens, this sets must_register_before; for legacy tokens, this sets the resource TTL.| Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|The name of the existing bot for which to add a new instance.| +|name|*no default* (required)|The name of the existing bot for which to add a new instance.| ## tctl bots instances list @@ -807,9 +807,9 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`text`|Output format, 'text' or 'json'| -|`--query`|none|An expression in the Teleport predicate language used to filter bot instances| -|`--search`|none|Fuzzy search query used to filter bot instances| +|`--format`|`text` (one of: `text`, `json`)|Output format.| +|`--query`|*no default*|An expression in the Teleport predicate language used to filter bot instances| +|`--search`|*no default*|Fuzzy search query used to filter bot instances| |`--sort-index`|`bot_name`|Request sort index, 'bot_name', 'active_at_latest', 'version_latest' or 'host_name_latest'| |`--sort-order`|`ascending`|Request sort order, 'ascending' or 'descending'| @@ -817,7 +817,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|name|none (optional)|The name of the bot from which to list instances. If unset, lists instances from all bots.| +|name|*no default* (optional)|The name of the bot from which to list instances. If unset, lists instances from all bots.| ## tctl bots instances show @@ -833,7 +833,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|id|none (required)|The full ID of the bot instance, in the form of \[bot name\]/\[uuid\]| +|id|*no default* (required)|The full ID of the bot instance, in the form of \[bot name\]/\[uuid\]| ## tctl bots ls @@ -859,7 +859,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|Name of an existing bot to remove.| +|name|*no default* (required)|Name of an existing bot to remove.| ## tctl bots update @@ -875,17 +875,17 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--add-logins`|none|Adds a comma-separated list of logins to an existing bot.| -|`--add-roles`|none|Adds a comma-separated list of roles to an existing bot.| -|`--set-logins`|none|Sets the bot's logins to the given comma-separated list, replacing any existing logins.| -|`--set-max-session-ttl`|none|Sets the max session TTL. 168h maximum.| -|`--set-roles`|none|Sets the bot's roles to the given comma-separated list, replacing any existing roles.| +|`--add-logins`|*no default*|Adds a comma-separated list of logins to an existing bot.| +|`--add-roles`|*no default*|Adds a comma-separated list of roles to an existing bot.| +|`--set-logins`|*no default*|Sets the bot's logins to the given comma-separated list, replacing any existing logins.| +|`--set-max-session-ttl`|*no default*|Sets the max session TTL. 168h maximum.| +|`--set-roles`|*no default*|Sets the bot's roles to the given comma-separated list, replacing any existing roles.| Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|Name of an existing bot to update.| +|name|*no default* (required)|Name of an existing bot to update.| ## tctl bound-keypair request-rotation @@ -901,7 +901,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|The name of the token| +|name|*no default* (required)|The name of the token| ## tctl create @@ -923,7 +923,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|filename|none (optional)|resource definition file, empty for stdin| +|filename|*no default* (optional)|resource definition file, empty for stdin| ## tctl db ls @@ -940,15 +940,15 @@ Flags: |Flag|Default|Description| |---|---|---| |`--format`|`text`|Output format, 'text', 'json', or 'yaml'| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")| |`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output| Arguments: |Argument|Default|Description| |---|---|---| -|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| +|labels|*no default* (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| ## tctl desktop bootstrap @@ -991,12 +991,12 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--asset-tag`|none|Inventory identifier for the device (e.g., Mac serial number)| -|`--enroll-ttl`|none|Time duration for the enrollment token| -|`--format`|`text`|Output format, 'text', 'json', or 'yaml'| +|`--asset-tag`|*no default*|Inventory identifier for the device (e.g., Mac serial number)| +|`--enroll-ttl`|*no default*|Time duration for the enrollment token| +|`--format`|`text` (one of: `text`, `json`, `yaml`)|Output format.| |`--[no-]current-device`|`false`|Registers the current device. Overrides --os and --asset-tag.| |`--[no-]enroll`|`false`|If set, creates a device enrollment token| -|`--os`|none|Operating system| +|`--os`|*no default* (one of: `linux`, `macos`, `windows`)|Operating system| ## tctl devices enroll @@ -1012,10 +1012,10 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--asset-tag`|none|Inventory identifier for the device| -|`--device-id`|none|Device identifier| +|`--asset-tag`|*no default*|Inventory identifier for the device| +|`--device-id`|*no default*|Device identifier| |`--[no-]current-device`|`false`|Enrolls the current device. Overrides --device-id and --asset-tag.| -|`--ttl`|none|Time duration for the enrollment token| +|`--ttl`|*no default*|Time duration for the enrollment token| ## tctl devices lock @@ -1031,12 +1031,12 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--asset-tag`|none|Inventory identifier for the device| -|`--device-id`|none|Device identifier| -|`--expires`|none|Time point (RFC3339) when the lock expires| -|`--message`|none|Message to display to locked-out users| +|`--asset-tag`|*no default*|Inventory identifier for the device| +|`--device-id`|*no default*|Device identifier| +|`--expires`|*no default*|Time point (RFC3339) when the lock expires| +|`--message`|*no default*|Message to display to locked-out users| |`--[no-]current-device`|`false`|Locks the current device. Overrides --device-id and --asset-tag.| -|`--ttl`|none|Time duration after which the lock expires| +|`--ttl`|*no default*|Time duration after which the lock expires| ## tctl devices ls @@ -1052,7 +1052,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`text`|Output format, 'text', 'json', or 'yaml'| +|`--format`|`text` (one of: `text`, `json`, `yaml`)|Output format.| ## tctl devices rm @@ -1068,8 +1068,8 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--asset-tag`|none|Inventory identifier for the device| -|`--device-id`|none|Device identifier| +|`--asset-tag`|*no default*|Inventory identifier for the device| +|`--device-id`|*no default*|Device identifier| |`--[no-]current-device`|`false`|Removes the current device. Overrides --device-id and --asset-tag.| ## tctl discovery nodes @@ -1088,7 +1088,7 @@ Flags: |Flag|Default|Description| |---|---|---| |`--cloud`|``|Comma-separated list of cloud providers to include (allowed: aws, azure). Empty (default) returns all.| -|`--format`|`text`|Output format.| +|`--format`|`text` (one of: `text`, `json`)|Output format.| |`--last`|`1h`|Time window to look back for failures in Teleport audit log (e.g. 1h, 24h, 30m).| |`--[no-]failures-only`|`false`|Only show instances with enrollment failures.| @@ -1106,7 +1106,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|resource type/resource name|none (optional)|Resource to update, e.g., "user/myuser"| +|resource type/resource name|*no default* (optional)|Resource to update, e.g., "user/myuser"| ## tctl get @@ -1130,7 +1130,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|resources|none (required)|Resource spec: 'type/\[name\]\[,...\]' or 'all'| +|resources|*no default* (required)|Resource spec: 'type/\[name\]\[,...\]' or 'all'| ## tctl help @@ -1146,7 +1146,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|command|none (optional)|Show help on command.| +|command|*no default* (optional)|Show help on command.| ## tctl idp saml test-attribute-mapping @@ -1162,9 +1162,9 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|none|output format, 'yaml' or 'json'| -|`--sp`|none|name of a file containing service provider spec| -|`-u`, `--users`|none|username or name of a file containing user spec| +|`--format`|*no default*|output format, 'yaml' or 'json'| +|`--sp`|*no default*|name of a file containing service provider spec| +|`-u`, `--users`|*no default*|username or name of a file containing user spec| ## tctl inventory list @@ -1180,13 +1180,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--exact-version`|none|Filter output by teleport version| +|`--exact-version`|*no default*|Filter output by teleport version| |`--format`|`text`|Output format, 'text' or 'json'| -|`--newer-than`|none|Filter for newer teleport versions| -|`--older-than`|none|Filter for older teleport versions| -|`--services`|none|Filter output by service (node,kube,proxy,etc)| -|`--update-group`|none|Filter output by update group| -|`--upgrader`|none|Filter output by upgrader (kube,unit,none)| +|`--newer-than`|*no default*|Filter for newer teleport versions| +|`--older-than`|*no default*|Filter for older teleport versions| +|`--services`|*no default*|Filter output by service (node,kube,proxy,etc)| +|`--update-group`|*no default*|Filter output by update group| +|`--upgrader`|*no default*|Filter output by upgrader (kube,unit,none)| ## tctl inventory ping @@ -1202,7 +1202,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|server-id|none (required)|ID of target server| +|server-id|*no default* (required)|ID of target server| ## tctl inventory status @@ -1236,15 +1236,15 @@ Flags: |Flag|Default|Description| |---|---|---| |`--format`|`text`|Output format, 'text', 'json', or 'yaml'| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")| |`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output| Arguments: |Argument|Default|Description| |---|---|---| -|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| +|labels|*no default* (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| ## tctl list-kinds @@ -1276,20 +1276,20 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--access-request`|none|UUID of an Access Request to disable.| -|`--bot-instance-id`|none|UUID of a bot instance to disable| -|`--device`|none|UUID of a trusted device to disable.| -|`--expires`|none|Time point (RFC3339) when the lock expires.| -|`--join-token`|none|Bot join token name to disable| -|`--linux-desktop`|none|Name of a Linux desktop to disable.| -|`--login`|none|Name of a local UNIX user to disable.| -|`--message`|none|Message to display to locked-out users.| -|`--mfa-device`|none|UUID of a user MFA device to disable.| -|`--role`|none|Name of a Teleport role to disable.| -|`--server-id`|none|UUID of a Teleport server to disable.| -|`--ttl`|none|Time duration after which the lock expires.| -|`--user`|none|Name of a Teleport user to disable.| -|`--windows-desktop`|none|Name of a Windows desktop to disable.| +|`--access-request`|*no default*|UUID of an Access Request to disable.| +|`--bot-instance-id`|*no default*|UUID of a bot instance to disable| +|`--device`|*no default*|UUID of a trusted device to disable.| +|`--expires`|*no default*|Time point (RFC3339) when the lock expires.| +|`--join-token`|*no default*|Bot join token name to disable| +|`--linux-desktop`|*no default*|Name of a Linux desktop to disable.| +|`--login`|*no default*|Name of a local UNIX user to disable.| +|`--message`|*no default*|Message to display to locked-out users.| +|`--mfa-device`|*no default*|UUID of a user MFA device to disable.| +|`--role`|*no default*|Name of a Teleport role to disable.| +|`--server-id`|*no default*|UUID of a Teleport server to disable.| +|`--ttl`|*no default*|Time duration after which the lock expires.| +|`--user`|*no default*|Name of a Teleport user to disable.| +|`--windows-desktop`|*no default*|Name of a Windows desktop to disable.| ## tctl login_rule test @@ -1307,13 +1307,13 @@ Flags: |---|---|---| |`--format`|`yaml`|Output format: 'yaml' or 'json'| |`--[no-]load-from-cluster`|`false`|load existing login rules from the connected Teleport cluster| -|`--resource-file`|none|login rule resource file name (YAML or JSON)| +|`--resource-file`|*no default*|login rule resource file name (YAML or JSON)| Arguments: |Argument|Default|Description| |---|---|---| -|traits-file|none (optional)|input user traits file name (YAML or JSON), empty for stdin| +|traits-file|*no default* (optional)|input user traits file name (YAML or JSON), empty for stdin| ## tctl nodes add @@ -1330,7 +1330,7 @@ Flags: |Flag|Default|Description| |---|---|---| |`--roles`|`node`|Comma-separated list of roles for the new node to assume \[node\]| -|`--token`|none|Override the default random generated token with a specified value| +|`--token`|*no default*|Override the default random generated token with a specified value| |`--ttl`|`30m0s`|Time to live for a generated token| ## tctl nodes ls @@ -1348,15 +1348,15 @@ Flags: |Flag|Default|Description| |---|---|---| |`--format`|`text`|Output format, 'text', or 'yaml'| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")| |`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output| Arguments: |Argument|Default|Description| |---|---|---| -|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| +|labels|*no default* (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| ## tctl notifications create @@ -1372,14 +1372,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--content`|none|Set the notification's content.| -|`--labels`|none|List of labels to attach to the notification. For example: key1=value1,key2=value2.| +|`--content`|*no default*|Set the notification's content.| +|`--labels`|*no default*|List of labels to attach to the notification. For example: key1=value1,key2=value2.| |`--[no-]require-all-roles`|`false`|Set whether this notification should target users who have all of the provided roles.| |`--[no-]warning`|`false`|Set whether this notification is a warning notification.| -|`--roles`|none|Target a specific set of roles. By default, this will target all users with any of the provided roles, use --require-all-roles to exclusively target users with all of them.| -|`-t`, `--title`|none|Set the notification's title.| +|`--roles`|*no default*|Target a specific set of roles. By default, this will target all users with any of the provided roles, use --require-all-roles to exclusively target users with all of them.| +|`-t`, `--title`|*no default*|Set the notification's title.| |`--ttl`|`30d`|Time duration after which the notification expires (default 30 days).| -|`--user`|none|Target a specific user.| +|`--user`|*no default*|Target a specific user.| ## tctl notifications ls @@ -1399,10 +1399,10 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`text`|Output format, 'yaml', 'json', or 'text'| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| +|`--format`|`text` (one of: `yaml`, `json`, `text`)|Output format.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| |`--[no-]all`|`false`|Set whether all notifications should be included, including those generated by Teleport, as opposed to solely those created using `tctl notifications create`.| -|`--user`|none|Set which user to list user-specific notifications for, or leave empty to list your own.| +|`--user`|*no default*|Set which user to list user-specific notifications for, or leave empty to list your own.| ## tctl notifications rm @@ -1418,13 +1418,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--user`|none|The user the notification to remove belongs to, if any.| +|`--user`|*no default*|The user the notification to remove belongs to, if any.| Arguments: |Argument|Default|Description| |---|---|---| -|id|none (required)|The ID of the notification to remove.| +|id|*no default* (required)|The ID of the notification to remove.| ## tctl plugins cleanup @@ -1446,7 +1446,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|type|none (required)|The type of plugin to clean up. Only supports Okta at present.| +|type|*no default* (required)|The type of plugin to clean up. Only supports Okta at present.| ## tctl plugins delete @@ -1462,7 +1462,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|name|none (optional)|The name of the SCIM plugin resource to delete| +|name|*no default* (optional)|The name of the SCIM plugin resource to delete| ## tctl plugins edit awsic @@ -1479,7 +1479,7 @@ Flags: |Flag|Default|Description| |---|---|---| |`--plugin-name`|`aws-identity-center`|Name of the AWS Identity Center integration instance to update. Defaults to aws-identity-center.| -|`--roles-sync-mode`|none|Control account-assignment role creation. ALL creates roles for all possible account assignments. NONE creates no roles, and also implies a totally-exclusive group import filter.| +|`--roles-sync-mode`|*no default* (one of: `ALL`, `NONE`)|Control account-assignment role creation. ALL creates roles for all possible account assignments. NONE creates no roles, and also implies a totally-exclusive group import filter.| ## tctl plugins install awsic @@ -1495,24 +1495,24 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--access-list-default-owner`|none|Teleport user to set as default owner for the imported Access Lists. Multiple flags allowed.| -|`--account-id`|none|Add AWS Account to account import list by ID. All AWS accounts will be imported if no items are added to account import list.| -|`--account-name`|none|Add AWS Account to account import list by name. Can be a glob, or enclosed in ^$ to specify a regular expression. All AWS accounts will be imported if no items are added to account import list.| -|`--assume-role-arn`|none|ARN of a role that the system credential should assume.| -|`--exclude-account-id`|none|Exclude AWS account from import list by ID.| -|`--exclude-account-name`|none|Exclude AWS account from import list by name. Can be a glob or a regular expression (enclosed in ^$).| -|`--exclude-group-name`|none|Exclude AWS group from import list by name. Can be a glob or a regular expression (enclosed in ^$).| -|`--group-name`|none|Add AWS group to group import list by name. Can be a glob, or enclosed in ^$ to specify a regular expression. If no filters are supplied then all AWS groups will be imported.| -|`--instance-arn`|none|AWS Identity center instance ARN| -|`--instance-region`|none|AWS Identity Center instance region| +|`--access-list-default-owner`|*no default*|Teleport user to set as default owner for the imported Access Lists. Multiple flags allowed.| +|`--account-id`|*no default*|Add AWS Account to account import list by ID. All AWS accounts will be imported if no items are added to account import list.| +|`--account-name`|*no default*|Add AWS Account to account import list by name. Can be a glob, or enclosed in ^$ to specify a regular expression. All AWS accounts will be imported if no items are added to account import list.| +|`--assume-role-arn`|*no default*|ARN of a role that the system credential should assume.| +|`--exclude-account-id`|*no default*|Exclude AWS account from import list by ID.| +|`--exclude-account-name`|*no default*|Exclude AWS account from import list by name. Can be a glob or a regular expression (enclosed in ^$).| +|`--exclude-group-name`|*no default*|Exclude AWS group from import list by name. Can be a glob or a regular expression (enclosed in ^$).| +|`--group-name`|*no default*|Add AWS group to group import list by name. Can be a glob, or enclosed in ^$ to specify a regular expression. If no filters are supplied then all AWS groups will be imported.| +|`--instance-arn`|*no default*|AWS Identity center instance ARN| +|`--instance-region`|*no default*|AWS Identity Center instance region| |`--[no-]force-scim-url`|`false`|Use the provided SCIM provisioning endpoint even if it fails scim endpoint validation| |`--[no-]use-system-credentials`|`true`|Uses system credentials instead of OIDC.| -|`--oidc-integration`|none|Name of the Teleport OIDC integration to use when authenticating with AWS. Must be supplied when --no-use-system-credentials is set.| -|`--roles-sync-mode`|`ALL`|Control account-assignment role creation. ALL creates Teleport Roles for all possible account assignments. NONE creates no Teleport Roles, and also implies a totally-exclusive group import filter.| -|`--scim-token`|none|AWS Identify Center SCIM provisioning token.| -|`--scim-url`|none|AWS Identity Center SCIM provisioning endpoint| -|`--user-label`|none|Add user label filter, in the form of a comma-separated list of "name=value" pairs. If no label filters are supplied, all Teleport users will be provisioned to Identity Center| -|`--user-origin`|none|Shorthand for "--user-label teleport.dev/origin=ORIGIN"| +|`--oidc-integration`|*no default*|Name of the Teleport OIDC integration to use when authenticating with AWS. Must be supplied when --no-use-system-credentials is set.| +|`--roles-sync-mode`|`ALL` (one of: `ALL`, `NONE`)|Control account-assignment role creation. ALL creates Teleport Roles for all possible account assignments. NONE creates no Teleport Roles, and also implies a totally-exclusive group import filter.| +|`--scim-token`|*no default*|AWS Identify Center SCIM provisioning token.| +|`--scim-url`|*no default*|AWS Identity Center SCIM provisioning endpoint| +|`--user-label`|*no default*|Add user label filter, in the form of a comma-separated list of "name=value" pairs. If no label filters are supplied, all Teleport users will be provisioned to Identity Center| +|`--user-origin`|*no default* (any of (repeatable): `defaults`, `config-file`, `dynamic`, `cloud`, `kubernetes`, `okta`, `scim`, `discovery-kubernetes`, `entra-id`, `aws-identity-center`, `integration_awsrolesanywhere`)|Shorthand for "--user-label teleport.dev/origin=ORIGIN"| ## tctl plugins install entraid @@ -1530,12 +1530,12 @@ Flags: |---|---|---| |`--access-list-owners-source`|`plugin`|Source of the Access List owners.| |`--auth-connector-name`|`entra-id-default`|Name of the SAML connector resource to create| -|`--default-owner`|none|List of Teleport users that are default owners for the imported Access Lists. Multiple flags allowed.| -|`--exclude-group-id`|none|Exclude group matching the specified group ID.| -|`--exclude-group-name`|none|Exclude groups matching the specified group name regex.| +|`--default-owner`|*no default*|List of Teleport users that are default owners for the imported Access Lists. Multiple flags allowed.| +|`--exclude-group-id`|*no default*|Exclude group matching the specified group ID.| +|`--exclude-group-name`|*no default*|Exclude groups matching the specified group name regex.| |`-f`, `--[no-]force`|`false`|Proceed with installation even if plugin already exists.| -|`--group-id`|none|Include group matching the specified group ID.| -|`--group-name`|none|Include groups matching the specified group name regex.| +|`--group-id`|*no default*|Include group matching the specified group ID.| +|`--group-name`|*no default*|Include groups matching the specified group name regex.| |`-m`, `--[no-]manual-setup`|`false`|Manually set up the EntraID integration.| |`--name`|`entra-id`|Name of the plugin resource to create| |`--[no-]access-graph`|`true`|Enables Access Graph cache build.| @@ -1587,10 +1587,10 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-a`, `--app-filter`|none|Add an app filter. Supports globbing by default. Enclose in `^pattern$` for full regex support.| -|`--api-token`|none|Okta API token for the plugin to use| -|`--app-id`|none|Okta ID of the APP used for SSO via SAML| -|`-g`, `--group-filter`|none|Add a group filter. Supports globbing by default. Enclose in `^pattern$` for full regex support.| +|`-a`, `--app-filter`|*no default*|Add an app filter. Supports globbing by default. Enclose in `^pattern$` for full regex support.| +|`--api-token`|*no default*|Okta API token for the plugin to use| +|`--app-id`|*no default*|Okta ID of the APP used for SSO via SAML| +|`-g`, `--group-filter`|*no default*|Add a group filter. Supports globbing by default. Enclose in `^pattern$` for full regex support.| |`--name`|`okta`|Name of the plugin resource to create| |`--[no-]accesslist-sync`|`true`|Enable group to Access List synchronization| |`--[no-]appgroup-sync`|`true`|Enable Okta Applications and Groups sync| @@ -1598,9 +1598,9 @@ Flags: |`--[no-]scim`|`false`|Enable SCIM Okta integration| |`--[no-]system-logs-export`|`false`|Enables the Teleport Identity Security SIEM integration for Okta.| |`--[no-]users-sync`|`true`|Enable user synchronization| -|`-o`, `--owner`|none|Add default owners for synced Access Lists| -|`--org`|none|URL of Okta organization| -|`--saml-connector`|none|SAML connector used for Okta SSO login.| +|`-o`, `--owner`|*no default*|Add default owners for synced Access Lists| +|`--org`|*no default*|URL of Okta organization| +|`--saml-connector`|*no default*|SAML connector used for Okta SSO login.| ## tctl plugins install scim @@ -1616,9 +1616,9 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--auth`|`oauth`|Plugin Authentication type.| -|`--connector`|none|Name of the Teleport connector to use.| -|`--connector-type`|none|Type of the Teleport connector to use.| +|`--auth`|`oauth` (one of: `bearer`, `oauth`)|Plugin Authentication type.| +|`--connector`|*no default*|Name of the Teleport connector to use.| +|`--connector-type`|*no default* (one of: `oidc`, `saml`)|Type of the Teleport connector to use.| ## tctl plugins rotate awsic @@ -1641,7 +1641,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|token|none (required)|The new SCIM bearer token.| +|token|*no default* (required)|The new SCIM bearer token.| ## tctl proxy ls @@ -1679,7 +1679,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|session-id|none (required)|ID of the session to download recordings for.| +|session-id|*no default* (required)|ID of the session to download recordings for.| ## tctl recordings encryption complete-rotation @@ -1742,10 +1742,10 @@ Flags: |Flag|Default|Description| |---|---|---| |`--format`|`text`|Format output (text, json, yaml).. Defaults to 'text'.| -|`--from-utc`|none|Start of time range in which recordings are listed. Format 2006-01-02. Defaults to 24 hours ago.| -|`--last`|none|Duration into the past from which session recordings should be listed. Format 5h30m40s| +|`--from-utc`|*no default*|Start of time range in which recordings are listed. Format 2006-01-02. Defaults to 24 hours ago.| +|`--last`|*no default*|Duration into the past from which session recordings should be listed. Format 5h30m40s| |`--limit`|`50`|Maximum number of recordings to show. Default 50.| -|`--to-utc`|none|End of time range in which recordings are listed. Format 2006-01-02. Defaults to current time.| +|`--to-utc`|*no default*|End of time range in which recordings are listed. Format 2006-01-02. Defaults to current time.| ## tctl recordings search @@ -1761,30 +1761,30 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--access-request`|none|Filter by access request ID. Can be specified multiple times.