mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-21 05:55:42 +08:00
Dan Share
5bddb36c65
* [Browser MFA] Add documentation * Address comments * Add browser to env vars * Address feedback * feedback * Address comments
2515 lines
64 KiB
Plaintext
2515 lines
64 KiB
Plaintext
---
|
|
title: tctl Reference
|
|
description: Provides a comprehensive list of commands, arguments, and flags for tctl.
|
|
sidebar_label: tctl
|
|
tags:
|
|
- reference
|
|
- platform-wide
|
|
---
|
|
{/*GENERATED FILE. DO NOT EDIT.*/}
|
|
{/*To generate, run: make cli-docs-tctl*/}
|
|
{/*vale messaging = NO*/}
|
|
|
|
This guide provides a comprehensive list of commands, arguments, and flags for
|
|
tctl.
|
|
|
|
`tctl` is a CLI tool that allows a cluster administrator to manage all resources
|
|
in a cluster, including nodes, users, tokens, certificates, and devices.
|
|
|
|
`tctl` can also be used to modify the dynamic configuration of the cluster,
|
|
such as creating new user roles or connecting to trusted clusters.
|
|
|
|
For a conceptual overview of `tctl`, see [Getting Started with
|
|
`tctl`](../../zero-trust-access/infrastructure-as-code/using-tctl.mdx).
|
|
|
|
```code
|
|
$ tctl [<flags>] <command> [<args> ...]
|
|
```
|
|
|
|
Global flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--auth-server`|none|Attempts to connect to specific auth/proxy address(es) instead of local auth \[127.0.0.1:3025\]|
|
|
|`-c`, `--config`|none|Path to a configuration file \[/etc/teleport.yaml\] for an Auth Service instance. Can also be set via the TELEPORT_CONFIG_FILE environment variable. Ignored if the auth_service is disabled.|
|
|
|`-d`, `--[no-]debug`|`false`|Enable verbose logging to stderr|
|
|
|`-i`, `--identity`|none|Path to an identity file. Must be provided to make remote connections to auth. An identity file can be exported with 'tctl auth sign'|
|
|
|`--[no-]insecure`|`false`|When specifying a proxy address in --auth-server, do not verify its TLS certificate. Danger: any data you send can be intercepted or modified by an attacker.|
|
|
|`--mfa-mode`|`auto`|Preferred mode for MFA assertions (auto, cross-platform, platform, sso, browser).|
|
|
|
|
Global environment variables:
|
|
|
|
|Variable|Default|Description|
|
|
|---|---|---|
|
|
|`TELEPORT_AUTH_SERVER`|none|Attempts to connect to specific auth/proxy address(es) instead of local auth [127.0.0.1:3025]|
|
|
|`TELEPORT_IDENTITY_FILE`|none|Path to an identity file. Must be provided to make remote connections to auth. An identity file can be exported with 'tctl auth sign'|
|
|
|`TELEPORT_MFA_MODE`|`auto`|Preferred mode for MFA assertions (auto, cross-platform, platform, sso, browser).|
|
|
|
|
## tctl acl get
|
|
|
|
Get detailed information for an Access List.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl acl get [<flags>] <access-list-name>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`yaml`|Output format, 'yaml', 'json', or 'text'|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|access-list-name|none (required)|The Access List name.|
|
|
|
|
## tctl acl ls
|
|
|
|
List cluster Access Lists.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl acl ls [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`yaml`|Output format, 'yaml', 'json', or 'text'|
|
|
|`--[no-]review-only`|`false`|List only access lists that are due for review within the next 2 weeks or past due|
|
|
|
|
## tctl acl reviews create
|
|
|
|
Submit a new review for a given access list.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl acl reviews create [<flags>] <access-list-name>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--notes`|none|Optional review notes.|
|
|
|`--remove-members`|none|Comma-separated list of members to remove as part of this review.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|access-list-name|none (required)|The access list name to submit review for.|
|
|
|
|
## tctl acl reviews ls
|
|
|
|
List past audit history for a given access list.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl acl reviews ls [<flags>] <access-list-name>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format 'yaml', 'json', or 'text'|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|access-list-name|none (required)|The access list name to fetch review history for.|
|
|
|
|
## tctl acl users add
|
|
|
|
Add a user to an Access List.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl acl users add [<flags>] <access-list-name> <user> [<expires>] [<reason>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--kind`|`user`|Access list member kind, 'user' or 'list'|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|access-list-name|none (required)|The Access List name.|
|
|
|expires|none (optional)|When the user's access expires (must be in RFC3339). Defaults to the expiration time of the Access List.|
|
|
|reason|none (optional)|The reason the user has been added to the Access List. Defaults to empty.|
|
|
|user|none (required)|The user to add to the Access List.|
|
|
|
|
## tctl acl users ls
|
|
|
|
