kubectl gentian synopsis
The synopsis of every kubectl gentian command, as the plugin's own header states it; the full description of each command is in commands.md.
1. Synopsis
kubectl gentian login sign in (a code to confirm in a browser)
kubectl gentian logout
kubectl gentian whoami
kubectl gentian tenants list
kubectl gentian tenants show <name>
kubectl gentian tenants create <name> [--display-name <text>] [--no-mfa] [--admins-add-catalogues]
[--self-sign-up]
[--country <ISO 3166-1 alpha-2, e.g. CH>] [--reuse-name]
(sign-up is off, and is said out loud when it is on:
anybody may make an account; --reuse-name approves
the name of a retired tenant, whose rights it inherits)
kubectl gentian tenants set <name> [--admins-add-catalogues=true|false]
[--country <alpha-2> | --country ""] "" names none
kubectl gentian tenants activate-admin <name> [--recovery-email <address>]
kubectl gentian tenants retire <name> [--purge [--keep-bundles]] [--yes]
kubectl gentian tenants import <file.gentian> [--identity-file <f> | --passphrase] [--drop-custom-domain] [--reuse-name]
kubectl gentian tenants import --bucket <b> --prefix <p> [--endpoint <url> [--addressing-style path|virtualHost]]
(--identity-file <f> | --passphrase) [--drop-custom-domain]
(the bundle's custom domain is kept unless --drop-custom-domain)
kubectl gentian tenants delegate-catalogues <name> on|off
kubectl gentian tenants domain <name> the domain of its own it is bound to
kubectl gentian tenants domain <name> <domain> [--yes] bind it: its addresses move to <label>.<domain>
(a cluster with many tenants only)
kubectl gentian tenants domain <name> --remove [--yes] back to its default address
kubectl gentian tenants mail-mode <name> [<mode>] what the operator provisions for its mail:
selfhosted, external, transport-only, disabled
kubectl gentian tenants groups <name> [<group>... | --clear] its own groups, declared in git
kubectl gentian tenants sign-in <name> [--from <tenant> --groups <g>,... | --remove <tenant>]
people of another tenant of this cluster signing in here
kubectl gentian tenants partners <name> realms of other clusters its realm links accounts with
kubectl gentian tenants partners <name> add <partner> --issuer <https://<host>/<path to the realm>>
[--issue] [--accept link|create|organization [--domain <d>] [--display-name <text>]]
[--as <name the partner gives this realm>]
kubectl gentian tenants partners <name> remove <partner>
kubectl gentian tenants platform-access <name> [on|off] whether the platform's administrators may sign in
to the tenant as its administrators (the tenant's switch)
kubectl gentian platform-roles holders who holds which cluster role by name, as the claim declares
kubectl gentian platform-roles holders add <role> <tenant> <login> --reason <why> [--expires <RFC 3339>] [--scope tenant:<t>]
a person of the platform tenant, or an administrator
of another, holds it: one commit
kubectl gentian platform-roles holders remove <role> <tenant> <login> no longer
kubectl gentian platform-roles candidates who could hold one: the platform tenant's people,
every other tenant's administrators
kubectl gentian platform-roles members who holds admin and breakGlass through their group
kubectl gentian platform-roles review [--next <RFC 3339>] review both lists and record it on the claim
kubectl gentian credentials list [--tenant <tenant>] what is asked for, and whether it is set
kubectl gentian credentials set <name> --field <key>=@<file> [--field <key>=-]
set one; a value from a file, or from stdin (once)
kubectl gentian catalogues list [--tenant <tenant>]
kubectl gentian catalogues add <name> <https-url> [--tenant <tenant>]
kubectl gentian catalogues add <name> --oci <artifact> --repository <repository> [--tenant <tenant>]
a catalog kept as an OCI artifact, read with the credential of a
repository declared for the tenant (or, without --tenant, for the cluster)
kubectl gentian catalogues remove <name> [--tenant <tenant>]
kubectl gentian catalogues rename <old> <new> [--tenant <tenant>]
the same catalog under another name: what was installed from
it follows, in the same commit, and no build moves
kubectl gentian catalogues residue
kubectl gentian catalogues residue remove <kind>/<name> [--namespace <ns>] [--yes]
kubectl gentian repositories declare <name> --tenant <tenant> --url oci://<host>/<path> [--type oci]
a private registry a tenant pulls charts and images from;
the token is set in the Admin Console under Credentials
kubectl gentian repositories remove <name> --tenant <tenant>
kubectl gentian models list the models the gateway offers, and what the claim says of each
kubectl gentian models show the Cluster claim's model settings, as JSON
kubectl gentian models set -f <file.json> make the claim declare exactly these settings
(no provider's token: that is a credential)
kubectl gentian settings show the Cluster claim's settings, as JSON
kubectl gentian settings set <path>=<value> [...] change them, in one commit: tenancyMode=multi,
mainAddress.tenant=<tenant>, mail.serviceMode=system,
platformRoles.auditor=gentian:platform:auditor ...