| -|`--database-name`|none|Filter database sessions by database name.| +|`--access-request`|*no default*|Filter by access request ID. Can be specified multiple times.| +|`--database-name`|*no default*|Filter database sessions by database name.| |`--format`|`text`|Format output (text, json, yaml).. Defaults to 'text'.| -|`--from`|none|Start of time range. Format 2006-01-02. Defaults to 24 hours ago.| -|`--kind`|none|Filter by session kind (ssh, db, k8s, desktop). Can be specified multiple times.| -|`--label`|none|Filter by resource labels (key=value pairs), e.g. env/prod=true,db/type=postgres.| +|`--from`|*no default*|Start of time range. Format 2006-01-02. Defaults to 24 hours ago.| +|`--kind`|*no default*|Filter by session kind (ssh, db, k8s, desktop). Can be specified multiple times.| +|`--label`|*no default*|Filter by resource labels (key=value pairs), e.g. env/prod=true,db/type=postgres.| |`--limit`|`50`|Maximum number of results to return.| -|`--pod-name`|none|Filter Kubernetes sessions by pod name.| -|`--pod-namespace`|none|Filter Kubernetes sessions by pod namespace.| -|`--resource-kind`|none|Filter by Teleport resource type (node, kube_cluster, db).| -|`--resource-name`|none|Filter by resource name.| -|`--role`|none|Filter by role held during the session. Can be specified multiple times.| -|`--search-mode`|`hybrid`|Search strategy to use when search queries are provided.| -|`--server-addr`|none|Filter SSH sessions by server address.| -|`--server-hostname`|none|Filter SSH sessions by server hostname.| -|`--severity`|none|Minimum severity level to include (low, medium, high, critical).| -|`--to`|none|End of time range. Format 2006-01-02. Defaults to current time.| -|`--username`|none|Filter by the Teleport username that initiated the session.| +|`--pod-name`|*no default*|Filter Kubernetes sessions by pod name.| +|`--pod-namespace`|*no default*|Filter Kubernetes sessions by pod namespace.| +|`--resource-kind`|*no default*|Filter by Teleport resource type (node, kube_cluster, db).| +|`--resource-name`|*no default*|Filter by resource name.| +|`--role`|*no default*|Filter by role held during the session. Can be specified multiple times.| +|`--search-mode`|`hybrid` (one of: `hybrid`, `keyword`, `embeddings`)|Search strategy to use when search queries are provided.| +|`--server-addr`|*no default*|Filter SSH sessions by server address.| +|`--server-hostname`|*no default*|Filter SSH sessions by server hostname.| +|`--severity`|*no default*|Minimum severity level to include (low, medium, high, critical).| +|`--to`|*no default*|End of time range. Format 2006-01-02. Defaults to current time.| +|`--username`|*no default*|Filter by the Teleport username that initiated the session.| Arguments: |Argument|Default|Description| |---|---|---| -|query|none (optional)|Natural language description of the sessions to find (e.g. "SSH sessions exfiltrating data to external endpoints").| +|query|*no default* (optional)|Natural language description of the sessions to find (e.g. "SSH sessions exfiltrating data to external endpoints").| ## tctl requests approve @@ -1800,17 +1800,17 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--annotations`|none|Resolution attributes \=\\[,...\]| -|`--assume-start-time`|none|Sets time roles can be assumed by requestor (RFC3339 e.g 2023-12-12T23:20:50.52Z)| -|`--delegator`|none|Optional delegating identity| -|`--reason`|none|Optional reason message| -|`--roles`|none|Override requested roles \\[,...\]| +|`--annotations`|*no default*|Resolution attributes \=\\[,...\]| +|`--assume-start-time`|*no default*|Sets time roles can be assumed by requestor (RFC3339 e.g 2023-12-12T23:20:50.52Z)| +|`--delegator`|*no default*|Optional delegating identity| +|`--reason`|*no default*|Optional reason message| +|`--roles`|*no default*|Override requested roles \\[,...\]| Arguments: |Argument|Default|Description| |---|---|---| -|request-id|none (required)|ID of target request(s)| +|request-id|*no default* (required)|ID of target request(s)| ## tctl requests create @@ -1827,15 +1827,15 @@ Flags: |Flag|Default|Description| |---|---|---| |`--[no-]dry-run`|`false`|Don't actually generate the Access Request| -|`--reason`|none|Optional reason message| -|`--resource`|none|Resource ID to be requested| -|`--roles`|none|Roles to be requested| +|`--reason`|*no default*|Optional reason message| +|`--resource`|*no default*|Resource ID to be requested| +|`--roles`|*no default*|Roles to be requested| Arguments: |Argument|Default|Description| |---|---|---| -|username|none (required)|Name of target user| +|username|*no default* (required)|Name of target user| ## tctl requests deny @@ -1851,15 +1851,15 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--annotations`|none|Resolution annotations \=\\[,...\]| -|`--delegator`|none|Optional delegating identity| -|`--reason`|none|Optional reason message| +|`--annotations`|*no default*|Resolution annotations \=\\[,...\]| +|`--delegator`|*no default*|Optional delegating identity| +|`--reason`|*no default*|Optional reason message| Arguments: |Argument|Default|Description| |---|---|---| -|request-id|none (required)|ID of target request(s)| +|request-id|*no default* (required)|ID of target request(s)| ## tctl requests get @@ -1875,7 +1875,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|request-id|none (required)|ID of target request(s)| +|request-id|*no default* (required)|ID of target request(s)| ## tctl requests ls @@ -1908,7 +1908,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--author`|none|Username of reviewer| +|`--author`|*no default*|Username of reviewer| |`--[no-]approve`|`false`|Review proposes approval| |`--[no-]deny`|`false`|Review proposes denial| @@ -1916,7 +1916,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|request-id|none (required)|ID of target request| +|request-id|*no default* (required)|ID of target request| ## tctl requests rm @@ -1938,7 +1938,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|request-id|none (required)|ID of target request(s)| +|request-id|*no default* (required)|ID of target request(s)| ## tctl rm @@ -1954,7 +1954,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|resource type/resource name|none (optional)|Resource to delete +|resource type/resource name|*no default* (optional)|Resource to delete \ Type of a resource \[for example: connector,user,cluster,token\] \ Resource name to delete @@ -1976,7 +1976,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|connector_name|none (required)|name of the SAML connector to export the key from| +|connector_name|*no default* (required)|name of the SAML connector to export the key from| ## tctl scoped assignments list @@ -1992,9 +1992,9 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| -|`--role`|none|Filter by assigned role.| -|`--user`|none|Filter by user.| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--role`|*no default*|Filter by assigned role.| +|`--user`|*no default*|Filter by user.| ## tctl scoped status @@ -2020,15 +2020,15 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--assign-scope`|none|Scope that should be applied to resources provisioned by this token| -|`--format`|none|Format output (text, json, yaml).| -|`--labels`|none|Set token labels, e.g. env=prod,region=us-west| -|`--mode`|none|Usage mode of a token (default: unlimited, single_use)| -|`--name`|none|Override the default, randomly generated token name with a specified name| -|`--scope`|none|Scope assigned to the token itself| -|`--ssh-labels`|none|Set immutable ssh labels the token should assign to provisioned resources, e.g. env=prod,region=us-west| +|`--assign-scope`|*no default*|Scope that should be applied to resources provisioned by this token| +|`--format`|*no default* (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--labels`|*no default*|Set token labels, e.g. env=prod,region=us-west| +|`--mode`|*no default*|Usage mode of a token (default: unlimited, single_use)| +|`--name`|*no default*|Override the default, randomly generated token name with a specified name| +|`--scope`|*no default*|Scope assigned to the token itself| +|`--ssh-labels`|*no default*|Set immutable ssh labels the token should assign to provisioned resources, e.g. env=prod,region=us-west| |`--ttl`|`30m0s`|Set expiration time for token, default is 30 minutes| -|`--type`|none|Type(s) of token to add, e.g. --type=node| +|`--type`|*no default*|Type(s) of token to add, e.g. --type=node| ## tctl scoped tokens ls @@ -2044,7 +2044,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|none|Format output (text, json, yaml).| +|`-f`, `--format`|*no default* (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| |`--[no-]with-secrets`|`false`|Do not redact join tokens| ## tctl scoped tokens rm @@ -2061,7 +2061,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|token|none (optional)|Token to delete| +|token|*no default* (optional)|Token to delete| ## tctl sso configure github @@ -2078,14 +2078,14 @@ Flags: |Flag|Default|Description| |---|---|---| |`--api-endpoint-url`|`https://api.github.com`|API endpoint URL for GitHub instance.| -|`--display`|none|Sets the connector display name.| +|`--display`|*no default*|Sets the connector display name.| |`--endpoint-url`|`https://github.com`|Endpoint URL for GitHub instance.| -|`--id`|none|GitHub app client ID.| +|`--id`|*no default*|GitHub app client ID.| |`-n`, `--name`|`github`|Connector name.| |`--[no-]ignore-missing-roles`|`false`|Ignore missing roles referenced in --teams-to-roles.| -|`--redirect-url`|none|Authorization callback URL.| -|`-r`, `--teams-to-roles`|none|Sets teams-to-roles mapping using format 'organization,name,role1,role2,...'. Repeatable.| -|`--secret`|none|GitHub app client secret.| +|`--redirect-url`|*no default*|Authorization callback URL.| +|`-r`, `--teams-to-roles`|*no default*|Sets teams-to-roles mapping using format 'organization,name,role1,role2,...'. Repeatable.| +|`--secret`|*no default*|GitHub app client secret.| ## tctl sso configure oidc @@ -2102,24 +2102,24 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--acr`|none|Authentication Context Class Reference values.| -|`--display`|none|Sets the connector display name.| -|`--google-acc`|none|Google only. String containing Google service account credentials.| -|`--google-acc-uri`|none|Google only. URI pointing at service account credentials. Example: file:///var/lib/teleport/gworkspace-creds.json.| -|`--google-admin`|none|Google only. Email of a Google admin to impersonate.| -|`--google-id`|none|Shorthand for setting the --id flag to \.apps.googleusercontent.com| -|`--id`|none|OIDC app client ID.| -|`--issuer-url`|none|Issuer URL.| -|`-n`, `--name`|none|Connector name. Required, unless implied from preset.| +|`--acr`|*no default*|Authentication Context Class Reference values.| +|`--display`|*no default*|Sets the connector display name.| +|`--google-acc`|*no default*|Google only. String containing Google service account credentials.| +|`--google-acc-uri`|*no default*|Google only. URI pointing at service account credentials. Example: file:///var/lib/teleport/gworkspace-creds.json.| +|`--google-admin`|*no default*|Google only. Email of a Google admin to impersonate.| +|`--google-id`|*no default*|Shorthand for setting the --id flag to \.apps.googleusercontent.com| +|`--id`|*no default*|OIDC app client ID.| +|`--issuer-url`|*no default*|Issuer URL.| +|`-n`, `--name`|*no default*|Connector name. Required, unless implied from preset.| |`--[no-]google-legacy`|`false`|Google only. Flag to select groups with direct membership filtered by domain (legacy behavior). Disabled by default. More info: https://goteleport.com/docs/enterprise/sso/google-workspace/#how-teleport-uses-google-workspace-apis| |`--[no-]ignore-missing-roles`|`false`|Ignore missing roles referenced in --claims-to-roles.| -|`-p`, `--preset`|none|Preset. One of: \[google gitlab okta\]| -|`--prompt`|none|Optional OIDC prompt. Example values: none, select_account, login, consent.| -|`--provider`|none|Sets the external identity provider type to enable IdP specific workarounds. Examples: ping, adfs, netiq, okta.| -|`-r`, `--claims-to-roles`|none|Sets claim-to-roles mapping using format 'claim_name,claim_value,role1,role2,...'. Repeatable.| -|`--redirect-url`|none|Authorization callback URL(s). Each repetition of the flag declares one redirectURL.| -|`--scope`|none|Scope specifies additional scopes set by provider. Each repetition of the flag declares one scope. Examples: email, groups, openid.| -|`--secret`|none|OIDC app client secret.| +|`-p`, `--preset`|*no default* (one of: `google`, `gitlab`, `okta`)|Preset.| +|`--prompt`|*no default*|Optional OIDC prompt. Example values: none, select_account, login, consent.| +|`--provider`|*no default*|Sets the external identity provider type to enable IdP specific workarounds. Examples: ping, adfs, netiq, okta.| +|`-r`, `--claims-to-roles`|*no default*|Sets claim-to-roles mapping using format 'claim_name,claim_value,role1,role2,...'. Repeatable.| +|`--redirect-url`|*no default*|Authorization callback URL(s). Each repetition of the flag declares one redirectURL.| +|`--scope`|*no default*|Scope specifies additional scopes set by provider. Each repetition of the flag declares one scope. Examples: email, groups, openid.| +|`--secret`|*no default*|OIDC app client secret.| ## tctl sso configure saml @@ -2136,24 +2136,24 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--acs`|none|AssertionConsumerService is a URL for assertion consumer service on the service provider (Teleport's side).| -|`--assertion-cert-file`|none|A file with cert used for securing SAML assertions. Must be used together with --assertion-key-file.| -|`--assertion-key-file`|none|A file with key used for securing SAML assertions. Must be used together with --assertion-cert-file.| -|`--audience`|none|Audience uniquely identifies our service provider.| -|`--cert`|none|Cert file with the IdP certificate PEM. IdP signs \ responses using this certificate.| -|`--display`|none|Sets the connector display name.| -|`-e`, `--entity-descriptor`|none|Set the Entity Descriptor. Valid values: file, URL, XML content. Supplies configuration parameters as single XML instead of individual elements.| -|`--issuer`|none|Issuer is the identity provider issuer.| -|`-n`, `--name`|none|Connector name. Required, unless implied from preset.| +|`--acs`|*no default*|AssertionConsumerService is a URL for assertion consumer service on the service provider (Teleport's side).| +|`--assertion-cert-file`|*no default*|A file with cert used for securing SAML assertions. Must be used together with --assertion-key-file.| +|`--assertion-key-file`|*no default*|A file with key used for securing SAML assertions. Must be used together with --assertion-cert-file.| +|`--audience`|*no default*|Audience uniquely identifies our service provider.| +|`--cert`|*no default*|Cert file with the IdP certificate PEM. IdP signs \ responses using this certificate.| +|`--display`|*no default*|Sets the connector display name.| +|`-e`, `--entity-descriptor`|*no default*|Set the Entity Descriptor. Valid values: file, URL, XML content. Supplies configuration parameters as single XML instead of individual elements.| +|`--issuer`|*no default*|Issuer is the identity provider issuer.| +|`-n`, `--name`|*no default*|Connector name. Required, unless implied from preset.| |`--[no-]allow-idp-initiated`|`false`|Allow the IdP to initiate the SSO flow.| |`--[no-]ignore-missing-roles`|`false`|Ignore missing roles referenced in --attributes-to-roles.| -|`-p`, `--preset`|none|Preset. One of: \[okta onelogin ad adfs\]| -|`--provider`|none|Sets the external identity provider type. Examples: ping, adfs.| -|`-r`, `--attributes-to-roles`|none|Sets attribute-to-role mapping using format 'attr_name,attr_value,role1,role2,...'. Repeatable.| -|`--service-provider-issuer`|none|ServiceProviderIssuer is the issuer of the service provider (Teleport).| -|`--signing-cert-file`|none|A file with request certificate. Must be used together with --signing-key-file.| -|`--signing-key-file`|none|A file with request signing key. Must be used together with --signing-cert-file.| -|`--sso`|none|SSO is the URL of the identity provider's SSO service.| +|`-p`, `--preset`|*no default* (one of: `okta`, `onelogin`, `ad`, `adfs`)|Preset.| +|`--provider`|*no default*|Sets the external identity provider type. Examples: ping, adfs.| +|`-r`, `--attributes-to-roles`|*no default*|Sets attribute-to-role mapping using format 'attr_name,attr_value,role1,role2,...'. Repeatable.| +|`--service-provider-issuer`|*no default*|ServiceProviderIssuer is the issuer of the service provider (Teleport).| +|`--signing-cert-file`|*no default*|A file with request certificate. Must be used together with --signing-key-file.| +|`--signing-key-file`|*no default*|A file with request signing key. Must be used together with --signing-cert-file.| +|`--sso`|*no default*|SSO is the URL of the identity provider's SSO service.| ## tctl sso test @@ -2169,13 +2169,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--browser`|none|Set to 'none' to suppress browser opening on login.| +|`--browser`|*no default*|Set to 'none' to suppress browser opening on login.| Arguments: |Argument|Default|Description| |---|---|---| -|filename|none (optional)|Connector resource definition filename. Empty for stdin.| +|filename|*no default* (optional)|Connector resource definition filename. Empty for stdin.| ## tctl stable-unix-users ls @@ -2191,7 +2191,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|`text`|Output format, 'text', or 'json'| +|`--format`|`text` (one of: `text`, `json`, `yaml`)|Output format.| ## tctl status @@ -2220,7 +2220,7 @@ Flags: |---|---|---| |`--bot-ttl`|`1h`|Time-to-live of the Bot resource. The bot will be removed after this period. Defaults to \[1h\]| |`--resource-prefix`|`tctl-terraform-env-`|Resource prefix to use when creating the Terraform role and bots. Defaults to \[tctl-terraform-env-\]| -|`--role`|none|Role used by Terraform. The role must already exist in Teleport. When not specified, uses the default role "terraform-provider"| +|`--role`|*no default*|Role used by Terraform. The role must already exist in Teleport. When not specified, uses the default role "terraform-provider"| ## tctl tokens add @@ -2238,14 +2238,14 @@ Flags: |---|---|---| |`--app-name`|`example-app`|Name of the application to add| |`--app-uri`|`http://localhost:8080`|URI of the application to add| -|`--db-name`|none|Name of the database to add| -|`--db-protocol`|none|Database protocol to use. Supported are: \[postgres mysql mongodb oracle cockroachdb redis snowflake sqlserver cassandra elasticsearch opensearch dynamodb clickhouse clickhouse-http spanner\]| -|`--db-uri`|none|Address the database is reachable at| -|`--format`|none|Output format, 'text', 'json', or 'yaml'| -|`--labels`|none|Set token labels, e.g. env=prod,region=us-west| +|`--db-name`|*no default*|Name of the database to add| +|`--db-protocol`|*no default*|Database protocol to use. Supported are: \[postgres mysql mongodb oracle cockroachdb redis snowflake sqlserver cassandra elasticsearch opensearch dynamodb clickhouse clickhouse-http spanner\]| +|`--db-uri`|*no default*|Address the database is reachable at| +|`--format`|*no default* (one of: `text`, `json`, `yaml`)|Output format.| +|`--labels`|*no default*|Set token labels, e.g. env=prod,region=us-west| |`--ttl`|`30m0s`|Set expiration time for token, default is 30 minutes| -|`--type`|none|Type(s) of token to add, e.g. --type=node,app,db,proxy,etc| -|`--value`|none|Override the default random generated token with a specified value| +|`--type`|*no default*|Type(s) of token to add, e.g. --type=node,app,db,proxy,etc| +|`--value`|*no default*|Override the default random generated token with a specified value| ## tctl tokens configure-kube @@ -2262,17 +2262,17 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--bot`|none|Name of the bot that this token will grant access to. When set, creates a bot token. Overrides --type| -|`--cluster-name`|none|Name of the Kubernetes cluster. When not set, defaults to the context name.| -|`--context`|none|Kubernetes context to use. When not set, defaults to the active context.| +|`--bot`|*no default*|Name of the bot that this token will grant access to. When set, creates a bot token. Overrides --type| +|`--cluster-name`|*no default*|Name of the Kubernetes cluster. When not set, defaults to the context name.| +|`--context`|*no default*|Kubernetes context to use. When not set, defaults to the active context.| |`-f`, `--[no-]force`|`false`|Force the token creation, even if the token already exists| |`-j`, `--join-with`|`auto`|Kubernetes joining type, possible values are 'oidc', 'jwks', and 'auto'. See https://goteleport.com/docs/reference/join-methods/#kubernetes-kubernetes for more details.| |`-n`, `--namespace`|`teleport`|Namespace of the Kubernetes Service Account using the token. For 'teleport-kube-agent' and 'tbot' Helm charts, this is the release namespace.| |`-o`, `--out`|`./values.yaml`|Path of the output file.| -|`-s`, `--service-account`|none|Name of the Kubernetes Service Account using the token. For 'teleport-kube-agent' and 'tbot' Helm charts, this is the release name.| -|`--token-name`|none|Optional name of the created join token. When not set, default to '\(-\)'| +|`-s`, `--service-account`|*no default*|Name of the Kubernetes Service Account using the token. For 'teleport-kube-agent' and 'tbot' Helm charts, this is the release name.| +|`--token-name`|*no default*|Optional name of the created join token. When not set, default to '\(-\)'| |`--type`|`kube,app,discovery`|Type(s) of token to add, e.g. --type=kube,app,db,discovery,proxy,etc| -|`--update-group`|none|Optional update group used for version detection and agent updater configuration| +|`--update-group`|*no default*|Optional update group used for version detection and agent updater configuration| ## tctl tokens ls @@ -2288,8 +2288,8 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--format`|none|Output format, 'text', 'json' or 'yaml'| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| +|`--format`|*no default* (one of: `text`, `json`, `yaml`)|Output format.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)| |`--[no-]with-secrets`|`false`|Do not redact join tokens| ## tctl tokens rm @@ -2306,7 +2306,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|token|none (optional)|Token to delete| +|token|*no default* (optional)|Token to delete| ## tctl top @@ -2322,7 +2322,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|diag-addr|none (optional)|Diagnostic HTTP URL| +|diag-addr|*no default* (optional)|Diagnostic HTTP URL| |refresh|`5s` (optional)|Refresh period| ## tctl update @@ -2339,14 +2339,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--set-labels`|none|Set labels| -|`--set-ttl`|none|Set TTL| +|`--set-labels`|*no default*|Set labels| +|`--set-ttl`|*no default*|Set TTL| Arguments: |Argument|Default|Description| |---|---|---| -|resource type/resource name|none (optional)|Resource to update +|resource type/resource name|*no default* (optional)|Resource to update \ Type of a resource \[for example: rc\] \ Resource name to update @@ -2367,28 +2367,28 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--aws-role-arns`|none|List of allowed AWS role ARNs for the new user| -|`--azure-identities`|none|List of allowed Azure identities for the new user| -|`--db-names`|none|List of allowed database names for the new user| -|`--db-roles`|none|List of database roles for automatic database user provisioning| -|`--db-users`|none|List of allowed database users for the new user| -|`--default-relay-addr`|none|Relay address that clients should use by default| -|`--gcp-service-accounts`|none|List of allowed GCP service accounts for the new user| -|`--host-user-gid`|none|GID for auto provisioned host users to use| -|`--host-user-uid`|none|UID for auto provisioned host users to use| -|`--kubernetes-groups`|none|List of allowed Kubernetes groups for the new user| -|`--kubernetes-users`|none|List of allowed Kubernetes users for the new user| -|`--logins`|none|List of allowed SSH logins for the new user| -|`--mcp-tools`|none|List of allowed MCP tools for the new user| -|`--roles`|none|List of roles for the new user to assume| +|`--aws-role-arns`|*no default*|List of allowed AWS role ARNs for the new user| +|`--azure-identities`|*no default*|List of allowed Azure identities for the new user| +|`--db-names`|*no default*|List of allowed database names for the new user| +|`--db-roles`|*no default*|List of database roles for automatic database user provisioning| +|`--db-users`|*no default*|List of allowed database users for the new user| +|`--default-relay-addr`|*no default*|Relay address that clients should use by default| +|`--gcp-service-accounts`|*no default*|List of allowed GCP service accounts for the new user| +|`--host-user-gid`|*no default*|GID for auto provisioned host users to use| +|`--host-user-uid`|*no default*|UID for auto provisioned host users to use| +|`--kubernetes-groups`|*no default*|List of allowed Kubernetes groups for the new user| +|`--kubernetes-users`|*no default*|List of allowed Kubernetes users for the new user| +|`--logins`|*no default*|List of allowed SSH logins for the new user| +|`--mcp-tools`|*no default*|List of allowed MCP tools for the new user| +|`--roles`|*no default*|List of roles for the new user to assume| |`--ttl`|`1h0m0s`|Set expiration time for token, default is 1h0m0s, maximum is 48h0m0s| -|`--windows-logins`|none|List of allowed Windows logins for the new user| +|`--windows-logins`|*no default*|List of allowed Windows logins for the new user| Arguments: |Argument|Default|Description| |---|---|---| -|account|none (required)|Teleport user account name| +|account|*no default* (required)|Teleport user account name| ## tctl users ls @@ -2420,7 +2420,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|account|none (required)|Teleport user account name| +|account|*no default* (required)|Teleport user account name| ## tctl users rm @@ -2436,7 +2436,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|logins|none (required)|Comma-separated list of user logins to delete| +|logins|*no default* (required)|Comma-separated list of user logins to delete| ## tctl users update @@ -2452,27 +2452,27 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--set-aws-role-arns`|none|List of allowed AWS role ARNs for the user, replaces current AWS role ARNs| -|`--set-azure-identities`|none|List of allowed Azure identities for the user, replaces current Azure identities| -|`--set-db-names`|none|List of allowed database names for the user, replaces current database names| -|`--set-db-roles`|none|List of allowed database roles for automatic database user provisioning, replaces current database roles| -|`--set-db-users`|none|List of allowed database users for the user, replaces current database users| -|`--set-default-relay-addr`|none|Relay address that clients should use by default. Value can be reset by providing an empty string| -|`--set-gcp-service-accounts`|none|List of allowed GCP service accounts for the user, replaces current service accounts| -|`--set-host-user-gid`|none|GID for auto provisioned host users to use. Value can be reset by providing an empty string| -|`--set-host-user-uid`|none|UID for auto provisioned host users to use. Value can be reset by providing an empty string| -|`--set-kubernetes-groups`|none|List of allowed Kubernetes groups for the user, replaces current Kubernetes groups| -|`--set-kubernetes-users`|none|List of allowed Kubernetes users for the user, replaces current Kubernetes users| -|`--set-logins`|none|List of allowed SSH logins for the user, replaces current logins| -|`--set-mcp-tools`|none|List of allowed MCP tools for the user, replaces current allowed MCP tools.