List users that are members of an Access List.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl acl users ls [<flags>] <access-list-name>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format 'json', or 'text'|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|access-list-name|none (required)|The Access List name.|
|
|
|
|
## tctl acl users rm
|
|
|
|
Remove a user from an Access List.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl acl users rm <access-list-name> <user>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|access-list-name|none (required)|The Access List name.|
|
|
|user|none (required)|The user to remove from the Access List.|
|
|
|
|
## tctl alerts ack
|
|
|
|
Acknowledge cluster alerts.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl alerts ack [<flags>] <id>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'text', 'json', or 'yaml'|
|
|
|`--[no-]clear`|`false`|Clear the acknowledgment for the cluster alert.|
|
|
|`--reason`|none|The reason for acknowledging the cluster alert.|
|
|
|`--ttl`|none|Time duration to acknowledge the cluster alert for.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|id|none (required)|The cluster alert ID.|
|
|
|
|
## tctl alerts ack ls
|
|
|
|
List acknowledged cluster alerts.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl alerts ack ls
|
|
```
|
|
|
|
## tctl alerts create
|
|
|
|
Create cluster alerts.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl alerts create [<flags>] <message>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--labels`|none|List of labels to attach to the alert. For example: key1=value1,key2=value2.|
|
|
|`--severity`|`low`|Severity of the alert (low, medium, or high).|
|
|
|`--ttl`|none|Time duration after which the alert expires (default 24h).|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|message|none (required)|Alert body message.|
|
|
|
|
## tctl alerts delete
|
|
|
|
Deletes a cluster alert.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl alerts delete <id>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|id|none (required)|The cluster alert ID.|
|
|
|
|
## tctl alerts list
|
|
|
|
List cluster alerts.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl alerts list [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'text', 'json', or 'yaml'|
|
|
|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)|
|
|
|`-v`, `--[no-]verbose`|`false`|Show detailed alert info, including acknowledged alerts.|
|
|
|
|
## tctl apps ls
|
|
|
|
List all applications registered with the cluster.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl apps ls [<flags>] [<labels>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'text', 'json', or 'yaml'|
|
|
|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')|
|
|
|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")|
|
|
|`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)|
|
|
|
|
## tctl audit query create
|
|
|
|
Create an audit query.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl audit query create [<flags>] [<query>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--name`|none|Audit query name|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|query|none (optional)|SQL Query|
|
|
|
|
## tctl audit query exec
|
|
|
|
Execute audit query.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl audit query exec [<query>]
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|query|none (optional)|SQL Query|
|
|
|
|
## tctl audit query get
|
|
|
|
Get audit query.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl audit query get <name>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (required)|name of the audit query|
|
|
|
|
## tctl audit query ls
|
|
|
|
List audit queries.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl audit query ls
|
|
```
|
|
|
|
## tctl audit query rm
|
|
|
|
Remove audit query.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl audit query rm <name>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (required)|name of the audit query|
|
|
|
|
## tctl audit report get
|
|
|
|
Get security report.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl audit report get <name>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (required)|security name|
|
|
|
|
## tctl audit report ls
|
|
|
|
List security reports.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl audit report ls
|
|
```
|
|
|
|
## tctl audit report run
|
|
|
|
Run the security report.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl audit report run <name>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (required)|security report name|
|
|
|
|
## tctl audit report state
|
|
|
|
Print the state of the security report.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl audit report state <name>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (required)|security report name|
|
|
|
|
## tctl audit schema
|
|
|
|
Print audit query schema.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl audit schema
|
|
```
|
|
|
|
## tctl auth crl
|
|
|
|
Export empty certificate revocation list (CRL) for Teleport certificate
|
|
