tctl service-account

tctl service-account token

Generate a new token that can be used to authenticate to TSB

Synopsis

Generate a new token that can be used to authenticate to TSB

This command generates a new token to authenticate to TSB as the service account. The command reads the private key from the specified file and uses it to sign the token. You can generate a new private key using the gen-key command.

tctl service-account token <name> --key-path <key file> [--expiration <expiration>] [flags]

Options

      --expiration duration   Expiration for the token (default 30m0s)
  -h, --help                  help for token
      --key-path string       Path to the file that contains the private key to use to generate the token

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
                                    specified via TCTL_CONFIG env variable. This flag
                                    takes precedence over the env variable.
      --debug                       Print debug messages for all requests and responses
      --disable-tctl-version-warn   If set, disable the outdated tctl version warning. Can also be
                                    specified via TCTL_DISABLE_VERSION_WARN env variable.
  -p, --profile string              Use specific profile (default "default")

tctl service-account revoke-key

Revoke the given key pairs for the given service account

Synopsis

Revoke the given key pairs for the given service account

Tokens signed by a revoked key stop being accepted, so this is the last step of a key rotation: revoke the old keys only once everything that signs tokens for the service account has moved over to the key that replaces them. Use the list-keys command to see which keys the service account still has and how long they have been there.

Repeat the id flag to revoke several keys at once.

A key the service account does not have is reported and ignored, so a command can be repeated if it fails part way through.

Revoking every key leaves the service account unable to authenticate to TSB until a key is added again, so it is refused unless the force flag is given. Forcing it is for taking a key out of use immediately, where the service account being unable to authenticate until a new key is installed is the point.

tctl service-account revoke-key <name> --id <key id> [--id <key id>]... [flags]

Options

      --force        Revoke the keys even if it leaves the service account with no keys at all
  -h, --help         help for revoke-key
      --id strings   ID of a key to revoke. Repeat the flag to revoke several keys

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
                                    specified via TCTL_CONFIG env variable. This flag
                                    takes precedence over the env variable.
      --debug                       Print debug messages for all requests and responses
      --disable-tctl-version-warn   If set, disable the outdated tctl version warning. Can also be
                                    specified via TCTL_DISABLE_VERSION_WARN env variable.
  -p, --profile string              Use specific profile (default "default")

tctl service-account list-keys

List the keys of the given service account

Synopsis

List the keys of the given service account

The service account accepts tokens signed by any of the keys listed here, so while its keys are being rotated this shows whether the new key is in place and how long the key it replaces has been around, before revoking that one with the revoke-key command.

Keys added before TSB started recording when a key was added have no age.

tctl service-account list-keys <name> [flags]

Options

  -h, --help                 help for list-keys
  -o, --output-type string   Response output type: table, yaml, json (default "table")

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
                                    specified via TCTL_CONFIG env variable. This flag
                                    takes precedence over the env variable.
      --debug                       Print debug messages for all requests and responses
      --disable-tctl-version-warn   If set, disable the outdated tctl version warning. Can also be
                                    specified via TCTL_DISABLE_VERSION_WARN env variable.
  -p, --profile string              Use specific profile (default "default")

tctl service-account get

Get one or multiple service accounts

tctl service-account get [<name>] [flags]

Options

  -h, --help                 help for get
  -o, --output-type string   Response output type: table, yaml, json (default "table")

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
                                    specified via TCTL_CONFIG env variable. This flag
                                    takes precedence over the env variable.
      --debug                       Print debug messages for all requests and responses
      --disable-tctl-version-warn   If set, disable the outdated tctl version warning. Can also be
                                    specified via TCTL_DISABLE_VERSION_WARN env variable.
  -p, --profile string              Use specific profile (default "default")

tctl service-account gen-key

Generate a new key pair for the given service account

Synopsis

Generate a new key pair for the given service account

This command generates a new key pair for the service account and prints the generated private key to the standard output.