| -|`--set-roles`|none|List of roles for the user to assume, replaces current roles| -|`--set-windows-logins`|none|List of allowed Windows logins for the user, replaces current Windows logins| +|`--set-aws-role-arns`|*no default*|List of allowed AWS role ARNs for the user, replaces current AWS role ARNs| +|`--set-azure-identities`|*no default*|List of allowed Azure identities for the user, replaces current Azure identities| +|`--set-db-names`|*no default*|List of allowed database names for the user, replaces current database names| +|`--set-db-roles`|*no default*|List of allowed database roles for automatic database user provisioning, replaces current database roles| +|`--set-db-users`|*no default*|List of allowed database users for the user, replaces current database users| +|`--set-default-relay-addr`|*no default*|Relay address that clients should use by default. Value can be reset by providing an empty string| +|`--set-gcp-service-accounts`|*no default*|List of allowed GCP service accounts for the user, replaces current service accounts| +|`--set-host-user-gid`|*no default*|GID for auto provisioned host users to use. Value can be reset by providing an empty string| +|`--set-host-user-uid`|*no default*|UID for auto provisioned host users to use. Value can be reset by providing an empty string| +|`--set-kubernetes-groups`|*no default*|List of allowed Kubernetes groups for the user, replaces current Kubernetes groups| +|`--set-kubernetes-users`|*no default*|List of allowed Kubernetes users for the user, replaces current Kubernetes users| +|`--set-logins`|*no default*|List of allowed SSH logins for the user, replaces current logins| +|`--set-mcp-tools`|*no default*|List of allowed MCP tools for the user, replaces current allowed MCP tools.| +|`--set-roles`|*no default*|List of roles for the user to assume, replaces current roles| +|`--set-windows-logins`|*no default*|List of allowed Windows logins for the user, replaces current Windows logins| Arguments: |Argument|Default|Description| |---|---|---| -|account|none (required)|Teleport user account name| +|account|*no default* (required)|Teleport user account name| ## tctl version @@ -2508,10 +2508,10 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--expires-at`|none|Time that the revocation should expire, usually this should match the expiry time of the credential. This should be specified using RFC3339 e.g '2024-02-05T15:04:00Z'. If unspecified, the time 1 week from now is used.| -|`--reason`|none|Reason for revocation.| -|`--serial`|none|Serial number of the certificate to revoke.| -|`--type`|none|Type of credential to revoke (x509)| +|`--expires-at`|*no default*|Time that the revocation should expire, usually this should match the expiry time of the credential. This should be specified using RFC3339 e.g '2024-02-05T15:04:00Z'. If unspecified, the time 1 week from now is used.| +|`--reason`|*no default*|Reason for revocation.| +|`--serial`|*no default*|Serial number of the certificate to revoke.| +|`--type`|*no default* (one of: `x509`)|Type of credential to revoke (x509)| ## tctl workload-identity revocations crl @@ -2528,7 +2528,7 @@ Flags: |Flag|Default|Description| |---|---|---| |`--[no-]follow`|`false`|Follow the stream of CRL updates.| -|`--out`|none|Path to write the CRL as a file to. If unspecified, STDOUT will be used.| +|`--out`|*no default*|Path to write the CRL as a file to. If unspecified, STDOUT will be used.| ## tctl workload-identity revocations ls @@ -2554,8 +2554,8 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--serial`|none|Serial number of the certificate to remove the revocation for.| -|`--type`|none|Type of credential to remove the revocation for (x509).| +|`--serial`|*no default*|Serial number of the certificate to remove the revocation for.| +|`--type`|*no default* (one of: `x509`)|Type of credential to remove the revocation for (x509).| ## tctl workload-identity rm @@ -2571,7 +2571,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|Name of the workload identity configuration to delete.| +|name|*no default* (required)|Name of the workload identity configuration to delete.| ## tctl workload-identity x509-issuer-overrides create @@ -2595,7 +2595,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|fullchain.pem|none (required)|PEM files containing an issuer and its optional chain each.| +|fullchain.pem|*no default* (required)|PEM files containing an issuer and its optional chain each.| ## tctl workload-identity x509-issuer-overrides sign-csrs diff --git a/docs/pages/reference/cli/teleport.mdx b/docs/pages/reference/cli/teleport.mdx index 6b128205bd0..97c4f3c5d81 100644 --- a/docs/pages/reference/cli/teleport.mdx +++ b/docs/pages/reference/cli/teleport.mdx @@ -34,23 +34,23 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--auth-server`|none|Address of the auth server \[127.0.0.1:3025\].| -|`--ca-pin`|none|CA pin to validate the auth server (can be repeated for multiple pins).| -|`-c`, `--config`|none|Path to a configuration file \[/etc/teleport.yaml\].| -|`--cloud`|none|Set to one of \[AWS Azure GCP\] if application should proxy particular cloud API| -|`--diag-addr`|none|Start diagnostic prometheus and healthz endpoint.| +|`--auth-server`|*no default*|Address of the auth server \[127.0.0.1:3025\].| +|`--ca-pin`|*no default*|CA pin to validate the auth server (can be repeated for multiple pins).| +|`-c`, `--config`|*no default*|Path to a configuration file \[/etc/teleport.yaml\].| +|`--cloud`|*no default*|Set to one of \[AWS Azure GCP\] if application should proxy particular cloud API| +|`--diag-addr`|*no default*|Start diagnostic prometheus and healthz endpoint.| |`-d`, `--[no-]debug`|`false`|Enable verbose logging to stderr.| -|`--labels`|none|Comma-separated list of labels for this node, for example env=dev,app=web.| -|`--name`|none|Name of the application to start.| +|`--labels`|*no default*|Comma-separated list of labels for this node, for example env=dev,app=web.| +|`--name`|*no default*|Name of the application to start.| |`--[no-]fips`|`false`|Start Teleport in FedRAMP/FIPS 140 mode.| |`--[no-]insecure`|`false`|Insecure mode disables certificate validation| |`--[no-]mcp-demo-server`|`false`|Enables the Teleport demo MCP server that shows current user and session information.| |`--[no-]no-debug-service`|`false`|Disables debug service.| |`--[no-]skip-version-check`|`false`|Skip version checking between server and client.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--public-addr`|none|Public address of the application to proxy.| -|`--token`|none|Invitation token or path to file with token value to register with an auth server \[none\].| -|`--uri`|none|Internal address of the application to proxy.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--public-addr`|*no default*|Public address of the application to proxy.| +|`--token`|*no default*|Invitation token or path to file with token value to register with an auth server \[none\].| +|`--uri`|*no default*|Internal address of the application to proxy.| ## teleport backend clone @@ -76,7 +76,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|key|none (required)|The backend key to retrieve.| +|key|*no default* (required)|The backend key to retrieve.| ## teleport backend get @@ -92,13 +92,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| Arguments: |Argument|Default|Description| |---|---|---| -|key|none (required)|The backend key to retrieve.| +|key|*no default* (required)|The backend key to retrieve.| ## teleport backend ls @@ -114,13 +114,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| Arguments: |Argument|Default|Description| |---|---|---| -|prefix|none (optional)|An optional key prefix to limit listing to.| +|prefix|*no default* (optional)|An optional key prefix to limit listing to.| ## teleport backend rm @@ -136,7 +136,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|key|none (required)|The backend key to remove.| +|key|*no default* (required)|The backend key to remove.| ## teleport configure @@ -152,25 +152,25 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--acme-email`|none|Email to receive updates from Letsencrypt.org.| -|`--app-name`|none|Name of the application to start when using app role.| -|`--app-uri`|none|Internal address of the application to proxy.| -|`--auth-server`|none|Address of the auth server.| -|`--cert-file`|none|Path to a TLS certificate file for the proxy.| -|`--cluster-name`|none|Unique cluster name, e.g. example.com.| +|`--acme-email`|*no default*|Email to receive updates from Letsencrypt.org.| +|`--app-name`|*no default*|Name of the application to start when using app role.| +|`--app-uri`|*no default*|Internal address of the application to proxy.| +|`--auth-server`|*no default*|Address of the auth server.| +|`--cert-file`|*no default*|Path to a TLS certificate file for the proxy.| +|`--cluster-name`|*no default*|Unique cluster name, e.g. example.com.| |`--data-dir`|`/var/lib/teleport`|Path to a directory where Teleport keep its data.| -|`--join-method`|`token`|Method to use to join the cluster (azure, azure_devops, bitbucket, circleci, ec2, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--key-file`|none|Path to a TLS key file for the proxy.| +|`--join-method`|`token` (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `ec2`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--key-file`|*no default*|Path to a TLS key file for the proxy.| |`--[no-]acme`|`false`|Get automatic certificate from Letsencrypt.org using ACME.| -|`--node-labels`|none|Comma-separated list of labels to add to newly created nodes, for example env=staging,cloud=aws.| -|`--node-name`|none|Name for the Teleport node.| +|`--node-labels`|*no default*|Comma-separated list of labels to add to newly created nodes, for example env=staging,cloud=aws.| +|`--node-name`|*no default*|Name for the Teleport node.| |`--[no-]mcp-demo-server`|`false`|Enables the Teleport demo MCP server that shows current user and session information.| |`-o`, `--output`|`stdout`|Write to stdout with "--output=stdout", default config file with "--output=file" or custom path with --output=file:///path| -|`--proxy`|none|Address of the proxy.| -|`--public-addr`|none|The hostport that the proxy advertises for the HTTP endpoint.| -|`--roles`|none|Comma-separated list of roles to create config with.| -|`--test`|none|Path to a configuration file to test.| -|`--token`|none|Invitation token or path to file with token value to register with an auth server.| +|`--proxy`|*no default*|Address of the proxy.| +|`--public-addr`|*no default*|The hostport that the proxy advertises for the HTTP endpoint.| +|`--roles`|*no default*|Comma-separated list of roles to create config with.| +|`--test`|*no default*|Path to a configuration file to test.| +|`--token`|*no default*|Invitation token or path to file with token value to register with an auth server.| |`--version`|`v3`|Teleport configuration version.| ## teleport db configure aws create-iam @@ -187,12 +187,12 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--assumes-roles`|none|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.| +|`--assumes-roles`|*no default*|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.| |`--name`|`DatabaseAccess`|Created policy name. Defaults to empty. Will be auto-generated if not provided.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| -|`--role`|none|IAM role name to attach policy to. Mutually exclusive with --user| -|`-r`, `--types`|none|Comma-separated list of database types to include in the policy. Any of rds,rdsproxy,redshift,redshift-serverless,elasticache,elasticache-serverless,memorydb,keyspace,dynamodb,opensearch,docdb| -|`--user`|none|IAM user name to attach policy to. Mutually exclusive with --role| +|`--role`|*no default*|IAM role name to attach policy to. Mutually exclusive with --user| +|`-r`, `--types`|*no default*|Comma-separated list of database types to include in the policy. Any of rds,rdsproxy,redshift,redshift-serverless,elasticache,elasticache-serverless,memorydb,keyspace,dynamodb,opensearch,docdb| +|`--user`|*no default*|IAM user name to attach policy to. Mutually exclusive with --role| ## teleport db configure aws print-iam @@ -208,12 +208,12 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--assumes-roles`|none|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.| +|`--assumes-roles`|*no default*|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.| |`--[no-]policy`|`false`|Only print IAM policy document.| |`--policy-name`|`DatabaseAccess`|Name of the Teleport Database agent policy. Default: "DatabaseAccess".| -|`--role`|none|IAM role name to attach policy to. Mutually exclusive with --user| -|`-r`, `--types`|none|Comma-separated list of database types to include in the policy. Any of rds,rdsproxy,redshift,redshift-serverless,elasticache,elasticache-serverless,memorydb,keyspace,dynamodb,opensearch,docdb| -|`--user`|none|IAM user name to attach policy to. Mutually exclusive with --role| +|`--role`|*no default*|IAM role name to attach policy to. Mutually exclusive with --user| +|`-r`, `--types`|*no default*|Comma-separated list of database types to include in the policy. Any of rds,rdsproxy,redshift,redshift-serverless,elasticache,elasticache-serverless,memorydb,keyspace,dynamodb,opensearch,docdb| +|`--user`|*no default*|IAM user name to attach policy to. Mutually exclusive with --role| ## teleport db configure bootstrap @@ -230,9 +230,9 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--assumes-roles`|none|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.| -|`--attach-to-role`|none|Role name to attach policy to. Mutually exclusive with --attach-to-user. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.| -|`--attach-to-user`|none|User name to attach policy to. Mutually exclusive with --attach-to-role. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.| +|`--assumes-roles`|*no default*|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.| +|`--attach-to-role`|*no default*|Role name to attach policy to. Mutually exclusive with --attach-to-user. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.| +|`--attach-to-user`|*no default*|User name to attach policy to. Mutually exclusive with --attach-to-role. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.| |`-c`, `--config`|`/etc/teleport.yaml`|Path to a configuration file \[/etc/teleport.yaml\].| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| |`--[no-]manual`|`false`|When executed in "manual" mode, it will print the instructions to complete the configuration instead of applying them directly.| @@ -252,48 +252,48 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--ad-domain`|none|(Only for SQL Server) Active Directory domain.| -|`--ad-keytab-file`|none|(Only for SQL Server) Kerberos keytab file.| -|`--ad-spn`|none|(Only for SQL Server) Service Principal Name for Active Directory auth.| -|`--aws-account-id`|none|(Only for Keyspaces or DynamoDB) AWS Account ID.| -|`--aws-assume-role-arn`|none|Optional AWS IAM role to assume.| -|`--aws-elasticache-group-id`|none|(Only for ElastiCache) ElastiCache replication group identifier.| -|`--aws-elasticache-serverless-cache-name`|none|(Only for ElastiCache Serverless) ElastiCache Serverless cache name.| -|`--aws-external-id`|none|(Only for AWS-hosted databases) Optional AWS external ID to use when assuming AWS roles.| -|`--aws-memorydb-cluster-name`|none|(Only for MemoryDB) MemoryDB cluster name.| -|`--aws-rds-cluster-id`|none|(Only for RDS Aurora) RDS Aurora database cluster identifier.| -|`--aws-rds-instance-id`|none|(Only for RDS) RDS database instance identifier.| -|`--aws-redshift-cluster-id`|none|(Only for Redshift) Redshift database cluster identifier.| -|`--aws-region`|none|(Only for AWS-hosted databases) AWS region RDS, Aurora, Redshift, Redshift Serverless, ElastiCache, OpenSearch or MemoryDB database instance is running in.| -|`--aws-tags`|none|(Only for AWS discoveries) Comma-separated list of AWS resource tags to match, for example env=dev,dept=it| -|`--azure-mysql-discovery`|none|List of Azure regions in which the agent will discover MySQL servers.| -|`--azure-postgres-discovery`|none|List of Azure regions in which the agent will discover PostgreSQL servers.| -|`--azure-redis-discovery`|none|List of Azure regions in which the agent will discover Azure Cache For Redis servers.| +|`--ad-domain`|*no default*|(Only for SQL Server) Active Directory domain.| +|`--ad-keytab-file`|*no default*|(Only for SQL Server) Kerberos keytab file.| +|`--ad-spn`|*no default*|(Only for SQL Server) Service Principal Name for Active Directory auth.| +|`--aws-account-id`|*no default*|(Only for Keyspaces or DynamoDB) AWS Account ID.| +|`--aws-assume-role-arn`|*no default*|Optional AWS IAM role to assume.| +|`--aws-elasticache-group-id`|*no default*|(Only for ElastiCache) ElastiCache replication group identifier.| +|`--aws-elasticache-serverless-cache-name`|*no default*|(Only for ElastiCache Serverless) ElastiCache Serverless cache name.| +|`--aws-external-id`|*no default*|(Only for AWS-hosted databases) Optional AWS external ID to use when assuming AWS roles.| +|`--aws-memorydb-cluster-name`|*no default*|(Only for MemoryDB) MemoryDB cluster name.| +|`--aws-rds-cluster-id`|*no default*|(Only for RDS Aurora) RDS Aurora database cluster identifier.| +|`--aws-rds-instance-id`|*no default*|(Only for RDS) RDS database instance identifier.| +|`--aws-redshift-cluster-id`|*no default*|(Only for Redshift) Redshift database cluster identifier.| +|`--aws-region`|*no default*|(Only for AWS-hosted databases) AWS region RDS, Aurora, Redshift, Redshift Serverless, ElastiCache, OpenSearch or MemoryDB database instance is running in.| +|`--aws-tags`|*no default*|(Only for AWS discoveries) Comma-separated list of AWS resource tags to match, for example env=dev,dept=it| +|`--azure-mysql-discovery`|*no default*|List of Azure regions in which the agent will discover MySQL servers.| +|`--azure-postgres-discovery`|*no default*|List of Azure regions in which the agent will discover PostgreSQL servers.| +|`--azure-redis-discovery`|*no default*|List of Azure regions in which the agent will discover Azure Cache For Redis servers.| |`--azure-resource-group`|`*`|List of Azure resource groups for Azure discoveries. Default is "*".| -|`--azure-sqlserver-discovery`|none|List of Azure regions in which the agent will discover Azure SQL Databases and Managed Instances.| +|`--azure-sqlserver-discovery`|*no default*|List of Azure regions in which the agent will discover Azure SQL Databases and Managed Instances.| |`--azure-subscription`|`*`|List of Azure subscription IDs for Azure discoveries. Default is "*".| -|`--azure-tags`|none|(Only for Azure discoveries) Comma-separated list of Azure resource tags to match, for example env=dev,dept=it| -|`--ca-cert-file`|none|Database CA certificate path.| -|`--ca-pin`|none|CA pin to validate the auth server (can be repeated for multiple pins).| -|`--dynamic-resources-labels`|none|Comma-separated list(s) of labels to match dynamic resources, for example env=dev,dept=it. Required to enable dynamic resources matching.| -|`--elasticache-discovery`|none|List of AWS regions in which the agent will discover ElastiCache Valkey or Redis clusters.| -|`--elasticache-serverless-discovery`|none|List of AWS regions in which the agent will discover ElastiCache Serverless Valkey or Redis caches.| -|`--gcp-instance-id`|none|(Only for Cloud SQL) GCP Cloud SQL instance identifier.| -|`--gcp-project-id`|none|(Only for Cloud SQL) GCP Cloud SQL project identifier.| -|`--labels`|none|Comma-separated list of labels for the database, for example env=dev,dept=it| -|`--memorydb-discovery`|none|List of AWS regions in which the agent will discover MemoryDB clusters.| -|`--name`|none|Name of the proxied database.| +|`--azure-tags`|*no default*|(Only for Azure discoveries) Comma-separated list of Azure resource tags to match, for example env=dev,dept=it| +|`--ca-cert-file`|*no default*|Database CA certificate path.| +|`--ca-pin`|*no default*|CA pin to validate the auth server (can be repeated for multiple pins).| +|`--dynamic-resources-labels`|*no default*|Comma-separated list(s) of labels to match dynamic resources, for example env=dev,dept=it. Required to enable dynamic resources matching.| +|`--elasticache-discovery`|*no default*|List of AWS regions in which the agent will discover ElastiCache Valkey or Redis clusters.| +|`--elasticache-serverless-discovery`|*no default*|List of AWS regions in which the agent will discover ElastiCache Serverless Valkey or Redis caches.| +|`--gcp-instance-id`|*no default*|(Only for Cloud SQL) GCP Cloud SQL instance identifier.| +|`--gcp-project-id`|*no default*|(Only for Cloud SQL) GCP Cloud SQL project identifier.| +|`--labels`|*no default*|Comma-separated list of labels for the database, for example env=dev,dept=it| +|`--memorydb-discovery`|*no default*|List of AWS regions in which the agent will discover MemoryDB clusters.| +|`--name`|*no default*|Name of the proxied database.| |`--[no-]trust-system-cert-pool`|`false`|Allows Teleport to trust certificate authorities available on the host system for self-hosted databases.| |`-o`, `--output`|`stdout`|Write to stdout with "--output=stdout", default config file with "--output=file" or custom path with --output=file:///path| -|`--opensearch-discovery`|none|List of AWS regions in which the agent will discover OpenSearch domains.| -|`--protocol`|none|Proxied database protocol. Supported are: \[postgres mysql mongodb oracle cockroachdb redis snowflake sqlserver cassandra elasticsearch opensearch dynamodb clickhouse clickhouse-http spanner\].| +|`--opensearch-discovery`|*no default*|List of AWS regions in which the agent will discover OpenSearch domains.| +|`--protocol`|*no default*|Proxied database protocol. Supported are: \[postgres mysql mongodb oracle cockroachdb redis snowflake sqlserver cassandra elasticsearch opensearch dynamodb clickhouse clickhouse-http spanner\].| |`--proxy`|`0.0.0.0:3080`|Teleport proxy address to connect to \[0.0.0.0:3080\].| -|`--rds-discovery`|none|List of AWS regions in which the agent will discover RDS/Aurora instances.| -|`--rdsproxy-discovery`|none|List of AWS regions in which the agent will discover RDS Proxies.| -|`--redshift-discovery`|none|List of AWS regions in which the agent will discover Redshift instances.| -|`--redshift-serverless-discovery`|none|List of AWS regions in which the agent will discover Redshift Serverless instances.| +|`--rds-discovery`|*no default*|List of AWS regions in which the agent will discover RDS/Aurora instances.| +|`--rdsproxy-discovery`|*no default*|List of AWS regions in which the agent will discover RDS Proxies.| +|`--redshift-discovery`|*no default*|List of AWS regions in which the agent will discover Redshift instances.| +|`--redshift-serverless-discovery`|*no default*|List of AWS regions in which the agent will discover Redshift Serverless instances.| |`--token`|`/tmp/token`|Invitation token or path to file with token value to register with an auth server \[none\].| -|`--uri`|none|Address the proxied database is reachable at.| +|`--uri`|*no default*|Address the proxied database is reachable at.| ## teleport db start @@ -309,38 +309,48 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--ad-domain`|none|(Only for SQL Server) Active Directory domain.| -|`--ad-keytab-file`|none|(Only for SQL Server) Kerberos keytab file.| +|`--ad-domain`|*no default*|(Only for SQL Server) Active Directory domain.| +|`--ad-keytab-file`|*no default*|(Only for SQL Server) Kerberos keytab file.| |`--ad-krb5-file`|`/etc/krb5.conf`|(Only for SQL Server) Kerberos krb5.conf file.| -|`--ad-spn`|none|(Only for SQL Server) Service Principal Name for Active Directory auth.| -|`--auth-server`|none|Address of the auth server \[127.0.0.1:3025\].| -|`--aws-account-id`|none|(Only for Keyspaces or DynamoDB) AWS Account ID.| -|`--aws-assume-role-arn`|none|Optional AWS IAM role to assume.| -|`--aws-external-id`|none|Optional AWS external ID used when assuming an AWS role.| -|`--aws-rds-cluster-id`|none|(Only for Aurora) Aurora cluster identifier.| -|`--aws-rds-instance-id`|none|(Only for RDS) RDS instance identifier.| -|`--aws-redshift-cluster-id`|none|(Only for Redshift) Redshift database cluster identifier.| -|`--aws-region`|none|(Only for RDS, Aurora, Redshift, ElastiCache or MemoryDB) AWS region AWS hosted database instance is running in.| -|`--aws-session-tags`|none|(Only for DynamoDB) List of STS tags.| -|`--ca-cert`|none|Database CA certificate path.| -|`--ca-pin`|none|CA pin to validate the auth server (can be repeated for multiple pins).| -|`-c`, `--config`|none|Path to a configuration file \[/etc/teleport.yaml\].| -|`--description`|none|Description of the proxied database.| -|`--diag-addr`|none|Start diagnostic prometheus and healthz endpoint.| +|`--ad-spn`|*no default*|(Only for SQL Server) Service Principal Name for Active Directory auth.| +|`--auth-server`|*no default*|Address of the auth server \[127.0.0.1:3025\].| +|`--aws-account-id`|*no default*|(Only for Keyspaces or DynamoDB) AWS Account ID.| +|`--aws-assume-role-arn`|*no default*|Optional AWS IAM role to assume.| +|`--aws-external-id`|*no default*|Optional AWS external ID used when assuming an AWS role.| +|`--aws-rds-cluster-id`|*no default*|(Only for Aurora) Aurora cluster identifier.| +|`--aws-rds-instance-id`|*no default*|(Only for RDS) RDS instance identifier.| +|`--aws-redshift-cluster-id`|*no default*|(Only for Redshift) Redshift database cluster identifier.| +|`--aws-region`|*no default*|(Only for RDS, Aurora, Redshift, ElastiCache or MemoryDB) AWS region AWS hosted database instance is running in.