kubectl gentian apps list --tenant <tenant> [--available]
kubectl gentian apps install <app> --tenant <tenant> [--from <source>] [--digest sha256:<hex>] [--for-everyone]
kubectl gentian apps uninstall <app> --tenant <tenant> [--purge]
kubectl gentian apps approve <app> --tenant <tenant> what the app asks for that nobody has approved yet
kubectl gentian apps approve <app> <kind>/<name> --tenant <tenant> --reason "<why>" [--expires <RFC 3339>]
approve one request: egress (the tenant's perimeter approver),
podSecurity or clusterRoles (the cluster's security officer),
apiExtensions or a role that writes (break-glass)
kubectl gentian apps decline <app> <kind>/<name> --tenant <tenant> --reason "<why>"
decline one, with the same right; the app keeps waiting
kubectl gentian approvals list what awaits the security officer and the perimeter
approver, across all tenants: who answers, who asked,
when, why the app wants it, and what was declined
kubectl gentian approvals granted every tenant's approved privilege exceptions
kubectl gentian approvals cluster-roles [allow|disallow <profile> <role>]
the cluster roles the cluster permits, per profile
kubectl gentian exposures requests --tenant <tenant> what its apps ask to have on the internet, or to keep
of their own Authorization header behind sign-in
kubectl gentian exposures approve <app-instance> <entry> --tenant <tenant> [--expires <date>] [--reason <text>]
[--acknowledge-main-address-rule] [--yes]
kubectl gentian exposures list --tenant <tenant> what the tenant has on the internet
kubectl gentian exposures withdraw <app-instance> <entry> --tenant <tenant>
kubectl gentian exposures alias <app-instance> <entry> --tenant <tenant> (--host <name>.<cluster's domain> | --remove)
a second address for a published entry, directly under
the cluster's own domain; the cluster's administrator's
kubectl gentian resources plans --tenant <tenant>
kubectl gentian resources show --tenant <tenant>
kubectl gentian resources set --tenant <tenant> --plan <plan> [--force]
move a tenant; the cluster's administrator's
kubectl gentian resources report --tenant <tenant> --from <time> --to <time>
kubectl gentian resources report --all --from <time> --to <time>
every tenant's billed intervals
kubectl gentian resources catalog the cluster's plans, with the tenants on each
kubectl gentian resources catalog set <plan> --file <plan.json>
add or change a plan; the file is the plan as the
director takes it (displayName, tier, units, quotas, ...)
kubectl gentian resources catalog remove <plan> remove a plan no tenant is on
kubectl gentian resources ordering where a tenant orders another plan
kubectl gentian resources ordering set --file <notice.json> {"text": {"en": ...}, "url" | "email" | "phone": ...}
kubectl gentian resources ordering clear tenants are told to ask the cluster's administrator
kubectl gentian version