spiral workloads
Manage workload identities and how they sign in
Usage: spiral workloads [OPTIONS] <COMMAND>Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
Subcommands
| Command | Summary |
|---|---|
spiral workloads ls | List the workloads in a project |
spiral workloads create | Create a workload in a project |
spiral workloads show | Show a workload with its keys and trust policies |
spiral workloads drop | Drop a workload and revoke all of its credentials |
spiral workloads keys | Manage the key pairs a workload signs in with |
spiral workloads trust | Manage the platform identities a workload signs in with |
spiral workloads revoke-secret | Revoke a workload client secret (spw_...) once the workload uses a key pair or a platform identity |
spiral workloads ls
Usage: spiral workloads ls [OPTIONS] [PROJECT]Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
PROJECT | no | Project ID. Prompted interactively when omitted on a TTY |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads create
Usage: spiral workloads create [OPTIONS] [PROJECT]Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
PROJECT | no | Project ID. Prompted interactively when omitted on a TTY |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--name <NAME> | no | A name that describes the workload | |
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads show
Usage: spiral workloads show [OPTIONS] [WORKLOAD]Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
WORKLOAD | no | Workload ID. Prompted interactively when omitted on a TTY |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads drop
Usage: spiral workloads drop [OPTIONS] [WORKLOAD]Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
WORKLOAD | no | Workload ID. Prompted interactively when omitted on a TTY |
Options
| Option | Required | Default | Description |
|---|---|---|---|
-y, --yes | no | Skip the confirmation prompt | |
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads keys
Usage: spiral workloads keys [OPTIONS] <COMMAND>Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads keys ls
Usage: spiral workloads keys ls [OPTIONS] [WORKLOAD]Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
WORKLOAD | no | Workload ID. Prompted interactively when omitted on a TTY |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads keys add
Add a key pair to a workload. Without --key, generate a P-256 key pair on this machine, write its private key as a JWK to --output, and register only the public key. With --key, register the public half of an existing RSA, EC or Ed25519 key in JWK or PEM form; when the file holds a private key, --output writes it as the JWK that SPIRAL_PRIVATE_KEY takes.
Usage: spiral workloads keys add [OPTIONS] [WORKLOAD]Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
WORKLOAD | no | Workload ID. Prompted interactively when omitted on a TTY |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--key <KEY> | no | A public or private key to register, as a JWK or in PEM, instead of a new key pair | |
--kid <KID> | no | The key ID. Defaults to the key's own kid, or a new UUID | |
-o, --output <OUTPUT> | no | Where to write the private key as a JWK, or - for standard output. A generated key defaults to <workload>.jwk in the current directory | |
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads keys rm
Usage: spiral workloads keys rm [OPTIONS] <WORKLOAD> <KID>Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
WORKLOAD | yes | Workload ID | |
KID | yes | The key's ID |
Options
| Option | Required | Default | Description |
|---|---|---|---|
-y, --yes | no | Skip the confirmation prompt | |
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads trust
Usage: spiral workloads trust [OPTIONS] <COMMAND>Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads trust ls
Usage: spiral workloads trust ls [OPTIONS] [WORKLOAD]Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
WORKLOAD | no | Workload ID. Prompted interactively when omitted on a TTY |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads trust add
Usage: spiral workloads trust add [OPTIONS] [WORKLOAD]Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
WORKLOAD | no | Workload ID. Prompted interactively when omitted on a TTY |
Options
| Option | Required | Default | Description |
|---|---|---|---|
--github <OWNER/REPO> | no | GitHub Actions in a repository, OWNER/REPO | |
--gcp-service-account <UNIQUE_ID> | no | A GCP service account, by its numeric unique ID | |
--kubernetes-service-account <NAMESPACE/NAME> | no | A Kubernetes service account, NAMESPACE/NAME. Needs --issuer, the cluster's service-account issuer | |
--aws-role <ROLE_ARN> | no | An AWS IAM role, by its ARN. Needs --issuer, the account's outbound identity federation issuer | |
--modal-workspace <WORKSPACE_ID> | no | A Modal workspace, by its ID | |
--issuer <ISSUER> | no | The OIDC issuer of the tokens | |
--condition <CLAIM=VALUE> | no | A claim the tokens must carry, CLAIM=VALUE. Repeat to require several | |
--audience <AUDIENCE> | no | The audience the tokens name, for an issuer whose tokens cannot name SpiralDB's token endpoint | |
--name <NAME> | no | A name that describes the policy | |
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads trust rm
Usage: spiral workloads trust rm [OPTIONS] <POLICY_ID>Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
POLICY_ID | yes | Trust policy ID |
Options
| Option | Required | Default | Description |
|---|---|---|---|
-y, --yes | no | Skip the confirmation prompt | |
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
spiral workloads revoke-secret
Usage: spiral workloads revoke-secret [OPTIONS] <CLIENT_ID>Arguments
| Argument | Required | Default | Description |
|---|---|---|---|
CLIENT_ID | yes | The client ID of the secret, which SPIRAL_CLIENT_ID holds |
Options
| Option | Required | Default | Description |
|---|---|---|---|
-y, --yes | no | Skip the confirmation prompt | |
--json | no | Emit output as JSON instead of formatted tables | |
--json-logs | no | Write structured JSON logs to standard error |
Found a problem? Edit this page or report an issue.