| +|`--aws-session-tags`|*no default*|(Only for DynamoDB) List of STS tags.| +|`--ca-cert`|*no default*|Database CA certificate path.| +|`--ca-pin`|*no default*|CA pin to validate the auth server (can be repeated for multiple pins).| +|`-c`, `--config`|*no default*|Path to a configuration file \[/etc/teleport.yaml\].| +|`--description`|*no default*|Description of the proxied database.| +|`--diag-addr`|*no default*|Start diagnostic prometheus and healthz endpoint.| |`-d`, `--[no-]debug`|`false`|Enable verbose logging to stderr.| -|`--gcp-alloydb-endpoint-type`|none|(Only for AlloyDB) Endpoint type. One of: \[public private psc\]| -|`--gcp-instance-id`|none|(Only for Cloud SQL) Instance identifier.| -|`--gcp-project-id`|none|(Only for Cloud SQL) Project identifier.| -|`--labels`|none|Comma-separated list of labels for this node, for example env=dev,app=web.| -|`--name`|none|Name of the proxied database.| +|`--gcp-alloydb-endpoint-type`|*no default* (one of: `public`, `private`, `psc`)|(Only for AlloyDB) Endpoint type.| +|`--gcp-instance-id`|*no default*|(Only for Cloud SQL) Instance identifier.| +|`--gcp-project-id`|*no default*|(Only for Cloud SQL) Project identifier.| +|`--labels`|*no default*|Comma-separated list of labels for this node, for example env=dev,app=web.| +|`--name`|*no default*|Name of the proxied database.| |`--[no-]fips`|`false`|Start Teleport in FedRAMP/FIPS 140 mode.| |`--[no-]insecure`|`false`|Insecure mode disables certificate validation| |`--[no-]no-debug-service`|`false`|Disables debug service.| |`--[no-]skip-version-check`|`false`|Skip version checking between server and client.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.| -|`--protocol`|none|Proxied database protocol. Supported are: \[postgres mysql mongodb oracle cockroachdb redis snowflake sqlserver cassandra elasticsearch opensearch dynamodb clickhouse clickhouse-http spanner\].| -|`--token`|none|Invitation token or path to file with token value to register with an auth server \[none\].| -|`--uri`|none|Address the proxied database is reachable at.| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.| +|`--protocol`|*no default*|Proxied database protocol. Supported are: \[postgres mysql mongodb oracle cockroachdb redis snowflake sqlserver cassandra elasticsearch opensearch dynamodb clickhouse clickhouse-http spanner\].| +|`--token`|*no default*|Invitation token or path to file with token value to register with an auth server \[none\].| +|`--uri`|*no default*|Address the proxied database is reachable at.| + +## teleport debug check-session-helper + +Checks if the embedded session helper is working, if available in this build. + +Usage: + +```code +$ teleport debug check-session-helper +``` ## teleport debug get-log-level @@ -383,7 +393,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|PROFILES|none (optional)|Comma-separated profile names to be exported. Supported profiles: allocs,block,cmdline,profile,trace,goroutine,heap,mutex,threadcreate. Default: goroutine,heap,profile| +|PROFILES|*no default* (optional)|Comma-separated profile names to be exported. Supported profiles: allocs,block,cmdline,goroutine,heap,mutex,profile,threadcreate,trace. Default: goroutine,heap,profile| ## teleport debug readyz @@ -395,6 +405,17 @@ Usage: $ teleport debug readyz ``` +## teleport debug require-session-helper + +Checks if the embedded session helper is working, failing if not available in +this build. + +Usage: + +```code +$ teleport debug require-session-helper +``` + ## teleport debug set-log-level Changes the log level. @@ -409,7 +430,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|LEVEL|none (required)|Log level (case-insensitive). Any of: TRACE,DEBUG,INFO,WARN,ERROR| +|LEVEL|*no default* (required)|Log level (case-insensitive). Any of: TRACE,DEBUG,INFO,WARN,ERROR| ## teleport discovery bootstrap @@ -426,18 +447,18 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--assume-role-arn`|none|Optional AWS IAM role to assume while bootstrapping.| -|`--assumes-roles`|none|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.| -|`--attach-to-role`|none|Role name to attach policy to. Mutually exclusive with --attach-to-user. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.| -|`--attach-to-user`|none|User name to attach policy to. Mutually exclusive with --attach-to-role. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.| +|`--assume-role-arn`|*no default*|Optional AWS IAM role to assume while bootstrapping.| +|`--assumes-roles`|*no default*|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.| +|`--attach-to-role`|*no default*|Role name to attach policy to. Mutually exclusive with --attach-to-user. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.| +|`--attach-to-user`|*no default*|User name to attach policy to. Mutually exclusive with --attach-to-role. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.| |`-c`, `--config`|`/etc/teleport.yaml`|Path to a configuration file \[/etc/teleport.yaml\].| |`--database-service-policy-name`|`DatabaseAccess`|Name of the policy for bootstrapping database service when database-service-role is provided. | -|`--database-service-role`|none|Role name to attach database access policies to. If specified, bootstrap for the database service that accesses the databases discovered by this discovery service.| -|`--external-id`|none|Optional AWS external ID used when assuming an AWS role.| +|`--database-service-role`|*no default*|Role name to attach database access policies to. If specified, bootstrap for the database service that accesses the databases discovered by this discovery service.| +|`--external-id`|*no default*|Optional AWS external ID used when assuming an AWS role.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| |`--[no-]manual`|`false`|When executed in "manual" mode, it will print the instructions to complete the configuration instead of applying them directly.| |`--policy-name`|`TeleportEC2Discovery`|Name of the Teleport Discovery service policy. Default: "TeleportEC2Discovery".| -|`--proxy`|none|Teleport proxy address to connect to| +|`--proxy`|*no default*|Teleport proxy address to connect to| ## teleport help @@ -453,7 +474,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|command|none (optional)|Show help on command.| +|command|*no default* (optional)|Show help on command.| ## teleport install systemd @@ -473,7 +494,7 @@ Flags: |`--fd-limit`|`524288`|Maximum number of open file descriptors.| |`-o`, `--output`|`stdout`|Write to stdout with "--output=stdout" or custom path with --output=file:///path| |`--pid-file`|`/run/teleport.pid`|Full path to the PID file.| -|`--teleport-path`|none|Full path to the Teleport binary.| +|`--teleport-path`|*no default*|Full path to the Teleport binary.| ## teleport integration configure access-graph aws-iam @@ -490,13 +511,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--aws-account-id`|none|The AWS account ID.| -|`--cloud-trail-bucket`|none|ARN of the S3 bucket where CloudTrail writes events to.| -|`--kms-key`|none|List of KMS Keys used to decrypt SQS and S3 bucket data.| +|`--aws-account-id`|*no default*|The AWS account ID.| +|`--cloud-trail-bucket`|*no default*|ARN of the S3 bucket where CloudTrail writes events to.| +|`--kms-key`|*no default*|List of KMS Keys used to decrypt SQS and S3 bucket data.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| |`--[no-]eks-audit-logs`|`false`|Enable collection of EKS audit logs| -|`--role`|none|The AWS Role used by the AWS OIDC Integration.| -|`--sqs-queue-url`|none|SQS Queue URL used to receive notifications from CloudTrail.| +|`--role`|*no default*|The AWS Role used by the AWS OIDC Integration.| +|`--sqs-queue-url`|*no default*|SQS Queue URL used to receive notifications from CloudTrail.| ## teleport integration configure access-graph azure @@ -513,10 +534,10 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--managed-identity`|none|The ID of the managed identity to run the Discovery service.| +|`--managed-identity`|*no default*|The ID of the managed identity to run the Discovery service.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| -|`--role-name`|none|The name of the Azure Role to create and assign to the managed identity| -|`--subscription-id`|none|The subscription ID in which to discovery resources.| +|`--role-name`|*no default*|The name of the Azure Role to create and assign to the managed identity| +|`--subscription-id`|*no default*|The subscription ID in which to discovery resources.| ## teleport integration configure aws-app-access-iam @@ -532,9 +553,9 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--aws-account-id`|none|The AWS account ID.| +|`--aws-account-id`|*no default*|The AWS account ID.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| -|`--role`|none|The AWS Role name used by the AWS OIDC Integration.| +|`--role`|*no default*|The AWS Role name used by the AWS OIDC Integration.| ## teleport integration configure awsoidc-idp @@ -551,13 +572,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--cluster`|none|Teleport Cluster name.| -|`--name`|none|Integration name.| +|`--cluster`|*no default*|Teleport Cluster name.| +|`--name`|*no default*|Integration name.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| |`--[no-]insecure`|`false`|Insecure mode disables certificate validation.| -|`--policy-preset`|none|Policy that will be applied to the AWS OIDC integration role.| -|`--proxy-public-url`|none|Proxy Public URL (eg https://mytenant.teleport.sh).| -|`--role`|none|The AWS Role used by the AWS OIDC Integration.| +|`--policy-preset`|*no default*|Policy that will be applied to the AWS OIDC integration role.| +|`--proxy-public-url`|*no default*|Proxy Public URL (eg https://mytenant.teleport.sh).| +|`--role`|*no default*|The AWS Role used by the AWS OIDC Integration.| ## teleport integration configure awsra-trust-anchor @@ -573,13 +594,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--cluster`|none|Teleport Cluster's name.| -|`--name`|none|Integration name.| +|`--cluster`|*no default*|Teleport Cluster's name.| +|`--name`|*no default*|Integration name.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| -|`--sync-profile`|none|The AWS IAM Roles Anywhere Profile name to create, which will be used to sync profiles as apps.| -|`--sync-role`|none|The AWS IAM Role name to create, which will be used to sync profiles as apps.| -|`--trust-anchor`|none|AWS Roles Anywhere Trust Anchor name.| -|`--trust-anchor-cert-b64`|none|AWS Roles Anywhere Trust Anchor's certificate, encoded in base64.| +|`--sync-profile`|*no default*|The AWS IAM Roles Anywhere Profile name to create, which will be used to sync profiles as apps.| +|`--sync-role`|*no default*|The AWS IAM Role name to create, which will be used to sync profiles as apps.| +|`--trust-anchor`|*no default*|AWS Roles Anywhere Trust Anchor name.| +|`--trust-anchor-cert-b64`|*no default*|AWS Roles Anywhere Trust Anchor's certificate, encoded in base64.| ## teleport integration configure azure-oidc @@ -595,10 +616,10 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--auth-connector-name`|none|The name of Entra ID SAML Auth connector in Teleport.| +|`--auth-connector-name`|*no default*|The name of Entra ID SAML Auth connector in Teleport.| |`--[no-]access-graph`|`false`|Enable Access Graph integration.| |`--[no-]skip-oidc-integration`|`false`|Skip OIDC integration.| -|`--proxy-public-addr`|none|The public address of Teleport Proxy Service| +|`--proxy-public-addr`|*no default*|The public address of Teleport Proxy Service| ## teleport integration configure deployservice-iam @@ -614,13 +635,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--aws-account-id`|none|The AWS account ID.| -|`--aws-region`|none|AWS Region.| -|`--cluster`|none|Teleport Cluster's name.| -|`--name`|none|Integration name.| +|`--aws-account-id`|*no default*|The AWS account ID.| +|`--aws-region`|*no default*|AWS Region.| +|`--cluster`|*no default*|Teleport Cluster's name.| +|`--name`|*no default*|Integration name.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| -|`--role`|none|The AWS Role used by the AWS OIDC Integration.| -|`--task-role`|none|The AWS Role to be used by the deployed service.| +|`--role`|*no default*|The AWS Role used by the AWS OIDC Integration.| +|`--task-role`|*no default*|The AWS Role to be used by the deployed service.| ## teleport integration configure ec2-ssm-iam @@ -637,14 +658,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--aws-account-id`|none|The AWS account ID.| -|`--aws-region`|none|AWS Region.| -|`--cluster`|none|Teleport Cluster's name.| -|`--name`|none|Integration name.| +|`--aws-account-id`|*no default*|The AWS account ID.| +|`--aws-region`|*no default*|AWS Region.| +|`--cluster`|*no default*|Teleport Cluster's name.| +|`--name`|*no default*|Integration name.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| -|`--proxy-public-url`|none|Proxy Public URL (eg https://mytenant.teleport.sh).| -|`--role`|none|The AWS Role name used by the AWS OIDC Integration.| -|`--ssm-document-name`|none|The AWS SSM Document name to create that will be used to install teleport.| +|`--proxy-public-url`|*no default*|Proxy Public URL (eg https://mytenant.teleport.sh).| +|`--role`|*no default*|The AWS Role name used by the AWS OIDC Integration.| +|`--ssm-document-name`|*no default*|The AWS SSM Document name to create that will be used to install teleport.| ## teleport integration configure eks-iam @@ -660,10 +681,10 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--aws-account-id`|none|The AWS account ID.| -|`--aws-region`|none|AWS Region.| +|`--aws-account-id`|*no default*|The AWS account ID.| +|`--aws-region`|*no default*|AWS Region.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| -|`--role`|none|The AWS Role used by the AWS OIDC Integration.| +|`--role`|*no default*|The AWS Role used by the AWS OIDC Integration.| ## teleport integration configure externalauditstorage @@ -680,20 +701,20 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--athena-results`|none|The S3 URI where athena results are stored.| -|`--athena-workgroup`|none|The name of the Athena workgroup used.| -|`--audit-events`|none|The S3 URI where audit events are stored.| -|`--aws-account-id`|none|The AWS account ID.| +|`--athena-results`|*no default*|The S3 URI where athena results are stored.| +|`--athena-workgroup`|*no default*|The name of the Athena workgroup used.| +|`--audit-events`|*no default*|The S3 URI where audit events are stored.| +|`--aws-account-id`|*no default*|The AWS account ID.| |`--aws-partition`|`aws`|AWS partition (default: aws).| -|`--aws-region`|none|AWS region.| -|`--cluster-name`|none|Teleport Cluster name.| -|`--glue-database`|none|The name of the Glue database used.| -|`--glue-table`|none|The name of the Glue table used.| -|`--integration`|none|AWS OIDC Integration name.| +|`--aws-region`|*no default*|AWS region.| +|`--cluster-name`|*no default*|Teleport Cluster name.| +|`--glue-database`|*no default*|The name of the Glue database used.| +|`--glue-table`|*no default*|The name of the Glue table used.| +|`--integration`|*no default*|AWS OIDC Integration name.| |`--[no-]bootstrap`|`false`|Bootstrap required infrastructure.| -|`--policy`|none|The name for the Policy to attach to the IAM role.| -|`--role`|none|The IAM Role used by the AWS OIDC Integration.| -|`--session-recordings`|none|The S3 URI where session recordings are stored.| +|`--policy`|*no default*|The name for the Policy to attach to the IAM role.| +|`--role`|*no default*|The IAM Role used by the AWS OIDC Integration.| +|`--session-recordings`|*no default*|The S3 URI where session recordings are stored.| ## teleport integration configure listdatabases-iam @@ -709,10 +730,10 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--aws-account-id`|none|The AWS account ID.| -|`--aws-region`|none|AWS Region.| +|`--aws-account-id`|*no default*|The AWS account ID.| +|`--aws-region`|*no default*|AWS Region.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| -|`--role`|none|The AWS Role used by the AWS OIDC Integration.| +|`--role`|*no default*|The AWS Role used by the AWS OIDC Integration.| ## teleport integration configure samlidp gcp-workforce @@ -728,10 +749,10 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--idp-metadata-url`|none|Teleport SAML IdP metadata endpoint.| -|`--org-id`|none|GCP organization ID.| -|`--pool-name`|none|Name for the new workforce identity pool.| -|`--pool-provider-name`|none|Name for the new workforce identity pool provider.| +|`--idp-metadata-url`|*no default*|Teleport SAML IdP metadata endpoint.| +|`--org-id`|*no default*|GCP organization ID.| +|`--pool-name`|*no default*|Name for the new workforce identity pool.| +|`--pool-provider-name`|*no default*|Name for the new workforce identity pool provider.| ## teleport integration configure session-summaries bedrock @@ -748,10 +769,10 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--aws-account-id`|none|The AWS account ID.| +|`--aws-account-id`|*no default*|The AWS account ID.| |`--[no-]confirm`|`false`|Apply changes without confirmation prompt.| |`--resource`|`*`|The Amazon Bedrock resource to grant access to. Can be a full ARN or a model ID (e.g., 'anthropic.claude-v2' or '*' for all models).| -|`--role`|none|The AWS Role name used by the AWS OIDC Integration.| +|`--role`|*no default*|The AWS Role name used by the AWS OIDC Integration.| ## teleport join openssh @@ -767,20 +788,20 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--additional-principals`|none|Additional principal to include, can be specified multiple times.| -|`--address`|none|Hostname or IP address of this OpenSSH node.| +|`--additional-principals`|*no default*|Additional principal to include, can be specified multiple times.| +|`--address`|*no default*|Hostname or IP address of this OpenSSH node.| |`--data-dir`|`/var/lib/teleport`|Path to directory to store teleport data \[/var/lib/teleport\].| |`-d`, `--[no-]debug`|`false`|Enable verbose logging to stderr.| -|`--join-method`|none|Method to use to join the cluster (token, iam, ec2).| -|`--labels`|none|Comma-separated list of labels for this OpenSSH node, for example env=dev,app=web.| +|`--join-method`|*no default* (one of: `token`, `iam`, `ec2`)|Method to use to join the cluster.| +|`--labels`|*no default*|Comma-separated list of labels for this OpenSSH node, for example env=dev,app=web.| |`--[no-]insecure`|`false`|Insecure mode disables certificate validation.| |`--[no-]restart-sshd`|`true`|Restart OpenSSH.| |`--[no-]skip-version-check`|`false`|Skip version checking between server and client.| |`--openssh-config`|`/etc/ssh/sshd_config`|Path to the OpenSSH config file \[/etc/ssh/sshd_config\].| -|`--proxy-server`|none|Address of the proxy server.| +|`--proxy-server`|*no default*|Address of the proxy server.| |`--sshd-check-command`|`sshd -t -f`|Command to use when checking OpenSSH config for validity. (sshd -t -f \)| -|`--sshd-restart-command`|none|Command to use when restarting openssh.| -|`--token`|none|Invitation token or path to file with token value to register with an auth server.| +|`--sshd-restart-command`|*no default*|Command to use when restarting openssh.| +|`--token`|*no default*|Invitation token or path to file with token value to register with an auth server.| ## teleport node configure @@ -796,19 +817,19 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--auth-server`|none|Address of the auth server.| -|`--azure-client-id`|none|Sets the client ID of the managed identity to join with. Only applies to the 'azure' join method.| -|`--ca-pin`|none|Comma-separated list of SKPI hashes for the CA used to verify the auth server.| -|`--cluster-name`|none|Unique cluster name, e.g. example.com.| +|`--auth-server`|*no default*|Address of the auth server.| +|`--azure-client-id`|*no default*|Sets the client ID of the managed identity to join with. Only applies to the 'azure' join method.| +|`--ca-pin`|*no default*|Comma-separated list of SKPI hashes for the CA used to verify the auth server.| +|`--cluster-name`|*no default*|Unique cluster name, e.g. example.com.| |`--data-dir`|`/var/lib/teleport`|Path to a directory where Teleport keep its data.| -|`--join-method`|`token`|Method to use to join the cluster (azure, azure_devops, bitbucket, circleci, ec2, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)| -|`--labels`|none|Comma-separated list of labels to add to newly created nodes ex) env=staging,cloud=aws.| -|`--node-name`|none|Name for the Teleport node.| +|`--join-method`|`token` (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `ec2`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.| +|`--labels`|*no default*|Comma-separated list of labels to add to newly created nodes ex) env=staging,cloud=aws.| +|`--node-name`|*no default*|Name for the Teleport node.| |`--[no-]silent`|`false`|Suppress user hint message.| |`-o`, `--output`|`stdout`|Write to stdout with "--output=stdout", default config file with "--output=file" or custom path with --output=file:///path| -|`--proxy`|none|Address of the proxy server.| -|`--public-addr`|none|The hostport that the node advertises for the SSH endpoint.| -|`--token`|none|Invitation token or path to file with token value to register with an auth server.| +|`--proxy`|*no default*|Address of the proxy server.| +|`--public-addr`|*no default*|The hostport that the node advertises for the SSH endpoint.| +|`--token`|*no default*|Invitation token or path to file with token value to register with an auth server.| |`--version`|`v3`|Teleport configuration version.| ## teleport start @@ -825,27 +846,27 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--advertise-ip`|none|IP to advertise to clients if running behind NAT| -|`--apply-on-startup`|none|Path to a non-empty YAML file containing resources to apply on startup. Works on initialized clusters, unlike --bootstrap. Only supports the following kinds: \[user token cluster_networking_config cluster_auth_preference bot role, workload_identity\].| -|`--auth-server`|none|Address of the auth server \[127.0.0.1:3025\]| -|`--bootstrap`|none|Path to a non-empty YAML file containing bootstrap resources (ignored if already initialized)| -|`--ca-pin`|none|CA pin to validate the Auth Server (can be repeated for multiple pins)| -|`-c`, `--config`|none|Path to a configuration file \[/etc/teleport.yaml\]| -|`--diag-addr`|none|Start diagnostic prometheus and healthz endpoint.| +|`--advertise-ip`|*no default*|IP to advertise to clients if running behind NAT| +|`--apply-on-startup`|*no default*|Path to a non-empty YAML file containing resources to apply on startup. Works on initialized clusters, unlike --bootstrap. Only supports the following kinds: bot,cluster_auth_preference,cluster_networking_config,inference_model,inference_policy,inference_secret,retrieval_model,role,token,user,workload_identity.| +|`--auth-server`|*no default*|Address of the auth server \[127.0.0.1:3025\]| +|`--bootstrap`|*no default*|Path to a non-empty YAML file containing bootstrap resources (ignored if already initialized)| +|`--ca-pin`|*no default*|CA pin to validate the Auth Server (can be repeated for multiple pins)| +|`-c`, `--config`|*no default*|Path to a configuration file \[/etc/teleport.yaml\]| +|`--diag-addr`|*no default*|Start diagnostic prometheus and healthz endpoint.| |`-d`, `--[no-]debug`|`false`|Enable verbose logging to stderr| -|`--labels`|none|Comma-separated list of labels for this node, for example env=dev,app=web| -|`-l`, `--listen-ip`|none|IP address to bind to \[0.0.0.0\]| -|`--nodename`|none|Name of this node, defaults to hostname| +|`--labels`|*no default*|Comma-separated list of labels for this node, for example env=dev,app=web| +|`-l`, `--listen-ip`|*no default*|IP address to bind to \[0.0.0.0\]| +|`--nodename`|*no default*|Name of this node, defaults to hostname| |`--[no-]fips`|`false`|Start Teleport in FedRAMP/FIPS 140 mode.| |`--[no-]insecure`|`false`|Insecure mode disables certificate validation| |`--[no-]insecure-no-tls`|`false`|Disable TLS for the web socket| |`--[no-]no-debug-service`|`false`|Disables debug service.| |`--[no-]permit-user-env`|`false`|Enables reading of ~/.tsh/environment when creating a session| |`--[no-]skip-version-check`|`false`|Skip version checking between server and client.| -|`--pid-file`|none|Full path to the PID file. By default no PID file will be created| -|`-r`, `--roles`|none|Comma-separated list of roles to start with \[proxy,node,auth,app,db\]| -|`--token`|none|Invitation token or path to file with token value. Used to register with an auth server \[none\]| -|`--token-secret`|none|Invitation token secret or path to file with secret value. Used to register with an auth server \[none\]| +|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created| +|`-r`, `--roles`|*no default*|Comma-separated list of roles to start with \[proxy,node,auth,app,db\]| +|`--token`|*no default*|Invitation token or path to file with token value. Used to register with an auth server \[none\]| +|`--token-secret`|*no default*|Invitation token secret or path to file with secret value. Used to register with an auth server \[none\]| ## teleport status diff --git a/docs/pages/reference/cli/tsh.mdx b/docs/pages/reference/cli/tsh.mdx index 5e81ebce05c..9099d671a1d 100644 --- a/docs/pages/reference/cli/tsh.mdx +++ b/docs/pages/reference/cli/tsh.mdx @@ -25,47 +25,47 @@ Global flags: |Flag|Default|Description| |---|---|---| -|`--auth`|none|Specify the name of authentication connector to use.| -|`--bind-addr`|none|Override host:port used when opening a browser for cluster logins.| -|`--callback`|none|Override the base URL (host:port) of the link shown when opening a browser for cluster logins. Must be used with --bind-addr.| -|`--cert-format`|none|SSH certificate format.| +|`--auth`|*no default*|Specify the name of authentication connector to use.| +|`--bind-addr`|*no default*|Override host:port used when opening a browser for cluster logins.| +|`--callback`|*no default*|Override the base URL (host:port) of the link shown when opening a browser for cluster logins. Must be used with --bind-addr.| +|`--cert-format`|*no default*|SSH certificate format.| |`-d`, `--[no-]debug`|`false`|Verbose logging to stdout.| -|`-i`, `--identity`|none|Identity file.| -|`-J`, `--jumphost`|none|SSH jumphost.| +|`-i`, `--identity`|*no default*|Identity file.| +|`-J`, `--jumphost`|*no default*|SSH jumphost.| |`-k`, `--add-keys-to-agent`|`auto`|Controls how keys are handled. Valid values are \[auto no yes only\].| -|`-l`, `--login`|none|Remote host login.| -|`--mfa-mode`|`auto`|Preferred mode for MFA and Passwordless assertions (auto, cross-platform, platform, otp, sso, browser).| +|`-l`, `--login`|*no default*|Remote host login.