spiral connections
Manage Connections: named credentials for external systems
Usage: spiral connections [OPTIONS] <COMMAND>Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--project <PROJECT> | no | Project that owns the Connection. Required for every operation | |
--json-logs | no | Write structured JSON logs to standard error |
Subcommands
| Command | Summary |
|---|---|
spiral connections create | Create a Connection. A secret, for a type that holds one, comes from a file or from stdin |
spiral connections list | List the Connections in a project |
spiral connections show | Show one Connection. No command shows the secret |
spiral connections update | Replace the whole credential of a Connection, its secret included. --auth moves an AWS, GCS, or Ceph Connection between a key and an identity |
spiral connections allowed-access | Set the most access that resources bound to a Connection may receive: read, or write for exports. SpiralDB never replaces or deletes an object through a Connection. Raising it first exercises the new level under the Connection URI |
spiral connections test | Check that a Connection reaches its external system |
spiral connections drop | Drop a Connection and delete its secret |
spiral connections create
Usage: spiral connections create [OPTIONS] --provider <PROVIDER> --uri <URI> <NAME>Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
NAME | yes | Connection name, such as acme_raw |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--provider <PROVIDER> | yes | Which external system the Connection reaches: its type | |
--auth <AUTH> | no | How SpiralDB authenticates to the provider. Required only for a provider that offers more than one way: aws and ceph take access_key or oidc, and gcs takes oidc or service_account_key | |
--uri <URI> | yes | The bucket, the prefix in a bucket, or the Hugging Face repository that the Connection reaches. The URI cannot change later | |
--description <DESCRIPTION> | no | What the Connection is for | |
--access-key-id <ACCESS_KEY_ID> | no | Access key ID, for --auth access_key | |
--role-arn <ROLE_ARN> | no | IAM role that trusts the Connection's identity, for an aws Connection with --auth oidc, such as arn:aws:iam::123456789012:role/spiraldb-reader; or the role that a ceph Connection assumes, as Ceph prints it, such as arn:aws:iam:::role/spiraldb-reader | |
--workload-identity-provider <WORKLOAD_IDENTITY_PROVIDER> | no | Workload identity pool provider that trusts SpiralDB, for a gcs Connection, such as projects/123456789012/locations/global/workloadIdentityPools/spiral/providers/spiral | |
--service-account <SERVICE_ACCOUNT> | no | Service account that the Connection impersonates, for a gcs Connection, such as spiral-reader@acme-data.iam.gserviceaccount.com | |
--endpoint <ENDPOINT> | no | Endpoint of a MinIO, RustFS, or Ceph deployment, such as https://minio.example.com, or of a Hugging Face Hub other than the public one | |
--region <REGION> | no | Region that the bucket signs against | |
--account-id <ACCOUNT_ID> | no | Cloudflare account ID, for an r2 Connection. The endpoint follows from it | |
--jurisdiction <JURISDICTION> | no | Jurisdiction that an R2 bucket was created in, for an r2 Connection. Left out, the bucket is in no jurisdiction | |
--secret-file <SECRET_FILE> | no | File that holds the secret: a secret access key, a token, or a Google service account key file | |
--secret-stdin | no | Read the secret from stdin | |
--json | no | Emit output as JSON instead of formatted tables | |
--project <PROJECT> | no | Project that owns the Connection. Required for every operation | |
--json-logs | no | Write structured JSON logs to standard error |
spiral connections list
Usage: spiral connections list [OPTIONS]Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--project <PROJECT> | no | Project that owns the Connection. Required for every operation | |
--json-logs | no | Write structured JSON logs to standard error |
spiral connections show
Usage: spiral connections show [OPTIONS] <NAME>Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
NAME | yes | Connection name, such as acme_raw or proj1.acme_raw |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--project <PROJECT> | no | Project that owns the Connection. Required for every operation | |
--json-logs | no | Write structured JSON logs to standard error |
spiral connections update
Usage: spiral connections update [OPTIONS] <NAME>Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
NAME | yes | Connection name |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--auth <AUTH> | no | How SpiralDB authenticates, to move an AWS or Ceph Connection between access_key and oidc, or a GCS Connection between service_account_key and oidc. Left out, the stored method stays. The provider never changes | |
--access-key-id <ACCESS_KEY_ID> | no | Access key ID, for --auth access_key | |
--role-arn <ROLE_ARN> | no | IAM role that trusts the Connection's identity, for an aws Connection with --auth oidc, such as arn:aws:iam::123456789012:role/spiraldb-reader; or the role that a ceph Connection assumes, as Ceph prints it, such as arn:aws:iam:::role/spiraldb-reader | |
--workload-identity-provider <WORKLOAD_IDENTITY_PROVIDER> | no | Workload identity pool provider that trusts SpiralDB, for a gcs Connection, such as projects/123456789012/locations/global/workloadIdentityPools/spiral/providers/spiral | |
--service-account <SERVICE_ACCOUNT> | no | Service account that the Connection impersonates, for a gcs Connection, such as spiral-reader@acme-data.iam.gserviceaccount.com | |
--endpoint <ENDPOINT> | no | Endpoint of a MinIO, RustFS, or Ceph deployment, such as https://minio.example.com, or of a Hugging Face Hub other than the public one | |
--region <REGION> | no | Region that the bucket signs against | |
--account-id <ACCOUNT_ID> | no | Cloudflare account ID, for an r2 Connection. The endpoint follows from it | |
--jurisdiction <JURISDICTION> | no | Jurisdiction that an R2 bucket was created in, for an r2 Connection. Left out, the bucket is in no jurisdiction | |
--secret-file <SECRET_FILE> | no | File that holds the secret: a secret access key, a token, or a Google service account key file | |
--secret-stdin | no | Read the secret from stdin | |
--json | no | Emit output as JSON instead of formatted tables | |
--project <PROJECT> | no | Project that owns the Connection. Required for every operation | |
--json-logs | no | Write structured JSON logs to standard error |
spiral connections allowed-access
Usage: spiral connections allowed-access [OPTIONS] <NAME> <ALLOWED_ACCESS>Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
NAME | yes | Connection name | |
ALLOWED_ACCESS | yes | read to read only, or write to also create objects, as exports need, but never replace or delete them |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--project <PROJECT> | no | Project that owns the Connection. Required for every operation | |
--json-logs | no | Write structured JSON logs to standard error |
spiral connections test
Usage: spiral connections test [OPTIONS] <NAME>Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
NAME | yes | Connection name, such as acme_raw or proj1.acme_raw |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--project <PROJECT> | no | Project that owns the Connection. Required for every operation | |
--json-logs | no | Write structured JSON logs to standard error |
spiral connections drop
Usage: spiral connections drop [OPTIONS] <NAME>Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
NAME | yes | Connection name, such as acme_raw or proj1.acme_raw |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--project <PROJECT> | no | Project that owns the Connection. Required for every operation | |
--json-logs | no | Write structured JSON logs to standard error |
Found a problem? Edit this page or report an issue.