The key private key should be stored securely, as it cannot be retrieved again and it is required if you want to generate authentication tokens for the service account.

The keys the service account already had keep working: it accepts tokens signed by any of its keys until each one is revoked with the revoke-key command.

tctl service-account gen-key <name> [flags]

Options

  -h, --help   help for gen-key

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
                                    specified via TCTL_CONFIG env variable. This flag
                                    takes precedence over the env variable.
      --debug                       Print debug messages for all requests and responses
      --disable-tctl-version-warn   If set, disable the outdated tctl version warning. Can also be
                                    specified via TCTL_DISABLE_VERSION_WARN env variable.
  -p, --profile string              Use specific profile (default "default")

tctl service-account delete

Deletes a service account

Synopsis

Deletes a service account and all its keys

tctl service-account delete <name> [flags]

Options

  -h, --help   help for delete

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
                                    specified via TCTL_CONFIG env variable. This flag
                                    takes precedence over the env variable.
      --debug                       Print debug messages for all requests and responses
      --disable-tctl-version-warn   If set, disable the outdated tctl version warning. Can also be
                                    specified via TCTL_DISABLE_VERSION_WARN env variable.
  -p, --profile string              Use specific profile (default "default")

tctl service-account create

Creates a new service account

Synopsis

Creates a new service account

This command creates a new service account with a new key pair and prints the generated private key to the standard output.

The private key should be stored securely, as it cannot be retrieved again and it is required if you want to generate authentication tokens for the service account.

Pass a public key with the key-path flag to create the service account with a key pair that you generated yourself. TSB then generates no key of its own, the private key never leaves this machine, and the command prints the ID the key was stored under instead of a private key.

tctl service-account create <name> [--key-path <key file>] [flags]

Options

  -h, --help              help for create
      --key-path string   Path to the file that contains a public key, in JWK format, to create the service account with instead of having TSB generate a key pair

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
                                    specified via TCTL_CONFIG env variable. This flag
                                    takes precedence over the env variable.
      --debug                       Print debug messages for all requests and responses
      --disable-tctl-version-warn   If set, disable the outdated tctl version warning. Can also be
                                    specified via TCTL_DISABLE_VERSION_WARN env variable.
  -p, --profile string              Use specific profile (default "default")

tctl service-account add-key

Add an existing public key to the given service account

Synopsis

Add an existing public key to the given service account

This command registers a key pair that you generated yourself, instead of having TSB generate one with the gen-key command. Only the public key is sent to TSB, and it must be in JWK format; the private key stays on this machine and is what you use to generate authentication tokens for the service account.

The command prints the ID that TSB stored the key under, which is the key ID to use when generating tokens with it.

The keys the service account already had keep working: it accepts tokens signed by any of its keys until each one is revoked with the revoke-key command.

tctl service-account add-key <name> --key-path <key file> [flags]

Options

  -h, --help              help for add-key
      --key-path string   Path to the file that contains the public key to add, in JWK format

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
                                    specified via TCTL_CONFIG env variable. This flag
                                    takes precedence over the env variable.
      --debug                       Print debug messages for all requests and responses
      --disable-tctl-version-warn   If set, disable the outdated tctl version warning. Can also be
                                    specified via TCTL_DISABLE_VERSION_WARN env variable.
  -p, --profile string              Use specific profile (default "default")

tctl service-account

Commands to manage TSB service accounts

Options

  -h, --help   help for service-account

Options inherited from parent commands

  -c, --config string               Path to the config file to use. Can also be
                                    specified via TCTL_CONFIG env variable. This flag
                                    takes precedence over the env variable.
      --debug                       Print debug messages for all requests and responses
      --disable-tctl-version-warn   If set, disable the outdated tctl version warning. Can also be
                                    specified via TCTL_DISABLE_VERSION_WARN env variable.
  -p, --profile string              Use specific profile (default "default")