| +|`--mfa-mode`|`auto` (one of: `auto`, `cross-platform`, `platform`, `otp`, `sso`, `browser`)|Preferred mode for MFA and Passwordless assertions.| |`--mlock`|`auto`|Determines whether process memory will be locked and whether failure to do so will be accepted (off, auto, best_effort, strict).| |`--[no-]enable-escape-sequences`|`true`|Enable support for SSH escape sequences. Type '~?' during an SSH session to list supported sequences. Default is enabled.| |`--[no-]headless`|`false`|Use headless login. Shorthand for --auth=headless.| |`--[no-]insecure`|`false`|Do not verify server's certificate and host name. Use only in test environments.| |`--[no-]os-log`|`false`|Verbose logging to the unified logging system. This flag implies --debug. Also available through the TELEPORT_OS_LOG env var. More details see https://goteleport.com/docs/connect-your-client/tsh/#debug-logs.| |`--[no-]skip-version-check`|`false`|Skip version checking between server and client.| -|`--piv-slot`|none|Specify a PIV slot key to use for Hardware Key support instead of the default. Ex: "9d".| -|`--proxy`|none|Teleport proxy address.| -|`--relay`|none|Teleport relay address, "none" to explicitly disable the use of a relay, or "default" to use the cluster-provided address even if a different address was specified at login time.| -|`--ttl`|none|Minutes to live for a session.| -|`--user`|none|Teleport user, defaults to current local user.| +|`--piv-slot`|*no default*|Specify a PIV slot key to use for Hardware Key support instead of the default. Ex: "9d".| +|`--proxy`|*no default*|Teleport proxy address.| +|`--relay`|*no default*|Teleport relay address, "none" to explicitly disable the use of a relay, or "default" to use the cluster-provided address even if a different address was specified at login time.| +|`--ttl`|*no default*|Minutes to live for a session.| +|`--user`|*no default*|Teleport user, defaults to current local user.| Global environment variables: |Variable|Default|Description| |---|---|---| |`TELEPORT_ADD_KEYS_TO_AGENT`|`auto`|Controls how keys are handled. Valid values are [auto no yes only].| -|`TELEPORT_AUTH`|none|Specify the name of authentication connector to use.| +|`TELEPORT_AUTH`|*no default*|Specify the name of authentication connector to use.| |`TELEPORT_CLUSTER`|`none`|Name of a Teleport root or leaf cluster| |`TELEPORT_GLOBAL_TSH_CONFIG`|`none`|Override location of global `tsh` config file from default `/etc/tsh.yaml`| |`TELEPORT_HEADLESS`|`false`|Use headless login. Shorthand for --auth=headless.| |`TELEPORT_HOME`|`none`|Home location for tsh configuration and data| -|`TELEPORT_IDENTITY_FILE`|none|Identity file.| -|`TELEPORT_LOGIN`|none|Remote host login.| -|`TELEPORT_LOGIN_BIND_ADDR`|none|Override host:port used when opening a browser for cluster logins.| -|`TELEPORT_MFA_MODE`|`auto`|Preferred mode for MFA and Passwordless assertions (auto, cross-platform, platform, otp, sso, browser).| +|`TELEPORT_IDENTITY_FILE`|*no default*|Identity file.| +|`TELEPORT_LOGIN`|*no default*|Remote host login.| +|`TELEPORT_LOGIN_BIND_ADDR`|*no default*|Override host:port used when opening a browser for cluster logins.| +|`TELEPORT_MFA_MODE`|`auto` (one of: `auto`, `cross-platform`, `platform`, `otp`, `sso`, `browser`)|Preferred mode for MFA and Passwordless assertions.| |`TELEPORT_MLOCK_MODE`|`auto`|Determines whether process memory will be locked and whether failure to do so will be accepted (off, auto, best_effort, strict).| -|`TELEPORT_PIV_SLOT`|none|Specify a PIV slot key to use for Hardware Key support instead of the default. Ex: "9d".| -|`TELEPORT_PROXY`|none|Teleport proxy address.| -|`TELEPORT_RELAY`|none|Teleport relay address, "none" to explicitly disable the use of a relay, or "default" to use the cluster-provided address even if a different address was specified at login time.| -|`TELEPORT_USER`|none|Teleport user, defaults to current local user.| +|`TELEPORT_PIV_SLOT`|*no default*|Specify a PIV slot key to use for Hardware Key support instead of the default. Ex: "9d".| +|`TELEPORT_PROXY`|*no default*|Teleport proxy address.| +|`TELEPORT_RELAY`|*no default*|Teleport relay address, "none" to explicitly disable the use of a relay, or "default" to use the cluster-provided address even if a different address was specified at login time.| +|`TELEPORT_USER`|*no default*|Teleport user, defaults to current local user.| ## tsh apps config @@ -81,13 +81,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|none|Optional print format, one of: "uri" to print app address, "ca" to print CA cert path, "cert" to print cert path, "key" print key path, "curl" to print example curl command, "json" or "yaml" to print everything as JSON or YAML.| +|`-f`, `--format`|*no default*|Optional print format, one of: "uri" to print app address, "ca" to print CA cert path, "cert" to print cert path, "key" print key path, "curl" to print example curl command, "json" or "yaml" to print everything as JSON or YAML.| Arguments: |Argument|Default|Description| |---|---|---| -|app|none (optional)|App to print information for. Required when logged into multiple apps.| +|app|*no default* (optional)|App to print information for. Required when logged into multiple apps.| ## tsh apps login @@ -103,17 +103,17 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--aws-role`|none|(For AWS CLI access only) Amazon IAM role ARN or role name.| -|`--azure-identity`|none|(For Azure CLI access only) Azure managed identity name.| -|`--gcp-service-account`|none|(For GCP CLI access only) GCP service account name.| +|`--aws-role`|*no default*|(For AWS CLI access only) Amazon IAM role ARN or role name.| +|`--azure-identity`|*no default*|(For Azure CLI access only) Azure managed identity name.| +|`--gcp-service-account`|*no default*|(For GCP CLI access only) GCP service account name.| |`-q`, `--[no-]quiet`|`false`|Quiet mode.| -|`--target-port`|none|Port to which connections made using this cert should be routed to. Valid only for multi-port TCP apps.| +|`--target-port`|*no default*|Port to which connections made using this cert should be routed to. Valid only for multi-port TCP apps.| Arguments: |Argument|Default|Description| |---|---|---| -|app|none (required)|App name to retrieve credentials for. Can be obtained from `tsh apps ls` output.| +|app|*no default* (required)|App name to retrieve credentials for. Can be obtained from `tsh apps ls` output.| ## tsh apps logout @@ -129,7 +129,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|app|none (optional)|App to remove credentials for.| +|app|*no default* (optional)|App to remove credentials for.| ## tsh apps ls @@ -145,17 +145,17 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| |`-R`, `--[no-]all`|`false`|List apps from all clusters and proxies.| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| |`-v`, `--[no-]verbose`|`false`|Show extra application fields.| Arguments: |Argument|Default|Description| |---|---|---| -|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|labels|*no default* (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| ## tsh aws @@ -171,15 +171,15 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--app`|none|Optional Name of the AWS application to use if logged into multiple.| -|`--aws-role`|none|(For AWS CLI access only) Amazon IAM role ARN or role name.| -|`--exec`|none|Execute different commands (e.g. terraform) under Teleport credentials.| +|`--app`|*no default*|Optional Name of the AWS application to use if logged into multiple.| +|`--aws-role`|*no default*|(For AWS CLI access only) Amazon IAM role ARN or role name.| +|`--exec`|*no default*|Execute different commands (e.g. terraform) under Teleport credentials.| Arguments: |Argument|Default|Description| |---|---|---| -|command|none (optional)|AWS command and subcommands arguments that are going to be forwarded to AWS CLI.| +|command|*no default* (optional)|AWS command and subcommands arguments that are going to be forwarded to AWS CLI.| ## tsh aws-profile @@ -196,7 +196,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--aws-sso-region`|none|AWS region for SSO. Auto-detected from cluster if not specified.| +|`--aws-sso-region`|*no default*|AWS region for SSO. Auto-detected from cluster if not specified.| |`--[no-]dry-run`|`false`|Print the configuration that will be applied without modifying the AWS config file.| ## tsh az @@ -213,14 +213,161 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--app`|none|Optional name of the Azure application to use if logged into multiple.| -|`--azure-identity`|none|(For Azure CLI access only) Azure managed identity name.| +|`--app`|*no default*|Optional name of the Azure application to use if logged into multiple.| +|`--azure-identity`|*no default*|(For Azure CLI access only) Azure managed identity name.| Arguments: |Argument|Default|Description| |---|---|---| -|command|none (optional)|`az` command and subcommands arguments that are going to be forwarded to Azure CLI.| +|command|*no default* (optional)|`az` command and subcommands arguments that are going to be forwarded to Azure CLI.| + +## tsh beams add + +Start a new beam, and optionally connect to it via SSH. + +Usage: + +```code +$ tsh beams add [] +``` + +Flags: + +|Flag|Default|Description| +|---|---|---| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--[no-]console`|`true`|Connect to the beam via SSH after creation.| + +## tsh beams exec + +Run a command in a beam, via SSH. + +Usage: + +```code +$ tsh beams exec ... +``` + +Arguments: + +|Argument|Default|Description| +|---|---|---| +|command|*no default* (required)|Command to execute in the instance.| +|name|*no default* (required)|ID (or UUID) of the beam to target.| + +## tsh beams ls + +List beam instances. + +Usage: + +```code +$ tsh beams ls [] +``` + +Flags: + +|Flag|Default|Description| +|---|---|---| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--[no-]all`|`false`|List all beams. By default, filters to show only beams belonging to the current user.| + +## tsh beams publish + +Publish an HTTP or TCP service running in a beam. + +Usage: + +```code +$ tsh beams publish [] +``` + +Flags: + +|Flag|Default|Description| +|---|---|---| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--[no-]tcp`|`false`|Publish as a TCP app instead of an HTTP app.| + +Arguments: + +|Argument|Default|Description| +|---|---|---| +|name|*no default* (required)|ID (or UUID) of the beam to target.| + +## tsh beams rm + +Delete a beam. + +Usage: + +```code +$ tsh beams rm +``` + +Arguments: + +|Argument|Default|Description| +|---|---|---| +|name|*no default* (required)|ID (or UUID) of the beam to delete.| + +## tsh beams scp + +Copy files between a beam and the local filesystem. + +Usage: + +```code +$ tsh beams scp [] +``` + +Flags: + +|Flag|Default|Description| +|---|---|---| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`-q`, `--[no-]quiet`|`false`|Quiet mode.| +|`-r`, `--[no-]recursive`|`false`|Recursive copy of subdirectories.| + +Arguments: + +|Argument|Default|Description| +|---|---|---| +|dest|*no default* (required)|Destination path to copy, in the form `BEAM_ID:PATH` or `LOCAL_PATH`.| +|src|*no default* (required)|Source path to copy, in the form `BEAM_ID:PATH` or `LOCAL_PATH`.| + +## tsh beams ssh + +Start an interactive shell in a beam, via SSH. + +Usage: + +```code +$ tsh beams ssh +``` + +Arguments: + +|Argument|Default|Description| +|---|---|---| +|name|*no default* (required)|ID (or UUID) of the beam to connect to.| + +## tsh beams unpublish + +Unpublish a previously published service in a beam. + +Usage: + +```code +$ tsh beams unpublish +``` + +Arguments: + +|Argument|Default|Description| +|---|---|---| +|name|*no default* (required)|ID (or UUID) of the beam to target.| ## tsh clusters @@ -236,7 +383,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| |`-q`, `--[no-]quiet`|`false`|Quiet mode.| |`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output.| @@ -254,7 +401,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-p`, `--port`|none|SSH port on a remote host.| +|`-p`, `--port`|*no default*|SSH port on a remote host.| ## tsh db config @@ -270,15 +417,15 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|none|Print format: "text" to print in table format (default), "cmd" to print connect command, "json" or "yaml" to print in JSON or YAML.| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`-f`, `--format`|*no default* (one of: `text`, `cmd`, `json`, `yaml`)|Print format: "text" to print in table format (default), "cmd" to print connect command, "json" or "yaml" to print in JSON or YAML.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| Arguments: |Argument|Default|Description| |---|---|---| -|db|none (optional)|Print information for the specified database.| +|db|*no default* (optional)|Print information for the specified database.| ## tsh db connect @@ -294,19 +441,19 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| -|`-n`, `--db-name`|none|Database name to log in to.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|`-n`, `--db-name`|*no default*|Database name to log in to.| |`--[no-]disable-access-request`|`false`|Disable automatic resource Access Requests.| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| -|`-r`, `--db-roles`|none|List of comma separate database roles to use for auto-provisioned user.| -|`--request-reason`|none|Reason for requesting access.| -|`-u`, `--db-user`|none|Database user to log in as.| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`-r`, `--db-roles`|*no default*|List of comma separate database roles to use for auto-provisioned user.| +|`--request-reason`|*no default*|Reason for requesting access.| +|`-u`, `--db-user`|*no default*|Database user to log in as.| Arguments: |Argument|Default|Description| |---|---|---| -|db|none (optional)|Database service name to connect to.| +|db|*no default* (optional)|Database service name to connect to.| ## tsh db env @@ -322,15 +469,15 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| Arguments: |Argument|Default|Description| |---|---|---| -|db|none (optional)|Print environment for the specified database.| +|db|*no default* (optional)|Print environment for the specified database.| ## tsh db exec @@ -346,21 +493,21 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--dbs`|none|List of comma separated target database services. Mutually exclusive with --search or --labels.| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| -|`-n`, `--db-name`|none|Database name to log in to.| +|`--dbs`|*no default*|List of comma separated target database services. Mutually exclusive with --search or --labels.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|`-n`, `--db-name`|*no default*|Database name to log in to.| |`--[no-]confirm`|`true`|Confirm selected database services before executing command.| -|`--output-dir`|none|Directory to store command output per target database service. A summary is saved as "summary.json".| +|`--output-dir`|*no default*|Directory to store command output per target database service. A summary is saved as "summary.json".| |`--parallel`|`1`|Run commands on target databases in parallel. Defaults to 1, and maximum allowed is 10.| -|`-r`, `--db-roles`|none|List of comma separate database roles to use for auto-provisioned user.| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| -|`-u`, `--db-user`|none|Database user to log in as.| +|`-r`, `--db-roles`|*no default*|List of comma separate database roles to use for auto-provisioned user.| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| +|`-u`, `--db-user`|*no default*|Database user to log in as.| Arguments: |Argument|Default|Description| |---|---|---| -|command|none (required)|Execute this command on target database services.| +|command|*no default* (required)|Execute this command on target database services.| ## tsh db login @@ -376,19 +523,19 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| -|`-n`, `--db-name`|none|Database name to configure as default.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|`-n`, `--db-name`|*no default*|Database name to configure as default.| |`--[no-]disable-access-request`|`false`|Disable automatic resource Access Requests.| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| -|`-r`, `--db-roles`|none|List of comma separate database roles to use for auto-provisioned user.| -|`--request-reason`|none|Reason for requesting access.| -|`-u`, `--db-user`|none|Database user to configure as default.| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`-r`, `--db-roles`|*no default*|List of comma separate database roles to use for auto-provisioned user.| +|`--request-reason`|*no default*|Reason for requesting access.| +|`-u`, `--db-user`|*no default*|Database user to configure as default.| Arguments: |Argument|Default|Description| |---|---|---| -|db|none (optional)|Database to retrieve credentials for. Can be obtained from 'tsh db ls' output.| +|db|*no default* (optional)|Database to retrieve credentials for. Can be obtained from 'tsh db ls' output.| ## tsh db logout @@ -404,14 +551,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| Arguments: |Argument|Default|Description| |---|---|---| -|db|none (optional)|Database to remove credentials for.| +|db|*no default* (optional)|Database to remove credentials for.| ## tsh db ls @@ -427,17 +574,42 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| |`-R`, `--[no-]all`|`false`|List databases from all clusters and proxies.| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| |`-v`, `--[no-]verbose`|`false`|Show extra database fields.| Arguments: |Argument|Default|Description| |---|---|---| -|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|labels|*no default* (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| + +## tsh delegation create-session + +Create a delegation session, allowing a bot or workload to temporarily act on +your behalf. + +Usage: + +```code +$ tsh delegation create-session [] +``` + +Flags: + +|Flag|Default|Description| +|---|---|---| +|`--allow-app`|*no default*|Allow access to an application.| +|`--allow-db`|*no default*|Allow access to a database.| +|`--allow-git-server`|*no default*|Allow access to a Git server.| +|`--allow-kube-cluster`|*no default*|Allow access to a Kubernetes cluster.| +|`--allow-node`|*no default*|Allow access to an SSH node.| +|`--allow-windows-desktop`|*no default*|Allow access to a Windows desktop.| +|`--bot`|*no default*|Name of a bot allowed to use the delegation session. Repeat to allow multiple bots.| +|`--[no-]allow-all`|`false`|Allow access to all resources, including destructive administrative actions. Mutually exclusive with the other --allow-* flags.| +|`--session-ttl`|*no default*|How long the delegation session should remain valid.| ## tsh device enroll @@ -454,7 +626,7 @@ Flags: |Flag|Default|Description| |---|---|---| |`--[no-]current-device`|`false`|Attempts to register and enroll the current device. Requires device admin privileges.| -|`--token`|none|Device enrollment token.| +|`--token`|*no default*|Device enrollment token.| ## tsh env @@ -470,7 +642,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| |`--[no-]unset`|`false`|Print commands to clear Teleport session environment variables.| ## tsh gcloud @@ -487,14 +659,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--app`|none|Optional name of the GCP application to use if logged into multiple.| -|`--gcp-service-account`|none|(For GCP CLI access only) GCP service account name.| +|`--app`|*no default*|Optional name of the GCP application to use if logged into multiple.| +|`--gcp-service-account`|*no default*|(For GCP CLI access only) GCP service account name.| Arguments: |Argument|Default|Description| |---|---|---| -|command|none (optional)|`gcloud` command and subcommands arguments.| +|command|*no default* (optional)|`gcloud` command and subcommands arguments.| ## tsh git clone @@ -510,8 +682,8 @@ Arguments: |Argument|Default|Description| |---|---|---| -|directory|none (optional)|The name of a new directory to clone into.| -|repository|none (required)|Git URL of the repository to clone.| +|directory|*no default* (optional)|The name of a new directory to clone into.| +|repository|*no default* (required)|Git URL of the repository to clone.| ## tsh git config @@ -528,7 +700,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|action|none (optional)|Optional action to perform. 'update' to configure the Git repo to proxy Git commands through Teleport. 'reset' to clear Teleport configuration from the Git repo.| +|action|*no default* (optional)|Optional action to perform. 'update' to configure the Git repo to proxy Git commands through Teleport. 'reset' to clear Teleport configuration from the Git repo.| ## tsh git login @@ -544,7 +716,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--github-org`|none|GitHub organization.| +|`--github-org`|*no default*|GitHub organization.| |`--[no-]force`|`false`|Force a login.| ## tsh git ls @@ -561,15 +733,15 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| Arguments: |Argument|Default|Description| |---|---|---| -|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|labels|*no default* (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| ## tsh gsutil @@ -585,14 +757,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--app`|none|Optional name of the GCP application to use if logged into multiple.| -|`--gcp-service-account`|none|(For GCP CLI access only) GCP service account name.| +|`--app`|*no default*|Optional name of the GCP application to use if logged into multiple.| +|`--gcp-service-account`|*no default*|(For GCP CLI access only) GCP service account name.| Arguments: |Argument|Default|Description| |---|---|---| -|command|none (optional)|`gsutil` command and subcommands arguments.| +|command|*no default* (optional)|`gsutil` command and subcommands arguments.| ## tsh headless approve @@ -620,7 +792,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|request id|none (optional)|Headless authentication request ID.| +|request id|*no default* (optional)|Headless authentication request ID.| ## tsh help @@ -636,7 +808,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|command|none (optional)|Show help on command.| +|command|*no default* (optional)|Show help on command.| ## tsh join @@ -652,14 +824,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`-m`, `--mode`|`observer`|Mode of joining the session, valid modes are observer, moderator and peer.| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`-m`, `--mode`|`observer` (one of: `observer`, `moderator`, `peer`)|Mode of joining the session.| Arguments: |Argument|Default|Description| |---|---|---| -|session-id|none (required)|ID of the session to join.| +|session-id|*no default* (required)|ID of the session to join.| ## tsh kube exec @@ -675,13 +847,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--container`|none|Container name. If omitted, use the kubectl.kubernetes.io/default-container annotation for selecting the container to be attached or the first container in the pod will be chosen.| -|`-f`, `--filename`|none|To use to exec into the resource.| -|`--invite`|none|A comma separated list of people to mark as invited for the session.| -|`-n`, `--namespace`|none|Configure the default Kubernetes namespace.| +|`-c`, `--container`|*no default*|Container name. If omitted, use the kubectl.kubernetes.io/default-container annotation for selecting the container to be attached or the first container in the pod will be chosen.| +|`-f`, `--filename`|*no default*|To use to exec into the resource.| +|`--invite`|*no default*|A comma separated list of people to mark as invited for the session.| +|`-n`, `--namespace`|*no default*|Configure the default Kubernetes namespace.| |`--[no-]participant-req`|`false`|Displays a verbose list of required participants in a moderated session.| |`-q`, `--[no-]quiet`|`false`|Only print output from the remote session.| -|`--reason`|none|The purpose of the session.| +|`--reason`|*no default*|The purpose of the session.| |`-s`, `--[no-]stdin`|`false`|Pass stdin to the container.| |`-t`, `--[no-]tty`|`false`|Stdin is a TTY.| @@ -689,8 +861,8 @@ Arguments: |Argument|Default|Description| |---|---|---| -|command|none (required)|Command to execute in the container.| -|target|none (required)|Pod or deployment name.| +|command|*no default* (required)|Command to execute in the container.| +|target|*no default* (required)|Pod or deployment name.| ## tsh kube join @@ -706,14 +878,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`-m`, `--mode`|`observer`|Mode of joining the session, valid modes are observer, moderator and peer.| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`-m`, `--mode`|`observer` (one of: `observer`, `moderator`, `peer`)|Mode of joining the session.| Arguments: |Argument|Default|Description| |---|---|---| -|session|none (required)|The ID of the target session.| +|session|*no default* (required)|The ID of the target session.| ## tsh kube login @@ -729,22 +901,22 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--as`|none|Configure custom Kubernetes user impersonation.| -|`--as-groups`|none|Configure custom Kubernetes group impersonation.| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| -|`-n`, `--namespace`|none|Configure the default Kubernetes namespace.| +|`--as`|*no default*|Configure custom Kubernetes user impersonation.| +|`--as-groups`|*no default*|Configure custom Kubernetes group impersonation.| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|`-n`, `--namespace`|*no default*|Configure the default Kubernetes namespace.| |`--[no-]all`|`false`|Generate a kubeconfig with every cluster the user has access to. Mutually exclusive with --labels or --query.| |`--[no-]disable-access-request`|`false`|Disable automatic resource Access Requests.| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| -|`--request-reason`|none|Reason for requesting access.| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`--request-reason`|*no default*|Reason for requesting access.| |`--set-context-name`|`{{.ClusterName}}-{{.KubeName}}`|Define a custom context name. To use it with --all include "\{\{.KubeName\}\}".| Arguments: |Argument|Default|Description| |---|---|---| -|kube-cluster|none (optional)|Name of the Kubernetes cluster to login to. Check 'tsh kube ls' for a list of available clusters.| +|kube-cluster|*no default* (optional)|Name of the Kubernetes cluster to login to. Check 'tsh kube ls' for a list of available clusters.| ## tsh kube ls @@ -760,19 +932,19 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| |`-q`, `--[no-]quiet`|`false`|Quiet mode.| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| |`-R`, `--[no-]all`|`false`|List Kubernetes clusters from all clusters and proxies.| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| |`-v`, `--[no-]verbose`|`false`|Show an untruncated list of labels.