authorities.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl auth crl --type=TYPE [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--out`|none|If set, writes exported revocation lists to files with the given path prefix|
|
|
|`--type`|none|Certificate authority type, one of: host, db, db_client, user|
|
|
|
|
## tctl auth export
|
|
|
|
Export public cluster CA certificates to stdout.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl auth export [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--compat`|none|export certificates compatible with specific version of Teleport|
|
|
|`--fingerprint`|none|filter authority by fingerprint|
|
|
|`--integration`|none|Name of the integration. Only applies to "github" CAs.|
|
|
|`--[no-]keys`|`false`|if set, will print private keys|
|
|
|`--out`|none|If set writes exported authorities to files with the given path prefix|
|
|
|`--type`|none|export certificate type (user, host, tls-host, tls-user, tls-user-der, tls-spiffe, windows, db, db-der, db-client, db-client-der, openssh, saml-idp, github, awsra)|
|
|
|
|
## tctl auth ls
|
|
|
|
List connected auth servers.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl auth ls [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`yaml`|Output format: 'yaml', 'json' or 'text'|
|
|
|
|
## tctl auth rotate
|
|
|
|
Rotate certificate authorities in the cluster. Starts in interactive mode by
|
|
default, provide --type to manually send rotation requests.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl auth rotate [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--grace-period`|`30h0m0s`|Grace period keeps previous certificate authorities signatures valid, if set to 0 will force users to re-login and nodes to re-register.|
|
|
|`--[no-]interactive`|`false`|Enable interactive mode|
|
|
|`--[no-]manual`|`false`|Activate manual rotation, set rotation phases manually|
|
|
|`--phase`|none|Target rotation phase to set, used in manual rotation, one of: init, standby, update_clients, update_servers, rollback|
|
|
|`--type`|none|Certificate authority to rotate, one of: host, windows, user, db, db_client, openssh, jwt, saml_idp, oidc_idp, spiffe, okta, awsra, bound_keypair|
|
|
|
|
## tctl auth sign
|
|
|
|
Create an identity file(s) for a given user.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl auth sign --out=OUT [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--app-name`|none|Application to generate identity file for. Mutually exclusive with "--db-service".|
|
|
|`--compat`|none|OpenSSH compatibility flag|
|
|
|`--db-name`|none|Database name placed on the identity file. Only used when "--db-service" is set.|
|
|
|`--db-service`|none|Database to generate identity file for. Mutually exclusive with "--app-name".|
|
|
|`--db-user`|none|Database user placed on the identity file. Only used when "--db-service" is set.|
|
|
|`--format`|`file`|Identity format: file, openssh, tls, kubernetes, db, windows, mongodb, cockroachdb, redis, snowflake, elasticsearch, cassandra, scylla, oracle. file is the default.|
|
|
|`--host`|none|Teleport host name|
|
|
|`--kube-cluster-name`|none|Kubernetes cluster to generate identity file for when --format is set to "kubernetes"|
|
|
|`--leaf-cluster`|none|Leaf cluster to generate identity file for when --format is set to "kubernetes"|
|
|
|`--[no-]omit-cdp`|`false`|Omit CRL Distribution Points from the cert. Only used when --format is set to "windows"|
|
|
|`--[no-]overwrite`|`false`|Whether to overwrite existing destination files. When not set, user will be prompted before overwriting any existing file.|
|
|
|`--[no-]tar`|`false`|Create a tarball of the resulting certificates and stream to stdout.|
|
|
|`-o`, `--out`|none|Identity output|
|
|
|`--proxy`|none|Address of the Teleport proxy. When --format is set to "kubernetes", this address will be set as cluster address in the generated kubeconfig file|
|
|
|`--ttl`|`12h0m0s`|TTL (time to live) for the generated certificate.|
|
|
|`--user`|none|Teleport user name|
|
|
|`--windows-domain`|none|Active Directory domain for which this cert is valid. Only used when --format is set to "windows"|
|
|
|`--windows-pki-domain`|none|Active Directory domain where CRLs will be located. Only used when --format is set to "windows"|
|
|
|`--windows-sid`|none|Optional Security Identifier to embed in the certificate. Only used when --format is set to "windows"|
|
|
|`--windows-user`|none|Window user placed on the identity file. Only used when --format is set to "windows"|
|
|
|
|
## tctl autoupdate agents mark-done
|
|
|
|
Marks one or many groups as done updating.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl autoupdate agents mark-done [<groups>...]
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|groups|none (optional)|Groups to mark as done updating.|
|
|
|
|
## tctl autoupdate agents report
|
|
|
|
Aggregates the agent autoupdate reports and displays agent count per version and
|
|
per update group.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl autoupdate agents report
|
|
```
|
|
|
|
## tctl autoupdate agents rollback
|
|
|
|
Rolls back one or many groups.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl autoupdate agents rollback [<groups>...]