| Arguments: |Argument|Default|Description| |---|---|---| -|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|labels|*no default* (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| ## tsh kube sessions @@ -789,8 +961,8 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| ## tsh kubectl @@ -806,7 +978,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|args|none (optional)|Arbitrary arguments| +|args|*no default* (optional)|Arbitrary arguments| ## tsh latency ssh @@ -828,14 +1000,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| |`--[no-]no-resume`|`false`|Disable SSH connection resumption.| Arguments: |Argument|Default|Description| |---|---|---| -|[user@]host|none (required)|Remote hostname and the login to use.| +|[user@]host|*no default* (required)|Remote hostname and the login to use.| ## tsh login @@ -851,24 +1023,24 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--browser`|none|Set to 'none' to suppress browser opening on login.| +|`--browser`|*no default*|Set to 'none' to suppress browser opening on login.| |`-f`, `--format`|`file`|Identity format: file, openssh (for OpenSSH compatibility) or kubernetes (for kubeconfig).| -|`--kube-cluster`|none|Name of the Kubernetes cluster to login to.| +|`--kube-cluster`|*no default*|Name of the Kubernetes cluster to login to.| |`--[no-]overwrite`|`false`|Whether to overwrite the existing identity file.| |`--[no-]request-nowait`|`false`|Finish without waiting for request resolution.| -|`-o`, `--out`|none|Identity output.| -|`--request-id`|none|Login with the roles requested in the given request.| -|`--request-reason`|none|Reason for requesting additional roles.| -|`--request-reviewers`|none|Suggested reviewers for role request.| -|`--request-roles`|none|Request one or more extra roles.| -|`--scope`|none|Scope pins credentials to a given scope.| +|`-o`, `--out`|*no default*|Identity output.| +|`--request-id`|*no default*|Login with the roles requested in the given request.| +|`--request-reason`|*no default*|Reason for requesting additional roles.| +|`--request-reviewers`|*no default*|Suggested reviewers for role request.| +|`--request-roles`|*no default*|Request one or more extra roles.| +|`--scope`|*no default*|Scope pins credentials to a given scope. Use "" to explicitly remove scoping.| |`-v`, `--[no-]verbose`|`false`|Show extra status information.| Arguments: |Argument|Default|Description| |---|---|---| -|cluster|none (optional)|Specify the Teleport cluster to connect.| +|cluster|*no default* (optional)|Specify the Teleport cluster to connect.| ## tsh logout @@ -894,18 +1066,18 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`-f`, `--format`|`text`|Format output (text, json, yaml, names).| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`, `names`)|Format output (text, json, yaml, names).| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| |`-R`, `--[no-]all`|`false`|List nodes from all clusters and proxies.| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| |`-v`, `--[no-]verbose`|`false`|One-line output (for text format), including node UUIDs.| Arguments: |Argument|Default|Description| |---|---|---| -|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|labels|*no default* (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| ## tsh mcp config @@ -921,27 +1093,27 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_MCP_CLIENT_CONFIG`|none|If specified, update the specified client config, assuming its format. "claude" for default Claude Desktop config, "cursor" for global Cursor MCP servers config, or specify a JSON file path. Can also be set with environment variable TELEPORT_MCP_CLIENT_CONFIG.| -|`TELEPORT_MCP_CONFIG_JSON_FORMAT`|`auto`|Format the JSON file (pretty, compact, auto, none). auto saves in compact if the file is already compact, otherwise pretty. Can also be set with environment variable TELEPORT_MCP_CONFIG_JSON_FORMAT. Default is auto.| +|`TELEPORT_MCP_CLIENT_CONFIG`|*no default*|If specified, update the specified client config, assuming its format. "claude" for default Claude Desktop config, "cursor" for global Cursor MCP servers config, or specify a JSON file path. Can also be set with environment variable TELEPORT_MCP_CLIENT_CONFIG.| +|`TELEPORT_MCP_CONFIG_JSON_FORMAT`|`auto` (one of: `pretty`, `compact`, `auto`, `none`)|Format the JSON file (pretty, compact, auto, none). auto saves in compact if the file is already compact, otherwise pretty. Can also be set with environment variable TELEPORT_MCP_CONFIG_JSON_FORMAT. Default is auto.| Flags: |Flag|Default|Description| |---|---|---| -|`--client-config`|none|If specified, update the specified client config, assuming its format. "claude" for default Claude Desktop config, "cursor" for global Cursor MCP servers config, or specify a JSON file path. Can also be set with environment variable TELEPORT_MCP_CLIENT_CONFIG.| -|`--format`|none|Format specifies the configuration format (claude, vscode, cursor). If not provided it will assume format from the configuration file, When no configuration file is provided it defaults to "claude".| -|`-H`, `--header`|none|Extra custom headers used for streamable HTTP MCP servers.| -|`--json-format`|`auto`|Format the JSON file (pretty, compact, auto, none). auto saves in compact if the file is already compact, otherwise pretty. Can also be set with environment variable TELEPORT_MCP_CONFIG_JSON_FORMAT. Default is auto.| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|`--client-config`|*no default*|If specified, update the specified client config, assuming its format. "claude" for default Claude Desktop config, "cursor" for global Cursor MCP servers config, or specify a JSON file path. Can also be set with environment variable TELEPORT_MCP_CLIENT_CONFIG.| +|`--format`|*no default*|Format specifies the configuration format (claude, vscode, cursor). If not provided it will assume format from the configuration file, When no configuration file is provided it defaults to "claude".| +|`-H`, `--header`|*no default*|Extra custom headers used for streamable HTTP MCP servers.| +|`--json-format`|`auto` (one of: `pretty`, `compact`, `auto`, `none`)|Format the JSON file (pretty, compact, auto, none). auto saves in compact if the file is already compact, otherwise pretty. Can also be set with environment variable TELEPORT_MCP_CONFIG_JSON_FORMAT. Default is auto.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| |`--[no-]auto-reconnect`|`false`|Automatically starts a new remote MCP session when the previous remote session is interrupted by network issues or tsh session expirations. Recommended for stateless MCP sessions. Defaults to true.| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| |`-R`, `--[no-]all`|`false`|Select all MCP servers. Mutually exclusive with --labels or --query.| Arguments: |Argument|Default|Description| |---|---|---| -|name|none (optional)|Name of the MCP server.| +|name|*no default* (optional)|Name of the MCP server.| ## tsh mcp db config @@ -957,25 +1129,25 @@ Environment variables: |Variable|Default|Description| |---|---|---| -|`TELEPORT_MCP_CLIENT_CONFIG`|none|If specified, update the specified client config, assuming its format. "claude" for default Claude Desktop config, "cursor" for global Cursor MCP servers config, or specify a JSON file path. Can also be set with environment variable TELEPORT_MCP_CLIENT_CONFIG.| -|`TELEPORT_MCP_CONFIG_JSON_FORMAT`|`auto`|Format the JSON file (pretty, compact, auto, none). auto saves in compact if the file is already compact, otherwise pretty. Can also be set with environment variable TELEPORT_MCP_CONFIG_JSON_FORMAT. Default is auto.| +|`TELEPORT_MCP_CLIENT_CONFIG`|*no default*|If specified, update the specified client config, assuming its format. "claude" for default Claude Desktop config, "cursor" for global Cursor MCP servers config, or specify a JSON file path. Can also be set with environment variable TELEPORT_MCP_CLIENT_CONFIG.| +|`TELEPORT_MCP_CONFIG_JSON_FORMAT`|`auto` (one of: `pretty`, `compact`, `auto`, `none`)|Format the JSON file (pretty, compact, auto, none). auto saves in compact if the file is already compact, otherwise pretty. Can also be set with environment variable TELEPORT_MCP_CONFIG_JSON_FORMAT. Default is auto.| Flags: |Flag|Default|Description| |---|---|---| -|`--client-config`|none|If specified, update the specified client config, assuming its format. "claude" for default Claude Desktop config, "cursor" for global Cursor MCP servers config, or specify a JSON file path. Can also be set with environment variable TELEPORT_MCP_CLIENT_CONFIG.| -|`--format`|none|Format specifies the configuration format (claude, vscode, cursor). If not provided it will assume format from the configuration file, When no configuration file is provided it defaults to "claude".| -|`--json-format`|`auto`|Format the JSON file (pretty, compact, auto, none). auto saves in compact if the file is already compact, otherwise pretty. Can also be set with environment variable TELEPORT_MCP_CONFIG_JSON_FORMAT. Default is auto.| -|`-n`, `--db-name`|none|Database name to log in to.| +|`--client-config`|*no default*|If specified, update the specified client config, assuming its format. "claude" for default Claude Desktop config, "cursor" for global Cursor MCP servers config, or specify a JSON file path. Can also be set with environment variable TELEPORT_MCP_CLIENT_CONFIG.| +|`--format`|*no default*|Format specifies the configuration format (claude, vscode, cursor). If not provided it will assume format from the configuration file, When no configuration file is provided it defaults to "claude".| +|`--json-format`|`auto` (one of: `pretty`, `compact`, `auto`, `none`)|Format the JSON file (pretty, compact, auto, none). auto saves in compact if the file is already compact, otherwise pretty. Can also be set with environment variable TELEPORT_MCP_CONFIG_JSON_FORMAT. Default is auto.| +|`-n`, `--db-name`|*no default*|Database name to log in to.| |`--[no-]overwrite`|`false`|Overwrites command and environment variable from the config file.| -|`-u`, `--db-user`|none|Database user to log in as.| +|`-u`, `--db-user`|*no default*|Database user to log in as.| Arguments: |Argument|Default|Description| |---|---|---| -|name|none (optional)|Database service name.| +|name|*no default* (optional)|Database service name.| ## tsh mcp ls @@ -991,16 +1163,16 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| |`-v`, `--[no-]verbose`|`false`|Show extra MCP server fields.| Arguments: |Argument|Default|Description| |---|---|---| -|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|labels|*no default* (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| ## tsh mfa add @@ -1016,8 +1188,8 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--name`|none|Name of the new MFA device.| -|`--type`|none|Type of the new MFA device (TOTP, WEBAUTHN).| +|`--name`|*no default*|Name of the new MFA device.| +|`--type`|*no default* (one of: `TOTP`, `WEBAUTHN`)|Type of the new MFA device (TOTP, WEBAUTHN).| ## tsh mfa ls @@ -1033,7 +1205,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| |`-v`, `--[no-]verbose`|`false`|Print more information about MFA devices.| ## tsh mfa rm @@ -1050,7 +1222,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|name|none (required)|Name or ID of the MFA device to remove.| +|name|*no default* (required)|Name or ID of the MFA device to remove.| ## tsh piv agent @@ -1076,16 +1248,16 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`-f`, `--format`|`pty`|Format output (pty, json, yaml, text).| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`-f`, `--format`|`pty` (one of: `pty`, `json`, `yaml`, `text`)|Format output (pty, json, yaml, text).| |`--[no-]skip-idle-time`|`false`|Quickly skip over idle time, applicable when streaming SSH or Kubernetes sessions.| -|`--speed`|`1x`|Playback speed, applicable when streaming SSH or Kubernetes sessions.| +|`--speed`|`1x` (one of: `0.5x`, `1x`, `2x`, `4x`, `8x`)|Playback speed, applicable when streaming SSH or Kubernetes sessions.| Arguments: |Argument|Default|Description| |---|---|---| -|session-id|none (required)|ID or path to session file to play.| +|session-id|*no default* (required)|ID or path to session file to play.| ## tsh proxy app @@ -1102,14 +1274,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`-p`, `--port`|none|Specifies the listening port used by the proxy app listener. Accepts an optional target port of a multi-port TCP app after a colon, e.g. "1234:5678".| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`-p`, `--port`|*no default*|Specifies the listening port used by the proxy app listener. Accepts an optional target port of a multi-port TCP app after a colon, e.g. "1234:5678".| Arguments: |Argument|Default|Description| |---|---|---| -|app|none (required)|The name of the application to start local proxy for.| +|app|*no default* (required)|The name of the application to start local proxy for.| ## tsh proxy aws @@ -1125,9 +1297,9 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--app`|none|Optional Name of the AWS application to use if logged into multiple.| -|`-f`, `--format`|`unix`|Optional format to print the commands for setting environment variables, one of: unix, command-prompt, powershell, text. Default is unix. Or specify a service format, one of: athena-odbc, athena-jdbc.| -|`-p`, `--port`|none|Specifies the source port used by the proxy listener.| +|`--app`|*no default*|Optional Name of the AWS application to use if logged into multiple.| +|`-f`, `--format`|`unix` (one of: `unix`, `command-prompt`, `powershell`, `text`, `athena-odbc`, `athena-jdbc`)|Optional format to print the commands for setting environment variables, one of: unix, command-prompt, powershell, text. Default is unix. Or specify a service format, one of: athena-odbc, athena-jdbc.| +|`-p`, `--port`|*no default*|Specifies the source port used by the proxy listener.| ## tsh proxy azure @@ -1143,9 +1315,9 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--app`|none|Optional Name of the Azure application to use if logged into multiple.| -|`-f`, `--format`|`unix`|Optional format to print the commands for setting environment variables, one of: unix, command-prompt, powershell, text. Default is unix.| -|`-p`, `--port`|none|Specifies the source port used by the proxy listener.| +|`--app`|*no default*|Optional Name of the Azure application to use if logged into multiple.| +|`-f`, `--format`|`unix` (one of: `unix`, `command-prompt`, `powershell`, `text`)|Optional format to print the commands for setting environment variables, one of: unix, command-prompt, powershell, text. Default is unix.| +|`-p`, `--port`|*no default*|Specifies the source port used by the proxy listener.| ## tsh proxy db @@ -1162,24 +1334,24 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| -|`--listen`|none|Specifies the source address used by proxy db listener. Mutually exclusive with --port.| -|`-n`, `--db-name`|none|Database name to log in to.| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|`--listen`|*no default*|Specifies the source address used by proxy db listener. Mutually exclusive with --port.| +|`-n`, `--db-name`|*no default*|Database name to log in to.| |`--[no-]disable-access-request`|`false`|Disable automatic resource Access Requests.| |`--[no-]insecure-listen-anywhere`|`false`|Allows the local proxy to listen on any address without restrictions. WARNING: this will expose unsecured listener to anyone in the network. Only use when network access is otherwise restricted.| |`--[no-]tunnel`|`false`|Open authenticated tunnel using database's client certificate so clients don't need to authenticate.| -|`-p`, `--port`|none|Specifies the source port used by proxy db listener.| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| -|`-r`, `--db-roles`|none|List of comma separate database roles to use for auto-provisioned user.| -|`--request-reason`|none|Reason for requesting access.| -|`-u`, `--db-user`|none|Database user to log in as.| +|`-p`, `--port`|*no default*|Specifies the source port used by proxy db listener.| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`-r`, `--db-roles`|*no default*|List of comma separate database roles to use for auto-provisioned user.| +|`--request-reason`|*no default*|Reason for requesting access.| +|`-u`, `--db-user`|*no default*|Database user to log in as.| Arguments: |Argument|Default|Description| |---|---|---| -|db|none (optional)|The name of the database to start local proxy for.| +|db|*no default* (optional)|The name of the database to start local proxy for.| ## tsh proxy gcloud @@ -1195,9 +1367,9 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--app`|none|Optional Name of the GCP application to use if logged into multiple.| -|`-f`, `--format`|`unix`|Optional format to print the commands for setting environment variables, one of: unix, command-prompt, powershell, text. Default is unix.| -|`-p`, `--port`|none|Specifies the source port used by the proxy listener.| +|`--app`|*no default*|Optional Name of the GCP application to use if logged into multiple.| +|`-f`, `--format`|`unix` (one of: `unix`, `command-prompt`, `powershell`, `text`)|Optional format to print the commands for setting environment variables, one of: unix, command-prompt, powershell, text. Default is unix.| +|`-p`, `--port`|*no default*|Specifies the source port used by the proxy listener.| ## tsh proxy kube @@ -1213,24 +1385,24 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--as`|none|Configure custom Kubernetes user impersonation.| -|`--as-groups`|none|Configure custom Kubernetes group impersonation.| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`--exec-arg`|none|Arguments to pass to the executed command (can be specified multiple times).| -|`--exec-cmd`|none|Command to execute when --exec is enabled. If not specified, defaults to $SHELL or /bin/bash. Implicitly enables exec mode.| -|`-f`, `--format`|`unix`|Optional format to print the commands for setting environment variables, one of: unix, command-prompt, powershell, text. Default is unix.| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| -|`-n`, `--namespace`|none|Configure the default Kubernetes namespace.| +|`--as`|*no default*|Configure custom Kubernetes user impersonation.| +|`--as-groups`|*no default*|Configure custom Kubernetes group impersonation.| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`--exec-arg`|*no default*|Arguments to pass to the executed command (can be specified multiple times).| +|`--exec-cmd`|*no default*|Command to execute when --exec is enabled. If not specified, defaults to $SHELL or /bin/bash. Implicitly enables exec mode.| +|`-f`, `--format`|`unix` (one of: `unix`, `command-prompt`, `powershell`, `text`)|Optional format to print the commands for setting environment variables, one of: unix, command-prompt, powershell, text. Default is unix.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|`-n`, `--namespace`|*no default*|Configure the default Kubernetes namespace.| |`--[no-]exec`|`false`|Run the proxy in the background and reexec into a new shell with $KUBECONFIG already pointed to our config file.| -|`-p`, `--port`|none|Specifies the source port used by the proxy listener.| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`-p`, `--port`|*no default*|Specifies the source port used by the proxy listener.| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| |`--set-context-name`|`{{.ClusterName}}-{{.KubeName}}`|Define a custom context name or template.| Arguments: |Argument|Default|Description| |---|---|---| -|kube-cluster|none (optional)|Name of the Kubernetes cluster to proxy. Check 'tsh kube ls' for a list of available clusters. If not specified, all clusters previously logged in through `tsh kube login` will be used.| +|kube-cluster|*no default* (optional)|Name of the Kubernetes cluster to proxy. Check 'tsh kube ls' for a list of available clusters. If not specified, all clusters previously logged in through `tsh kube login` will be used.| ## tsh proxy mcp @@ -1246,14 +1418,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`-p`, `--port`|none|Specifies the listening port used by the proxy app listener.| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`-p`, `--port`|*no default*|Specifies the listening port used by the proxy app listener.| Arguments: |Argument|Default|Description| |---|---|---| -|app|none (required)|The name of the MCP application to start local proxy for.| +|app|*no default* (required)|The name of the MCP application to start local proxy for.| ## tsh proxy ssh @@ -1276,7 +1448,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| |`--[no-]no-resume`|`false`|Disable SSH connection resumption.| |`--[no-]relogin`|`true`|Permit performing an authentication attempt on a failed command.| @@ -1284,7 +1456,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|[user@]host|none (required)|Remote hostname and the login to use.| +|[user@]host|*no default* (required)|Remote hostname and the login to use.| ## tsh recordings export @@ -1300,13 +1472,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--out`|none|Override output file name.| +|`--out`|*no default*|Override output file name.| Arguments: |Argument|Default|Description| |---|---|---| -|session-id|none (required)|ID of the session to export.| +|session-id|*no default* (required)|ID of the session to export.| ## tsh recordings ls @@ -1322,11 +1494,11 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).. Defaults to 'text'.| -|`--from-utc`|none|Start of time range in which recordings are listed. Format 2006-01-02. Defaults to 24 hours ago.| -|`--last`|none|Duration into the past from which session recordings should be listed. Format "5h30m40s".| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).. Defaults to 'text'.| +|`--from-utc`|*no default*|Start of time range in which recordings are listed. Format 2006-01-02. Defaults to 24 hours ago.| +|`--last`|*no default*|Duration into the past from which session recordings should be listed. Format "5h30m40s".| |`--limit`|`50`|Maximum number of recordings to show. Default 50.| -|`--to-utc`|none|End of time range in which recordings are listed. Format 2006-01-02. Defaults to current time.| +|`--to-utc`|*no default*|End of time range in which recordings are listed. Format 2006-01-02. Defaults to current time.| ## tsh request create @@ -1342,19 +1514,19 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--assume-start-time`|none|Sets time roles can be assumed by requestor (RFC3339 e.g. 2023-12-12T23:20:50.52Z).| -|`--max-duration`|none|How long the access should be granted for.| +|`--assume-start-time`|*no default*|Sets time roles can be assumed by requestor (RFC3339 e.g 2023-12-12T23:20:50.52Z).| +|`--max-duration`|*no default*|How long the access should be granted for.| |`--[no-]nowait`|`false`|Finish without waiting for request resolution.| -|`--reason`|none|Reason for requesting.| -|`--request-ttl`|none|Expiration time for the Access Request.| -|`--resource`|none|Resource ID to be requested.| -|`--reviewers`|none|Suggested reviewers.| -|`--roles`|none|Roles to be requested.| -|`--session-ttl`|none|Expiration time for the elevated certificate.| +|`--reason`|*no default*|Reason for requesting.| +|`--request-ttl`|*no default*|Expiration time for the Access Request.| +|`--resource`|*no default*|Resource ID to be requested.| +|`--reviewers`|*no default*|Suggested reviewers.| +|`--roles`|*no default*|Roles to be requested.| +|`--session-ttl`|*no default*|Expiration time for the elevated certificate.| ## tsh request drop -Drop one more Access Requests from current identity. +Drop one or more Access Requests from current identity. Usage: @@ -1382,7 +1554,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| |`--[no-]my-requests`|`false`|Only show requests created by current user.| |`--[no-]reviewable`|`false`|Only show requests reviewable by current user.| |`--[no-]suggested`|`false`|Only show requests that suggest current user as reviewer.| @@ -1401,16 +1573,16 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--assume-start-time`|none|Sets time roles can be assumed by requestor (RFC3339 e.g. 2023-12-12T23:20:50.52Z).| +|`--assume-start-time`|*no default*|Sets time roles can be assumed by requestor (RFC3339 e.g 2023-12-12T23:20:50.52Z).| |`--[no-]approve`|`false`|Review proposes approval.| |`--[no-]deny`|`false`|Review proposes denial.| -|`--reason`|none|Review reason message.| +|`--reason`|*no default*|Review reason message.| Arguments: |Argument|Default|Description| |---|---|---| -|request-id|none (required)|ID of target request.| +|request-id|*no default* (required)|ID of target request.| ## tsh request search @@ -1426,17 +1598,17 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| -|`--kind`|none|Resource kind to search for (node, kube_cluster, kube_resource, db, app, windows_desktop, user_group, saml_idp_service_provider, aws_ic_account, aws_ic_account_assignment, git_server). Mutually exclusive with --roles.| -|`--kube-api-group`|none|Kubernetes API group to search for resources.| -|`--kube-cluster`|none|Kubernetes Cluster to search for Pods.| -|`--kube-kind`|none|Kubernetes resource kind name (plural) to search for. Required with --kind="kube_resource" Ex: pods, deployments, namespaces, etc.| -|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--kind`|*no default*|Resource kind to search for (node, kube_cluster, kube_resource, db, app, windows_desktop, user_group, saml_idp_service_provider, aws_ic_account, aws_ic_account_assignment, git_server). Mutually exclusive with --roles.| +|`--kube-api-group`|*no default*|Kubernetes API group to search for resources.| +|`--kube-cluster`|*no default*|Kubernetes Cluster to search for Pods.| +|`--kube-kind`|*no default*|Kubernetes resource kind name (plural) to search for. Required with --kind="kube_resource" Ex: pods, deployments, namespaces, etc.| +|`--labels`|*no default*|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2).| |`--namespace`|`default`|Kubernetes Namespace to search for Pods.| |`--[no-]all-kube-namespaces`|`false`|Search Pods in every namespace.| |`--[no-]roles`|`false`|List requestable roles instead of searching for resources. Mutually exclusive with --kind.| -|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| -|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| +|`--query`|*no default*|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"').| +|`--search`|*no default*|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase").| |`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output.| ## tsh request show @@ -1453,13 +1625,13 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| Arguments: |Argument|Default|Description| |---|---|---| -|request-id|none (required)|ID of the target request.| +|request-id|*no default* (required)|ID of the target request.| ## tsh resolve @@ -1475,14 +1647,14 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| |`-q`, `--[no-]quiet`|`false`|Quiet mode.| Arguments: |Argument|Default|Description| |---|---|---| -|host|none (required)|Remote hostname to resolve.| +|host|*no default* (required)|Remote hostname to resolve.| ## tsh scan keys @@ -1498,8 +1670,8 @@ Flags: |Flag|Default|Description| |---|---|---| -|`--dirs`|`/Users/`|Directories to scan.| -|`--skip-paths`|none|Paths to directories or files to skip. Supports for matching patterns.| +|`--dirs`|*no default*|Directories to scan. Defaults to /home/ on Linux, /Users/ on macOS, and C:\Users\ on Windows.| +|`--skip-paths`|*no default*|Paths to directories or files to skip. Supports for matching patterns.| ## tsh scopes ls @@ -1537,11 +1709,11 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| |`--[no-]no-resume`|`false`|Disable SSH connection resumption.| |`--[no-]relogin`|`true`|Permit performing an authentication attempt on a failed command.| |`-p`, `--[no-]preserve`|`false`|Preserves access and modification times from the original file.| -|`-P`, `--port`|none|Port to connect to on the remote host.| +|`-P`, `--port`|*no default*|Port to connect to on the remote host.| |`-q`, `--[no-]quiet`|`false`|Quiet mode.| |`-r`, `--[no-]recursive`|`false`|Recursive copy of subdirectories.| @@ -1549,7 +1721,7 @@ Arguments: |Argument|Default|Description| |---|---|---| -|from, to|none (required)|Source and destination to copy, one must be a local path and one must be a remote path.| +|from, to|*no default* (required)|Source and destination to copy, one must be a local path and one must be a remote path.| ## tsh sessions ls @@ -1565,8 +1737,8 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| -|`--kind`|`ssh`,`k8s`,`db`,`app`,`desktop`|Filter by session kind(s).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| +|`--kind`|`ssh`,`k8s`,`db`,`app`,`desktop` (any of (repeatable): `ssh`, `k8s`, `kube`, `db`, `app`, `desktop`)|Filter by session kind(s).| ## tsh ssh @@ -1583,31 +1755,31 @@ Environment variables: |Variable|Default|Description| |---|---|---| |`TELEPORT_NO_RESUME`|`false`|Disable SSH connection resumption.| -|`TELEPORT_REQUEST_MODE`|`resource`|Type of automatic Access Request to make (off, resource, role).| +|`TELEPORT_REQUEST_MODE`|`resource` (one of: `off`, `resource`, `role`)|Type of automatic Access Request to make.| Flags: |Flag|Default|Description| |---|---|---| |`-A`, `--[no-]forward-agent`|`false`|Forward agent to target node.| -|`-c`, `--cluster`|none|Specify the Teleport cluster to connect.| -|`-D`, `--dynamic-forward`|none|Forward localhost connections to remote server using SOCKS5.| +|`-c`, `--cluster`|*no default*|Specify the Teleport cluster to connect.| +|`-D`, `--dynamic-forward`|*no default*|Forward localhost connections to remote server using SOCKS5.| |`-f`, `--[no-]fork-after-authentication`|`false`|Run in background after authentication is complete.| -|`--invite`|none|A comma separated list of people to mark as invited for the session.| -|`-L`, `--forward`|none|Forward localhost connections to remote server.| -|`--log-dir`|none|Directory to log separated command output, when executing on multiple nodes. If set, output from each node will also be labeled in the terminal.| +|`--invite`|*no default*|A comma separated list of people to mark as invited for the session.| +|`-L`, `--forward`|*no default*|Forward localhost connections to remote server.| +|`--log-dir`|*no default*|Directory to log separated command output, when executing on multiple nodes. If set, output from each node will also be labeled in the terminal.| |`-N`, `--[no-]no-remote-exec`|`false`|Don't execute remote command, useful for port forwarding.| |`--[no-]disable-access-request`|`false`|Disable automatic resource Access Requests (DEPRECATED: use --request-mode=off).| |`--[no-]local`|`false`|Execute command on localhost after connecting to SSH node.| |`--[no-]no-resume`|`false`|Disable SSH connection resumption.| |`--[no-]participant-req`|`false`|Displays a verbose list of required participants in a moderated session.| |`--[no-]relogin`|`true`|Permit performing an authentication attempt on a failed command.| -|`-o`, `--option`|none|OpenSSH options in the format used in the configuration file.| -|`-p`, `--port`|none|SSH port on a remote host.| -|`--reason`|none|The purpose of the session.| -|`--request-mode`|`resource`|Type of automatic Access Request to make (off, resource, role).| -|`--request-reason`|none|Reason for requesting access.| -|`-R`, `--remote-forward`|none|Forward remote connections to localhost.| +|`-o`, `--option`|*no default*|OpenSSH options in the format used in the configuration file.| +|`-p`, `--port`|*no default*|SSH port on a remote host.| +|`--reason`|*no default*|The purpose of the session.| +|`--request-mode`|`resource` (one of: `off`, `resource`, `role`)|Type of automatic Access Request to make.| +|`--request-reason`|*no default*|Reason for requesting access.| +|`-R`, `--remote-forward`|*no default*|Forward remote connections to localhost.| |`-t`, `--[no-]tty`|`false`|Allocate TTY.| |`--x11-untrusted-timeout`|`10m`|Sets a timeout for untrusted X11 forwarding, after which the client will reject any forwarding requests from the server.| |`-X`, `--[no-]x11-untrusted`|`false`|Requests untrusted (secure) X11 forwarding for this session.| @@ -1617,8 +1789,8 @@ Arguments: |Argument|Default|Description| |---|---|---| -|command|none (optional)|Command to execute on a remote host.| -|[user@]host|none (optional)|Remote hostname and the login to use, this argument is required.| +|command|*no default* (optional)|Command to execute on a remote host.| +|[user@]host|*no default* (optional)|Remote hostname and the login to use, this argument is required.| ## tsh status @@ -1634,7 +1806,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| |`--[no-]client`|`false`|Show client information only (no server required).| |`-v`, `--[no-]verbose`|`false`|Show extra status information after successful login.| @@ -1669,7 +1841,7 @@ Flags: |Flag|Default|Description| |---|---|---| -|`-f`, `--format`|`text`|Format output (text, json, yaml).| +|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).| |`--[no-]client`|`false`|Show the client version only (no server required).| ## tsh vnet @@ -1695,8 +1867,8 @@ $ tsh vnet-ssh-autoconfig ## tsh workload-identity issue-x509 -Use Teleport Workload Identity to issue an X509 credential write it to a local -directory. +Use Teleport Workload Identity to issue an X509 credential and write it to a +local directory. Usage: @@ -1709,7 +1881,7 @@ Flags: |Flag|Default|Description| |---|---|---| |`--credential-ttl`|`1h`|Sets the time to live for the credential.| -|`--label-selector`|none|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','.| -|`--name-selector`|none|The name of the workload identity to issue.| -|`--output`|none|Path to the directory to write the SVID into.| +|`--label-selector`|*no default*|A label-based selector for which workload identities to issue. Multiple labels can be provided using ','.| +|`--name-selector`|*no default*|The name of the workload identity to issue.| +|`--output`|*no default*|Path to the directory to write the SVID into.| diff --git a/go.mod b/go.mod index d3659f2731e..00df6a8334e 100644 --- a/go.mod +++ b/go.mod @@ -626,7 +626,7 @@ require ( // when changing the replace directives make sure to also apply the same changes // to modules that require github.com/gravitational/teleport replace ( - github.com/alecthomas/kingpin/v2 => github.com/gravitational/kingpin/v2 v2.1.11-0.20260417152838-9efcbe7e5d61 + github.com/alecthomas/kingpin/v2 => github.com/gravitational/kingpin/v2 v2.1.11-0.20260507144047-1f18894764f5 github.com/crewjam/saml => github.com/gravitational/saml v0.4.15-teleport.2 github.com/datastax/go-cassandra-native-protocol => github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.3 github.com/go-mysql-org/go-mysql => github.com/gravitational/go-mysql v1.9.1-teleport.4 diff --git a/go.sum b/go.sum index 6e474afda22..c9984b48f8b 100644 --- a/go.sum +++ b/go.sum @@ -789,8 +789,8 @@ github.com/gravitational/go-mysql v1.9.1-teleport.4 h1:2Lt2fcEMrco6apu8jme0mj6OS github.com/gravitational/go-mysql v1.9.1-teleport.4/go.mod h1:pkllauQtJgHr2mTonYYysOznctozxiWgwpKAez0s+2U= github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5 h1:qg8FcGwRACSHortU1UxCSo9nF0t34rPWjk9Nef3j2Ic= github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM= -github.com/gravitational/kingpin/v2 v2.1.11-0.20260417152838-9efcbe7e5d61 h1:cgG/o1SAL2WK9AtryT/esiuXqCN47f15EwppKgeom60= -github.com/gravitational/kingpin/v2 v2.1.11-0.20260417152838-9efcbe7e5d61/go.mod h1:usbNrkVhUGh5+Pqd4u5tYKszWmq6YSCApkePRMmJFP8= +github.com/gravitational/kingpin/v2 v2.1.11-0.20260507144047-1f18894764f5 h1:E7lyOeBLDh+3N3cAKT+dC343tAP5uJxyUJDGFxi+q5Y= +github.com/gravitational/kingpin/v2 v2.1.11-0.20260507144047-1f18894764f5/go.mod h1:usbNrkVhUGh5+Pqd4u5tYKszWmq6YSCApkePRMmJFP8= github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 h1:Kt7aT9N7vbZmcMejGXnSAGap8TUwH3fMoHE8cQm14wc= github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1/go.mod h1:n4RXV6T3SJ/vrJqmc4vBeHpaBspxWENDD67ssQlXXkg= github.com/gravitational/predicate v1.3.4 h1:9N3JhBXNPcUh0w8DdlpnVmfnH9Z3xxbw43sD3E19VBE= diff --git a/lib/auth/init.go b/lib/auth/init.go index e201cb81b43..fb53b5162bb 100644 --- a/lib/auth/init.go +++ b/lib/auth/init.go @@ -1788,8 +1788,12 @@ func migrateRemoteClusters(ctx context.Context, asrv *Server) error { // to avoid consistency issues. A lower priority means the resource is applied // before. var ResourceApplyPriority = map[string]int{ - types.KindRole: 1, - types.KindUser: 2, // Users must be applied after Roles + types.KindRole: 1, + types.KindInferenceSecret: 1, + + types.KindUser: 2, // Users must be applied after Roles + types.KindInferenceModel: 2, + types.KindToken: 3, types.KindClusterNetworkingConfig: 3, types.KindClusterAuthPreference: 3, @@ -1797,7 +1801,9 @@ var ResourceApplyPriority = map[string]int{ // Bots should be applied after users and roles as at the moment they are actually converted to users and roles. // This will ensure that Bot Users/Roles are properly created regardless of the Teleport version from which the // resources have been exported. - types.KindBot: 3, + types.KindBot: 3, + types.KindInferencePolicy: 3, + types.KindRetrievalModel: 3, } // Unlike when resources are loaded via --bootstrap, we're inserting elements via their service. diff --git a/lib/tbot/cli/keypair_create.go b/lib/tbot/cli/keypair_create.go index 18227492d06..75ac4267e50 100644 --- a/lib/tbot/cli/keypair_create.go +++ b/lib/tbot/cli/keypair_create.go @@ -56,7 +56,7 @@ func NewKeypairCreateCommand(parentCmd KingpinClause, action func(*KeypairCreate cmd.Flag("storage", "The internal storage URI to write the keypair to, such as `file:///var/lib/teleport/bot`.").StringVar(&c.Storage) cmd.Flag("proxy-server", "The proxy server, which will be pinged to determine the current cryptographic suite in use.").Required().StringVar(&c.ProxyServer) cmd.Flag("overwrite", "If set, overwrite any existing keypair. If unset and a keypair already exists, its key will be printed for use.").BoolVar(&c.Overwrite) - cmd.Flag("format", "Output format, one of: text, json").Default(teleport.Text).EnumVar(&c.Format, teleport.Text, teleport.JSON) + cmd.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.Format, teleport.Text, teleport.JSON) cmd.Flag("static", "If set, creates a static private key instead of writing a mutable key into bot storage. If --static-key-path is unset, the key will be printed to the terminal.").BoolVar(&c.Static) cmd.Flag("static-key-path", "If set, writes the static private key to a file.").StringVar(&c.StaticKeyPath) diff --git a/lib/tbot/cli/start_database.go b/lib/tbot/cli/start_database.go index 4052b090683..f0291a4d7e1 100644 --- a/lib/tbot/cli/start_database.go +++ b/lib/tbot/cli/start_database.go @@ -52,7 +52,7 @@ func NewDatabaseCommand(parentCmd *kingpin.CmdClause, action MutatorAction, mode c.sharedDestinationArgs = newSharedDestinationArgs(cmd) c.genericMutatorHandler = newGenericMutatorHandler(cmd, c, action) - cmd.Flag("format", "The format of the credentials to generate. If specified, must be `tls`, `mongo` or `cockroach`.").Default("").EnumVar(&c.Format, database.SupportedDatabaseFormatStrings()...) + cmd.Flag("format", "The format of the credentials to generate.").Default("").EnumVar(&c.Format, database.SupportedDatabaseFormatStrings()...) cmd.Flag("service", "The database service name.").Required().StringVar(&c.Service) cmd.Flag("username", "The database user name.").Required().StringVar(&c.Username) cmd.Flag("database", "The name of the database available in the requested database service.").Required().StringVar(&c.Database) diff --git a/lib/tbot/cli/start_legacy.go b/lib/tbot/cli/start_legacy.go index e57883a200b..9c95460ec6f 100644 --- a/lib/tbot/cli/start_legacy.go +++ b/lib/tbot/cli/start_legacy.go @@ -23,7 +23,6 @@ import ( "fmt" "log/slog" "reflect" - "strings" "time" "github.com/alecthomas/kingpin/v2" @@ -150,11 +149,6 @@ type LegacyCommand struct { // NewLegacyCommand initializes and returns a command supporting // `tbot start legacy` and `tbot configure legacy`. func NewLegacyCommand(parentCmd *kingpin.CmdClause, action MutatorAction, mode CommandMode) *LegacyCommand { - joinMethodList := fmt.Sprintf( - "(%s)", - strings.Join(onboarding.SupportedJoinMethods, ", "), - ) - c := &LegacyCommand{ action: action, cmd: parentCmd.Command("legacy", fmt.Sprintf("%s tbot with either a config file or a legacy output.", mode)).Default(), @@ -167,7 +161,7 @@ func NewLegacyCommand(parentCmd *kingpin.CmdClause, action MutatorAction, mode C c.cmd.Flag("ca-pin", "CA pin to validate the Teleport Auth Server; used on first connect.").StringsVar(&c.CAPins) c.cmd.Flag("certificate-ttl", "TTL of short-lived machine certificates.").DurationVar(&c.CertificateTTL) c.cmd.Flag("renewal-interval", "Interval at which short-lived certificates are renewed; must be less than the certificate TTL.").DurationVar(&c.RenewalInterval) - c.cmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).EnumVar(&c.JoinMethod, onboarding.SupportedJoinMethods...) + c.cmd.Flag("join-method", "Method to use to join the cluster.").EnumVar(&c.JoinMethod, onboarding.SupportedJoinMethods...) c.cmd.Flag("oneshot", "If set, quit after the first renewal.").IsSetByUser(&c.oneshotSetByUser).BoolVar(&c.Oneshot) c.cmd.Flag("diag-addr", "If set and the bot is in debug mode, a diagnostics service will listen on specified address.").StringVar(&c.DiagAddr) c.cmd.Flag("diag-socket-for-updater", "If set, run the diagnostics service on the specified socket path for teleport-update to consume.").Hidden().StringVar(&c.DiagSocketForUpdater) diff --git a/lib/tbot/cli/start_shared.go b/lib/tbot/cli/start_shared.go index 68fb7f6f46e..b69b41b98f0 100644 --- a/lib/tbot/cli/start_shared.go +++ b/lib/tbot/cli/start_shared.go @@ -20,10 +20,8 @@ package cli import ( "context" - "fmt" "log/slog" "reflect" - "strings" "time" "github.com/alecthomas/kingpin/v2" @@ -137,15 +135,11 @@ func newSharedStartArgs(cmd *kingpin.CmdClause) *sharedStartArgs { args := &sharedStartArgs{} args.AuthProxyArgs = newAuthProxyArgs(cmd) - joinMethodList := fmt.Sprintf( - "(%s)", - strings.Join(onboarding.SupportedJoinMethods, ", "), - ) cmd.Flag("token", "A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.").Envar(TokenEnvVar).StringVar(&args.Token) cmd.Flag("ca-pin", "CA pin to validate the Teleport Auth Server; used on first connect.").StringsVar(&args.CAPins) cmd.Flag("certificate-ttl", "TTL of short-lived machine certificates.").DurationVar(&args.CertificateTTL) cmd.Flag("renewal-interval", "Interval at which short-lived certificates are renewed; must be less than the certificate TTL.").DurationVar(&args.RenewalInterval) - cmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).EnumVar(&args.JoinMethod, onboarding.SupportedJoinMethods...) + cmd.Flag("join-method", "Method to use to join the cluster.").EnumVar(&args.JoinMethod, onboarding.SupportedJoinMethods...) cmd.Flag("oneshot", "If set, quit after the first renewal.").IsSetByUser(&args.oneshotSetByUser).BoolVar(&args.Oneshot) cmd.Flag("diag-addr", "If set and the bot is in debug mode, a diagnostics service will listen on specified address.").StringVar(&args.DiagAddr) cmd.Flag("storage", "A destination URI for tbot's internal storage, e.g. file:///foo/bar").StringVar(&args.Storage) diff --git a/lib/utils/usage.go b/lib/utils/usage.go index 320eb474168..b50f960dd8c 100644 --- a/lib/utils/usage.go +++ b/lib/utils/usage.go @@ -25,3 +25,6 @@ import ( // UpdateAppUsageTemplate is a no-op for regular builds. See usage_docs.go for // doc generation. func UpdateAppUsageTemplate(*kingpin.Application) {} + +// DocsMode is false in regular builds. It is true when building with -tags docs. +const DocsMode = false diff --git a/lib/utils/usage_docs.go b/lib/utils/usage_docs.go index d435e44d302..a0171bffa57 100644 --- a/lib/utils/usage_docs.go +++ b/lib/utils/usage_docs.go @@ -34,6 +34,9 @@ import ( "gopkg.in/yaml.v3" ) +// DocsMode is true when building with -tags docs. +const DocsMode = true + var nonLetters = regexp.MustCompile(`\W`) // lowerWordChars returns only the word characters (\w) from in, in lowercase, @@ -183,22 +186,37 @@ func sortCommandsByName(cmds []*kingpin.CmdModel) []*kingpin.CmdModel { return cmds } +const noDefaultSet = "*no default*" + // formatDefaultFlagValue returns the default value of flag to display in a // table of flags. Assumes that a Boolean flag is false unless it is true by -// default. +// default. If the flag is an enum, includes the valid enum options. func formatDefaultFlagValue(flag *kingpin.FlagModel) string { + var defaultValue string + switch { case len(flag.Default) == 0 && flag.IsBoolFlag(): - return "`false`" + defaultValue = "`false`" case len(flag.Default) > 0: ret := make([]string, len(flag.Default)) for i, v := range flag.Default { ret[i] = fmt.Sprintf("`%v`", v) } - return strings.Join(ret, ",") + defaultValue = strings.Join(ret, ",") default: - return "none" + defaultValue = noDefaultSet } + + // If this is an enum flag, append the valid options + if prefix, options := getEnumOptions(flag.Value); len(options) > 0 { + optionsFormatted := make([]string, len(options)) + for i, opt := range options { + optionsFormatted[i] = fmt.Sprintf("`%s`", opt) + } + defaultValue += fmt.Sprintf(" (%s: %s)", prefix, strings.Join(optionsFormatted, ", ")) + } + + return defaultValue } // formatDefaultArgValue returns the default value of arg to display in a table @@ -212,7 +230,7 @@ func formatDefaultArgValue(arg *kingpin.ArgModel) string { } ret = strings.Join(def, ",") } else { - ret = "none" + ret = noDefaultSet } if arg.Required { ret += " (required)" @@ -229,6 +247,45 @@ type repeatableFlag interface { IsCumulative() bool } +// enumFlag is an interface for flags that have enum values. We use reflection +// to access the options field since kingpin doesn't export an interface for this. +type enumFlag interface { + String() string + Set(string) error +} + +// Optional interface for flags that can be repeated. +type repeatable interface { + IsCumulative() bool +} + +// Optional interface for enum values that have a set of valid options. +type enumOptions interface { + EnumOptions() []string +} + +// getEnumOptions extracts the enum options from a kingpin Value using reflection. +// Returns nil if the value is not an enum type or if options cannot be extracted. +func getEnumOptions(value kingpin.Value) (string, []string) { + if value == nil { + return "", nil + } + + prefix := "one of" + if e, ok := value.(repeatable); ok && e.IsCumulative() { + prefix = "any of (repeatable)" + } + + var options []string + if e, ok := value.(enumOptions); ok { + options = e.EnumOptions() + } + if len(options) > 0 { + return prefix, options + } + return "", nil +} + // formatUsageArg prints a command argument to include in a usage snippet. func formatUsageArg(arg *kingpin.ArgModel) string { var ret string diff --git a/lib/utils/usage_docs_test.go b/lib/utils/usage_docs_test.go index f4bf3889ee2..270f6c7d879 100644 --- a/lib/utils/usage_docs_test.go +++ b/lib/utils/usage_docs_test.go @@ -512,6 +512,55 @@ Arguments: |start_time|@now@ (optional)|When to start the app| |verbosity|@3@ (optional)|Verbosity level.| +`, + }, + { + name: "enum flag with default value", + makeApp: func() *kingpin.Application { + app := InitCLIParser("myapp", "This is the main CLI tool.") + var format string + app.Flag("format", "Output format").Default("text").EnumVar(&format, "text", "json", "yaml") + return app + }, + config: generatorConfig{ + Introduction: "This is the main CLI tool.", + }, + expectSubstring: `Global flags: + +|Flag|Default|Description| +|---|---|---| +|@--format@|@text@ (valid: @text@, @json@, @yaml@)|Output format| + +`, + }, + { + name: "enum flag in subcommand", + makeApp: func() *kingpin.Application { + app := InitCLIParser("myapp", "This is the main CLI tool.") + list := app.Command("list", "List resources.") + var mode string + list.Flag("mode", "List mode").Default("all").EnumVar(&mode, "all", "active", "inactive") + return app + }, + config: generatorConfig{ + Introduction: "This is the main CLI tool.", + }, + expectSubstring: `## myapp list + +List resources. + +Usage: + +@@@code +$ myapp list [] +@@@ + +Flags: + +|Flag|Default|Description| +|---|---|---| +|@--mode@|@all@ (valid: @all@, @active@, @inactive@)|List mode| + `, }, } diff --git a/tool/tctl/common/acl_command.go b/tool/tctl/common/acl_command.go index f3b513ace15..22d7c744399 100644 --- a/tool/tctl/common/acl_command.go +++ b/tool/tctl/common/acl_command.go @@ -89,16 +89,16 @@ func (c *ACLCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFl acl := app.Command("acl", "Manage Access Lists.").Alias("access-lists") c.ls = acl.Command("ls", "List cluster Access Lists.") - c.ls.Flag("format", "Output format, 'yaml', 'json', or 'text'").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text) + c.ls.Flag("format", "Output format.").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text) c.ls.Flag("review-only", "List only access lists that are due for review within the next 2 weeks or past due").BoolVar(&c.reviewOnly) c.get = acl.Command("get", "Get detailed information for an Access List.") c.get.Arg("access-list-name", "The Access List name.").Required().StringVar(&c.accessListName) - c.get.Flag("format", "Output format, 'yaml', 'json', or 'text'").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text) + c.get.Flag("format", "Output format.").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text) c.summary = acl.Command("summary", "Show summary information for access lists, including their members and last review.") c.summary.Arg("access-list-name", "The access list name to show summary for. If not provided, shows summary for all access lists.").StringVar(&c.accessListName) - c.summary.Flag("format", "Output format 'yaml' or 'json'").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON) + c.summary.Flag("format", "Output format.").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON) c.summary.Flag("review-only", "Show only access lists that are due for review within the next 2 weeks or past due. Defaults to true."). Default("true"). // default to show only reviewable lists since the command can get expensive with many lists/members BoolVar(&c.reviewOnly) @@ -106,7 +106,7 @@ func (c *ACLCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFl users := acl.Command("users", "Manage user membership to Access Lists.") c.usersAdd = users.Command("add", "Add a user to an Access List.") - c.usersAdd.Flag("kind", "Access list member kind, 'user' or 'list'").Default(memberKindUser).EnumVar(&c.memberKind, memberKindUser, memberKindList) + c.usersAdd.Flag("kind", "Access list member kind.").Default(memberKindUser).EnumVar(&c.memberKind, memberKindUser, memberKindList) c.usersAdd.Arg("access-list-name", "The Access List name.").Required().StringVar(&c.accessListName) c.usersAdd.Arg("user", "The user to add to the Access List.").Required().StringVar(&c.userName) c.usersAdd.Arg("expires", "When the user's access expires (must be in RFC3339). Defaults to the expiration time of the Access List.").StringVar(&c.expires) @@ -118,7 +118,7 @@ func (c *ACLCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFl c.usersList = users.Command("ls", "List users that are members of an Access List.") c.usersList.Arg("access-list-name", "The Access List name.").Required().StringVar(&c.accessListName) - c.usersList.Flag("format", "Output format 'json', or 'text'").Default(teleport.Text).EnumVar(&c.format, teleport.JSON, teleport.Text) + c.usersList.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, teleport.JSON, teleport.Text) reviews := acl.Command("reviews", "Manage access list reviews.") @@ -129,7 +129,7 @@ func (c *ACLCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFl c.reviewsList = reviews.Command("ls", "List past audit history for a given access list.") c.reviewsList.Arg("access-list-name", "The access list name to fetch review history for.").Required().StringVar(&c.accessListName) - c.reviewsList.Flag("format", "Output format 'yaml', 'json', or 'text'").Default(teleport.Text).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text) + c.reviewsList.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text) if c.Stdout == nil { c.Stdout = os.Stdout diff --git a/tool/tctl/common/alert_command.go b/tool/tctl/common/alert_command.go index 733aac5bc5b..d56eaa482fb 100644 --- a/tool/tctl/common/alert_command.go +++ b/tool/tctl/common/alert_command.go @@ -80,12 +80,12 @@ func (c *AlertCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLI c.alertList = alert.Command("list", "List cluster alerts.").Alias("ls") c.alertList.Flag("verbose", "Show detailed alert info, including acknowledged alerts.").Short('v').BoolVar(&c.verbose) c.alertList.Flag("labels", labelHelp).StringVar(&c.labels) - c.alertList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.format, formats...) + c.alertList.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, formats...) c.alertCreate = alert.Command("create", "Create cluster alerts.") c.alertCreate.Arg("message", "Alert body message.").Required().StringVar(&c.message) c.alertCreate.Flag("ttl", "Time duration after which the alert expires (default 24h).").DurationVar(&c.ttl) - c.alertCreate.Flag("severity", "Severity of the alert (low, medium, or high).").Default("low").EnumVar(&c.severity, "low", "medium", "high") + c.alertCreate.Flag("severity", "Severity of the alert.").Default("low").EnumVar(&c.severity, "low", "medium", "high") c.alertCreate.Flag("labels", "List of labels to attach to the alert. For example: key1=value1,key2=value2.").StringVar(&c.labels) c.alertDelete = alert.Command("delete", "Deletes a cluster alert.").Alias("rm") @@ -99,7 +99,7 @@ func (c *AlertCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLI c.alertAck.Flag("clear", "Clear the acknowledgment for the cluster alert.").BoolVar(&c.clear) c.alertAck.Flag("reason", "The reason for acknowledging the cluster alert.").StringVar(&c.reason) c.alertAck.Arg("id", "The cluster alert ID.").Required().StringVar(&c.alertID) - c.alertAck.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.format, formats...) + c.alertAck.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, formats...) // We add "ack ls" as a command so kingpin shows it in the help dialog - as there is a space, `tctl ack xyz` will always be // handled by the ack command above diff --git a/tool/tctl/common/auth_command.go b/tool/tctl/common/auth_command.go index 55f17c229a9..7a371de4e21 100644 --- a/tool/tctl/common/auth_command.go +++ b/tool/tctl/common/auth_command.go @@ -176,7 +176,7 @@ func (a *AuthCommand) Initialize(app *kingpin.Application, cliFlags *tctlcfg.Glo a.authLS.Flag("format", "Output format: 'yaml', 'json' or 'text'").Default(teleport.YAML).StringVar(&a.format) a.authCRL = auth.Command("crl", "Export empty certificate revocation list (CRL) for Teleport certificate authorities.") - a.authCRL.Flag("type", fmt.Sprintf("Certificate authority type, one of: %s", strings.Join(allowedCRLCertificateTypes, ", "))).Required().EnumVar(&a.caType, allowedCRLCertificateTypes...) + a.authCRL.Flag("type", "Certificate authority type.").Required().EnumVar(&a.caType, allowedCRLCertificateTypes...) a.authCRL.Flag("out", "If set, writes exported revocation lists to files with the given path prefix").StringVar(&a.output) if libsubca.Enabled() { diff --git a/tool/tctl/common/auth_rotate_command.go b/tool/tctl/common/auth_rotate_command.go index de552e8e4cd..c474258afb9 100644 --- a/tool/tctl/common/auth_rotate_command.go +++ b/tool/tctl/common/auth_rotate_command.go @@ -72,7 +72,7 @@ func (c *authRotateCommand) Initialize(authCmd *kingpin.CmdClause) { c.cmd = authCmd.Command("rotate", "Rotate certificate authorities in the cluster. Starts in interactive mode by default, provide --type to manually send rotation requests.") c.cmd.Flag("interactive", "Enable interactive mode").BoolVar(&c.interactiveMode) c.cmd.Flag("manual", "Activate manual rotation, set rotation phases manually").BoolVar(&c.manualMode) - c.cmd.Flag("type", fmt.Sprintf("Certificate authority to rotate, one of: %s", strings.Join(getCertAuthTypes(), ", "))).EnumVar(&c.caType, getCertAuthTypes()...) + c.cmd.Flag("type", "Certificate authority to rotate.").EnumVar(&c.caType, getCertAuthTypes()...) c.cmd.Flag("phase", fmt.Sprintf("Target rotation phase to set, used in manual rotation, one of: %v", strings.Join(types.RotatePhases, ", "))).StringVar(&c.targetPhase) c.cmd.Flag("grace-period", "Grace period keeps previous certificate authorities signatures valid, if set to 0 will force users to re-login and nodes to re-register."). Default(fmt.Sprintf("%v", defaults.RotationGracePeriod)). diff --git a/tool/tctl/common/bots_command.go b/tool/tctl/common/bots_command.go index 722d01c9c93..7b7512909c6 100644 --- a/tool/tctl/common/bots_command.go +++ b/tool/tctl/common/bots_command.go @@ -117,7 +117,7 @@ type BotsCommand struct { // `bot instances add` func (c *BotsCommand) initSharedBotTokenFlags(cmd *kingpin.CmdClause) { cmd.Flag("token", "The token to use, if any. If unset, a new single-use token will be created.").StringVar(&c.tokenID) - cmd.Flag("format", "Output format, one of: text, json").Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON) + cmd.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON) // TODO(timothyb89): Remove in v20 (optional) cmd.Flag("legacy", "If set, generate a legacy joining token instead of a bound keypair token. No effect if --token is set.").BoolVar(&c.legacy) @@ -157,7 +157,7 @@ func (c *BotsCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIF bots := app.Command("bots", "Manage Machine & Workload Identity bots on the cluster.").Alias("bot") c.botsList = bots.Command("ls", "List all certificate renewal bots registered with the cluster.") - c.botsList.Flag("format", "Output format, 'text' or 'json'").Hidden().Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON) + c.botsList.Flag("format", "Output format.").Hidden().Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON) c.botsAdd = bots.Command("add", "Add a new bot to the cluster.") c.botsAdd.Arg("name", "A name to uniquely identify this bot in the cluster.").Required().StringVar(&c.botName) @@ -190,7 +190,7 @@ func (c *BotsCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIF c.botsInstancesList = c.botsInstances.Command("list", "List bot instances.").Alias("ls") c.botsInstancesList.Arg("name", "The name of the bot from which to list instances. If unset, lists instances from all bots.").StringVar(&c.botName) - c.botsInstancesList.Flag("format", "Output format, 'text' or 'json'").Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON) + c.botsInstancesList.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON) c.botsInstancesList.Flag("search", "Fuzzy search query used to filter bot instances").StringVar(&c.search) c.botsInstancesList.Flag("query", "An expression in the Teleport predicate language used to filter bot instances").StringVar(&c.query) c.botsInstancesList.Flag("sort-index", "Request sort index, 'bot_name', 'active_at_latest', 'version_latest' or 'host_name_latest'").Default("bot_name").StringVar(&c.sortIndex) diff --git a/tool/tctl/common/devices.go b/tool/tctl/common/devices.go index f8c19591507..1cf100f983f 100644 --- a/tool/tctl/common/devices.go +++ b/tool/tctl/common/devices.go @@ -94,10 +94,10 @@ func (c *DevicesCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalC BoolVar(&c.add.enroll) addCmd.Flag("enroll-ttl", "Time duration for the enrollment token"). DurationVar(&c.add.enrollTTL) - addCmd.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.add.format, formats...) + addCmd.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.add.format, formats...) lsCmd := devicesCmd.Command("ls", "Lists managed devices.") - lsCmd.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.ls.format, formats...) + lsCmd.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.ls.format, formats...) rmCmd := devicesCmd.Command("rm", "Removes a managed device.") rmCmd.Flag("device-id", "Device identifier").StringVar(&c.rm.deviceID) diff --git a/tool/tctl/common/notification_command.go b/tool/tctl/common/notification_command.go index df3d6f185da..0c8281b258a 100644 --- a/tool/tctl/common/notification_command.go +++ b/tool/tctl/common/notification_command.go @@ -88,7 +88,7 @@ func (n *NotificationCommand) Initialize(app *kingpin.Application, _ *tctlcfg.Gl n.ls = notif.Command("ls", "List notifications which were manually created using `tctl notifications create`. By default, this will list notifications capable of targeting multiple users, such as role-based ones. To list notifications directed only at a specific user, use the --user flag. To include notifications generated by Teleport, use --all.") n.ls.Flag("user", "Set which user to list user-specific notifications for, or leave empty to list your own.").StringVar(&n.user) - n.ls.Flag("format", "Output format, 'yaml', 'json', or 'text'").Default(teleport.Text).EnumVar(&n.format, teleport.YAML, teleport.JSON, teleport.Text) + n.ls.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&n.format, teleport.YAML, teleport.JSON, teleport.Text) n.ls.Flag("all", "Set whether all notifications should be included, including those generated by Teleport, as opposed to solely those created using `tctl notifications create`.").BoolVar(&n.allNotifications) n.ls.Flag("labels", labelHelp).StringVar(&n.labels) diff --git a/tool/tctl/common/stableunixusers/command.go b/tool/tctl/common/stableunixusers/command.go index fcb328dde40..fe38bd15d9a 100644 --- a/tool/tctl/common/stableunixusers/command.go +++ b/tool/tctl/common/stableunixusers/command.go @@ -43,7 +43,7 @@ type Command struct { func (c *Command) Initialize(app *kingpin.Application, _ *config.GlobalCLIFlags, _ *servicecfg.Config) { rootCmd := app.Command("stable-unix-users", "Manage the database of stable UNIX users.") c.lsCmd = rootCmd.Command("ls", "List the stable UNIX users currently persisted in the cluster.") - c.lsCmd.Flag("format", "Output format, 'text', or 'json'").Default(teleport.Text).EnumVar(&c.lsFormat, teleport.Text, teleport.JSON, teleport.YAML) + c.lsCmd.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.lsFormat, teleport.Text, teleport.JSON, teleport.YAML) } // TryRun implements [tool/tctl/common.CLICommand]. diff --git a/tool/tctl/common/tctl.go b/tool/tctl/common/tctl.go index 402ca2007d9..ac551e9f102 100644 --- a/tool/tctl/common/tctl.go +++ b/tool/tctl/common/tctl.go @@ -166,7 +166,7 @@ func TryRun(ctx context.Context, commands []CLICommand, args []string) error { app.Flag("insecure", "When specifying a proxy address in --auth-server, do not verify its TLS certificate. Danger: any data you send can be intercepted or modified by an attacker."). BoolVar(&ccf.Insecure) modes := []string{mfa.MFAModeAuto, mfa.MFAModeCrossPlatform, mfa.MFAModePlatform, mfa.MFAModeSSO, mfa.MFAModeBrowser} - app.Flag("mfa-mode", fmt.Sprintf("Preferred mode for MFA assertions (%v).", strings.Join(modes, ", "))). + app.Flag("mfa-mode", "Preferred mode for MFA assertions."). Default(mfa.MFAModeAuto). Envar(mfaModeEnvVar). EnumVar(&ccf.MFAMode, modes...) diff --git a/tool/tctl/common/token_command.go b/tool/tctl/common/token_command.go index 4247dfe42bb..144f72e0e07 100644 --- a/tool/tctl/common/token_command.go +++ b/tool/tctl/common/token_command.go @@ -170,7 +170,7 @@ func (c *TokensCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCL c.tokenAdd.Flag("db-name", "Name of the database to add").StringVar(&c.dbName) c.tokenAdd.Flag("db-protocol", fmt.Sprintf("Database protocol to use. Supported are: %v", defaults.DatabaseProtocols)).StringVar(&c.dbProtocol) c.tokenAdd.Flag("db-uri", "Address the database is reachable at").StringVar(&c.dbURI) - c.tokenAdd.Flag("format", "Output format, 'text', 'json', or 'yaml'").EnumVar(&c.format, formats...) + c.tokenAdd.Flag("format", "Output format.").EnumVar(&c.format, formats...) // "tctl tokens rm ..." c.tokenDel = tokens.Command("rm", "Delete/revoke an invitation token.").Alias("del") @@ -178,7 +178,7 @@ func (c *TokensCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCL // "tctl tokens ls" c.tokenList = tokens.Command("ls", "List node and user invitation tokens.") - c.tokenList.Flag("format", "Output format, 'text', 'json' or 'yaml'").EnumVar(&c.format, formats...) + c.tokenList.Flag("format", "Output format.").EnumVar(&c.format, formats...) c.tokenList.Flag("with-secrets", "Do not redact join tokens").BoolVar(&c.withSecrets) c.tokenList.Flag("labels", labelHelp).StringVar(&c.labels) diff --git a/tool/tctl/sso/configure/oidc.go b/tool/tctl/sso/configure/oidc.go index bff3c7d9948..a9f7ec1f6a6 100644 --- a/tool/tctl/sso/configure/oidc.go +++ b/tool/tctl/sso/configure/oidc.go @@ -150,7 +150,7 @@ func addOIDCCommand(cmd *SSOConfigureCommand) *AuthKindCommand { sub := cmd.ConfigureCmd.Command("oidc", fmt.Sprintf("Configure OIDC auth connector, optionally using a preset. Available presets: %v.", oidcPresets.getNames())) // commonly used flags - sub.Flag("preset", fmt.Sprintf("Preset. One of: %v", oidcPresets.getNames())).Short('p').EnumVar(&extra.chosenPreset, oidcPresets.getNames()...) + sub.Flag("preset", "Preset.").Short('p').EnumVar(&extra.chosenPreset, oidcPresets.getNames()...) sub.Flag("name", "Connector name. Required, unless implied from preset.").Short('n').StringVar(&extra.connectorName) sub.Flag("claims-to-roles", "Sets claim-to-roles mapping using format 'claim_name,claim_value,role1,role2,...'. Repeatable.").Short('r').Required().PlaceHolder("name,value,role1,role2,...").SetValue(flags.NewClaimsToRolesParser(&spec.ClaimsToRoles)) sub.Flag("display", "Sets the connector display name.").StringVar(&spec.Display) diff --git a/tool/tctl/sso/configure/saml.go b/tool/tctl/sso/configure/saml.go index 5af1e01efe7..d3419079c7f 100644 --- a/tool/tctl/sso/configure/saml.go +++ b/tool/tctl/sso/configure/saml.go @@ -96,7 +96,7 @@ func addSAMLCommand(cmd *SSOConfigureCommand) *AuthKindCommand { saml := &samlExtraFlags{} // commonly used flags - sub.Flag("preset", fmt.Sprintf("Preset. One of: %v", samlPresets.getNames())).Short('p').EnumVar(&saml.chosenPreset, samlPresets.getNames()...) + sub.Flag("preset", "Preset.").Short('p').EnumVar(&saml.chosenPreset, samlPresets.getNames()...) sub.Flag("name", "Connector name. Required, unless implied from preset.").Short('n').StringVar(&saml.connectorName) sub.Flag("entity-descriptor", "Set the Entity Descriptor. Valid values: file, URL, XML content. Supplies configuration parameters as single XML instead of individual elements.").Short('e').StringVar(&saml.entityDescriptorFlag) sub.Flag("attributes-to-roles", "Sets attribute-to-role mapping using format 'attr_name,attr_value,role1,role2,...'. Repeatable.").Short('r').Required().SetValue(flags.NewAttributesToRolesParser(&spec.AttributesToRoles)) diff --git a/tool/teleport/common/teleport.go b/tool/teleport/common/teleport.go index ef050cc2f21..12d3af848fa 100644 --- a/tool/teleport/common/teleport.go +++ b/tool/teleport/common/teleport.go @@ -158,8 +158,11 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con start.Flag("config", fmt.Sprintf("Path to a configuration file [%v]", defaults.ConfigFilePath)). Short('c').ExistingFileVar(&ccf.ConfigFile) + + applyOnStartupSupportedKinds := slices.Collect(maps.Keys(auth.ResourceApplyPriority)) + slices.Sort(applyOnStartupSupportedKinds) start.Flag("apply-on-startup", - fmt.Sprintf("Path to a non-empty YAML file containing resources to apply on startup. Works on initialized clusters, unlike --bootstrap. Only supports the following kinds: %s.", slices.Collect(maps.Keys(auth.ResourceApplyPriority)))). + fmt.Sprintf("Path to a non-empty YAML file containing resources to apply on startup. Works on initialized clusters, unlike --bootstrap. Only supports the following kinds: %s.", strings.Join(applyOnStartupSupportedKinds, ","))). ExistingFileVar(&ccf.ApplyOnStartupFile) start.Flag("bootstrap", "Path to a non-empty YAML file containing bootstrap resources (ignored if already initialized)").ExistingFileVar(&ccf.BootstrapFile) @@ -273,7 +276,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con for _, endpointType := range gcp.AlloyDBEndpointTypes { alloyDBEndpointTypes = append(alloyDBEndpointTypes, string(endpointType)) } - dbStartCmd.Flag("gcp-alloydb-endpoint-type", fmt.Sprintf("(Only for AlloyDB) Endpoint type. One of: %v", alloyDBEndpointTypes)).EnumVar(&ccf.DatabaseGCPAlloyDBEndpointType, alloyDBEndpointTypes...) + dbStartCmd.Flag("gcp-alloydb-endpoint-type", "(Only for AlloyDB) Endpoint type.").EnumVar(&ccf.DatabaseGCPAlloyDBEndpointType, alloyDBEndpointTypes...) dbStartCmd.Flag("ad-keytab-file", "(Only for SQL Server) Kerberos keytab file.").StringVar(&ccf.DatabaseADKeytabFile) dbStartCmd.Flag("ad-krb5-file", "(Only for SQL Server) Kerberos krb5.conf file.").Default(defaults.Krb5FilePath).StringVar(&ccf.DatabaseADKrb5File) dbStartCmd.Flag("ad-domain", "(Only for SQL Server) Active Directory domain.").StringVar(&ccf.DatabaseADDomain) @@ -445,7 +448,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con dump.Flag("key-file", "Path to a TLS key file for the proxy.").ExistingFileVar(&dumpFlags.KeyFile) dump.Flag("data-dir", "Path to a directory where Teleport keep its data.").Default(defaults.DataDir).StringVar(&dumpFlags.DataDir) dump.Flag("token", "Invitation token or path to file with token value to register with an auth server.").StringVar(&dumpFlags.AuthToken) - dump.Flag("join-method", fmt.Sprintf("Method to use to join the cluster (%s)", strings.Join(joinMethods, ", "))).Default("token").EnumVar(&dumpFlags.JoinMethod, joinMethods...) + dump.Flag("join-method", "Method to use to join the cluster.").Default("token").EnumVar(&dumpFlags.JoinMethod, joinMethods...) dump.Flag("roles", "Comma-separated list of roles to create config with.").StringVar(&dumpFlags.Roles) dump.Flag("auth-server", "Address of the auth server.").StringVar(&dumpFlags.AuthServer) dump.Flag("proxy", "Address of the proxy.").StringVar(&dumpFlags.ProxyAddress) @@ -472,7 +475,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con dumpNodeConfigure.Flag("proxy", "Address of the proxy server.").StringVar(&dumpFlags.ProxyAddress) dumpNodeConfigure.Flag("labels", "Comma-separated list of labels to add to newly created nodes ex) env=staging,cloud=aws.").StringVar(&dumpFlags.NodeLabels) dumpNodeConfigure.Flag("ca-pin", "Comma-separated list of SKPI hashes for the CA used to verify the auth server.").StringVar(&dumpFlags.CAPin) - dumpNodeConfigure.Flag("join-method", fmt.Sprintf("Method to use to join the cluster (%s)", strings.Join(joinMethods, ", "))).Default("token").EnumVar(&dumpFlags.JoinMethod, joinMethods...) + dumpNodeConfigure.Flag("join-method", "Method to use to join the cluster.").Default("token").EnumVar(&dumpFlags.JoinMethod, joinMethods...) dumpNodeConfigure.Flag("node-name", "Name for the Teleport node.").StringVar(&dumpFlags.NodeName) dumpNodeConfigure.Flag("silent", "Suppress user hint message.").BoolVar(&dumpFlags.Silent) dumpNodeConfigure.Flag("azure-client-id", "Sets the client ID of the managed identity to join with. Only applies to the 'azure' join method.").StringVar(&dumpFlags.AzureClientID) @@ -491,7 +494,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con // teleport join --proxy-server=proxy.example.com --token=aws-join-token [--openssh-config=/path/to/sshd.conf] [--restart-sshd=true] joinOpenSSH.Flag("proxy-server", "Address of the proxy server.").StringVar(&ccf.ProxyServer) joinOpenSSH.Flag("token", "Invitation token or path to file with token value to register with an auth server.").StringVar(&ccf.AuthToken) - joinOpenSSH.Flag("join-method", "Method to use to join the cluster (token, iam, ec2).").EnumVar(&ccf.JoinMethod, "token", "iam", "ec2") + joinOpenSSH.Flag("join-method", "Method to use to join the cluster.").EnumVar(&ccf.JoinMethod, "token", "iam", "ec2") joinOpenSSH.Flag("openssh-config", fmt.Sprintf("Path to the OpenSSH config file [%v].", "/etc/ssh/sshd_config")).Default("/etc/ssh/sshd_config").StringVar(&ccf.OpenSSHConfigPath) joinOpenSSH.Flag("data-dir", fmt.Sprintf("Path to directory to store teleport data [%v].", defaults.DataDir)).Default(defaults.DataDir).StringVar(&ccf.DataDir) joinOpenSSH.Flag("restart-sshd", "Restart OpenSSH.").Default("true").BoolVar(&ccf.RestartOpenSSH) @@ -631,7 +634,8 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con getLogLevelCmd := debugCmd.Command("get-log-level", "Fetches current log level.") collectProfilesCmd := debugCmd.Command("profile", "Export the application profiles (pprof format). Outputs to stdout .tar.gz file contents.") collectProfilesCmd.Alias(collectProfileUsageExamples) // We're using "alias" section to display usage examples. - collectProfilesCmd.Arg("PROFILES", fmt.Sprintf("Comma-separated profile names to be exported. Supported profiles: %s. Default: %s", strings.Join(slices.Collect(maps.Keys(debugclient.SupportedProfiles)), ","), strings.Join(defaultCollectProfiles, ","))).StringVar(&ccf.Profiles) + supportedProfiles := slices.Sorted(maps.Keys(debugclient.SupportedProfiles)) + collectProfilesCmd.Arg("PROFILES", fmt.Sprintf("Comma-separated profile names to be exported. Supported profiles: %s. Default: %s", strings.Join(supportedProfiles, ","), strings.Join(defaultCollectProfiles, ","))).StringVar(&ccf.Profiles) collectProfilesCmd.Flag("seconds", "For CPU and trace profiles, profile for the given duration (if set to 0, it returns a profile snapshot). For other profiles, return a delta profile. Default: 0").Short('s').Default("0").IntVar(&ccf.ProfileSeconds) readyzCmd := debugCmd.Command("readyz", "Checks if the instance is ready to serve requests.") metricsCmd := debugCmd.Command("metrics", "Fetches the cluster's Prometheus metrics.") diff --git a/tool/tsh/common/kube.go b/tool/tsh/common/kube.go index 8c3d944d332..5e391f5c81e 100644 --- a/tool/tsh/common/kube.go +++ b/tool/tsh/common/kube.go @@ -110,7 +110,7 @@ func newKubeJoinCommand(parent *kingpin.CmdClause) *kubeJoinCommand { CmdClause: parent.Command("join", "Join an active Kubernetes session."), } - c.Flag("mode", "Mode of joining the session, valid modes are observer, moderator and peer.").Short('m').Default("observer").EnumVar(&c.mode, "observer", "moderator", "peer") + c.Flag("mode", "Mode of joining the session.").Short('m').Default("observer").EnumVar(&c.mode, "observer", "moderator", "peer") c.Flag("cluster", clusterHelp).Short('c').StringVar(&c.siteName) c.Arg("session", "The ID of the target session.").Required().StringVar(&c.session) return c diff --git a/tool/tsh/common/scan.go b/tool/tsh/common/scan.go index ade15de3f5a..c7da2c74ea6 100644 --- a/tool/tsh/common/scan.go +++ b/tool/tsh/common/scan.go @@ -57,7 +57,11 @@ type scanKeysCommand struct { func newScanKeysCommand(parent *kingpin.CmdClause) *scanKeysCommand { c := &scanKeysCommand{CmdClause: parent.Command("keys", "Scan the local machine for SSH private keys and report findings to Teleport.")} - c.Flag("dirs", "Directories to scan.").Default(defaultDirValues()).StringsVar(&c.dirs) + c.Flag("dirs", fmt.Sprintf("Directories to scan. Defaults to %s on %s, %s on %s, and %s on %s.", + "/home/", "Linux", + "/Users/", "macOS", + `C:\Users\`, "Windows", + )).StringsVar(&c.dirs) c.Flag("skip-paths", "Paths to directories or files to skip. Supports for matching patterns.").StringsVar(&c.skipPaths) return c } @@ -77,7 +81,7 @@ func defaultDirValues() string { func (c *scanKeysCommand) run(cf *CLIConf) error { if len(c.dirs) == 0 { - return trace.BadParameter("no directories to scan") + c.dirs = []string{defaultDirValues()} } if cf.Proxy == "" { diff --git a/tool/tsh/common/tsh.go b/tool/tsh/common/tsh.go index a897d5e5353..75cd47d57ee 100644 --- a/tool/tsh/common/tsh.go +++ b/tool/tsh/common/tsh.go @@ -957,7 +957,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error { fmt.Sprintf("Verbose logging to the unified logging system. This flag implies --debug. Also available through the %s env var. More details see https://goteleport.com/docs/connect-your-client/tsh/#debug-logs.", osLogEnvVar)). IsSetByUser(&cf.OSLogSetByUser) - if runtime.GOOS != constants.DarwinOS { + if runtime.GOOS != constants.DarwinOS && !utils.DocsMode { osLogFlag.Hidden() } osLogFlag.BoolVar(&cf.OSLog) @@ -974,7 +974,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error { app.Flag("callback", "Override the base URL (host:port) of the link shown when opening a browser for cluster logins. Must be used with --bind-addr.").StringVar(&cf.CallbackAddr) app.Flag("browser-login", browserHelp).Hidden().Envar(browserEnvVar).StringVar(&cf.Browser) modes := []string{mfaModeAuto, mfaModeCrossPlatform, mfaModePlatform, mfaModeOTP, mfaModeSSO, mfaModeBrowser} - app.Flag("mfa-mode", fmt.Sprintf("Preferred mode for MFA and Passwordless assertions (%v).", strings.Join(modes, ", "))). + app.Flag("mfa-mode", "Preferred mode for MFA and Passwordless assertions."). Default(mfaModeAuto). Envar(mfaModeEnvVar). EnumVar(&cf.MFAMode, modes...) @@ -1014,7 +1014,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error { ssh.Flag("reason", "The purpose of the session.").StringVar(&cf.Reason) ssh.Flag("participant-req", "Displays a verbose list of required participants in a moderated session.").BoolVar(&cf.displayParticipantRequirements) ssh.Flag("request-reason", "Reason for requesting access.").StringVar(&cf.RequestReason) - ssh.Flag("request-mode", fmt.Sprintf("Type of automatic Access Request to make (%s).", strings.Join(accessRequestModes, ", "))).Envar(requestModeEnvVar).Default(accessRequestModeResource).EnumVar(&cf.RequestMode, accessRequestModes...) + ssh.Flag("request-mode", "Type of automatic Access Request to make.").Envar(requestModeEnvVar).Default(accessRequestModeResource).EnumVar(&cf.RequestMode, accessRequestModes...) ssh.Flag("disable-access-request", "Disable automatic resource Access Requests (DEPRECATED: use --request-mode=off).").BoolVar(&cf.disableAccessRequest) ssh.Flag("log-dir", "Directory to log separated command output, when executing on multiple nodes. If set, output from each node will also be labeled in the terminal.").StringVar(&cf.SSHLogDir) ssh.Flag("no-resume", "Disable SSH connection resumption.").Envar(noResumeEnvVar).BoolVar(&cf.DisableSSHResumption) @@ -1208,8 +1208,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error { dbConfig.Flag("query", queryHelp).StringVar(&cf.PredicateExpression) // --db flag is deprecated in favor of positional argument for consistency with other commands. dbConfig.Flag("db", "Print information for the specified database.").Hidden().StringVar(&cf.DatabaseService) - dbConfig.Flag("format", fmt.Sprintf("Print format: %q to print in table format (default), %q to print connect command, %q or %q to print in JSON or YAML.", - dbFormatText, dbFormatCommand, dbFormatJSON, dbFormatYAML)).Short('f').EnumVar(&cf.Format, dbFormatText, dbFormatCommand, dbFormatJSON, dbFormatYAML) + dbConfig.Flag("format", "Print format: \"text\" to print in table format (default), \"cmd\" to print connect command, \"json\" or \"yaml\" to print in JSON or YAML.").Short('f').EnumVar(&cf.Format, dbFormatText, dbFormatCommand, dbFormatJSON, dbFormatYAML) dbConnect := db.Command("connect", "Connect to a database.") dbConnect.Arg("db", "Database service name to connect to.").StringVar(&cf.DatabaseService) dbConnect.Flag("db-user", "Database user to log in as.").Short('u').StringVar(&cf.DatabaseUser) @@ -1236,7 +1235,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error { // join join := app.Command("join", "Join the active SSH or Kubernetes session.") join.Flag("cluster", clusterHelp).Short('c').StringVar(&cf.SiteName) - join.Flag("mode", "Mode of joining the session, valid modes are observer, moderator and peer.").Short('m').Default("observer").EnumVar(&cf.JoinMode, "observer", "moderator", "peer") + join.Flag("mode", "Mode of joining the session.").Short('m').Default("observer").EnumVar(&cf.JoinMode, "observer", "moderator", "peer") join.Arg("session-id", "ID of the session to join.").Required().StringVar(&cf.SessionID) // play play := app.Command("play", "Replay the recorded session (SSH, Kubernetes, App, DB).")