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|groups|none (optional)|Groups to rollback. When empty, every group already started is rolled back.|
|
|
|
|
## tctl autoupdate agents start-update
|
|
|
|
Starts updating one or many groups.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl autoupdate agents start-update [<flags>] [<groups>...]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--[no-]force`|`false`|Skips progressive deployment mechanism such as canaries or backpressure.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|groups|none (optional)|Groups to start updating.|
|
|
|
|
## tctl autoupdate agents status
|
|
|
|
Prints agents auto update status.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl autoupdate agents status
|
|
```
|
|
|
|
## tctl autoupdate client-tools disable
|
|
|
|
Disables client tools auto updates. Clients will not be told to update to the
|
|
target version.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl autoupdate client-tools disable
|
|
```
|
|
|
|
## tctl autoupdate client-tools enable
|
|
|
|
Enables client tools auto updates. Clients will be told to update to the target
|
|
version.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl autoupdate client-tools enable
|
|
```
|
|
|
|
## tctl autoupdate client-tools status
|
|
|
|
Prints if the client tools updates are enabled/disabled, and the target version
|
|
in specified format.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl autoupdate client-tools status [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`yaml`|Output format: 'yaml' or 'json'|
|
|
|`--proxy`|none|Address of the Teleport proxy. When defined this address will be used to retrieve client tools auto update configuration.|
|
|
|
|
## tctl autoupdate client-tools target
|
|
|
|
Sets the client tools target version. This command is not supported on Teleport
|
|
Cloud.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl autoupdate client-tools target [<flags>] [<version>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--[no-]clear`|`false`|Removes the target version, Teleport will default to its current proxy version.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|version|none (optional)|Client tools target version. Clients will be told to update to this version.|
|
|
|
|
## tctl bots add
|
|
|
|
Add a new bot to the cluster.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl bots add [<flags>] <name>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, one of: text, json|
|
|
|`--initial-public-key`|none|If set, use the given initial public key in SSH authorized_keys format, instead of generating a registration secret. The value must be quoted. Not compatible with --token or --legacy.|
|
|
|`--logins`|none|List of allowed SSH logins for the bot user|
|
|
|`--max-session-ttl`|none|Set a max session TTL for the bot's internal identity. 12h default, 168h maximum.|
|
|
|`--[no-]legacy`|`false`|If set, generate a legacy joining token instead of a bound keypair token. No effect if --token is set.|
|
|
|`--recovery-limit`|none|Overrides the recovery limit (default: 1) for the bound keypair token. No effect if --token or --legacy is set, or if --recovery-mode is not standard. Must be greater than 1.|
|
|
|`--recovery-mode`|`standard`|If set, overrides the recovery mode for the bound keypair token. No effect if --token or --legacy is set.|
|
|
|`--registration-secret`|none|Sets a registration secret for the bound keypair token. If not set, one will be randomly generated. No effect if --initial-public-key, --token, or --legacy is set. |
|
|
|`--roles`|none|Roles the bot is able to assume.|
|
|
|`--token`|none|The token to use, if any. If unset, a new single-use token will be created.|
|
|
|`--ttl`|`1h0m0s`|TTL for the bot join token. For standard bound keypair tokens, this sets must_register_before; for legacy tokens, this sets the resource TTL.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (required)|A name to uniquely identify this bot in the cluster.|
|
|
|
|
## tctl bots instances add
|
|
|
|
Join a new instance onto an existing bot.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl bots instances add [<flags>] <name>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, one of: text, json|
|
|
|`--initial-public-key`|none|If set, use the given initial public key in SSH authorized_keys format, instead of generating a registration secret. The value must be quoted. Not compatible with --token or --legacy.|
|
|
|`--[no-]legacy`|`false`|If set, generate a legacy joining token instead of a bound keypair token. No effect if --token is set.|
|
|
|`--recovery-limit`|none|Overrides the recovery limit (default: 1) for the bound keypair token. No effect if --token or --legacy is set, or if --recovery-mode is not standard. Must be greater than 1.|
|
|
|`--recovery-mode`|`standard`|If set, overrides the recovery mode for the bound keypair token. No effect if --token or --legacy is set.|
|
|
|`--registration-secret`|none|Sets a registration secret for the bound keypair token. If not set, one will be randomly generated. No effect if --initial-public-key, --token, or --legacy is set. |
|
|
|`--token`|none|The token to use, if any. If unset, a new single-use token will be created.|
|
|
|`--ttl`|`1h0m0s`|TTL for the bot join token. For standard bound keypair tokens, this sets must_register_before; for legacy tokens, this sets the resource TTL.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (required)|The name of the existing bot for which to add a new instance.|
|
|
|
|
## tctl bots instances list
|
|
|
|
List bot instances.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl bots instances list [<flags>] [<name>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'text' or 'json'|
|
|
|`--query`|none|An expression in the Teleport predicate language used to filter bot instances|
|
|
|`--search`|none|Fuzzy search query used to filter bot instances|
|
|
|`--sort-index`|`bot_name`|Request sort index, 'bot_name', 'active_at_latest', 'version_latest' or 'host_name_latest'|
|
|
|`--sort-order`|`ascending`|Request sort order, 'ascending' or 'descending'|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (optional)|The name of the bot from which to list instances. If unset, lists instances from all bots.|
|
|
|
|
## tctl bots instances show
|
|
|
|
Shows information about a specific bot instance.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl bots instances show <id>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|id|none (required)|The full ID of the bot instance, in the form of \[bot name\]/\[uuid\]|
|
|
|
|
## tctl bots ls
|
|
|
|
List all certificate renewal bots registered with the cluster.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl bots ls
|
|
```
|
|
|
|
## tctl bots rm
|
|
|
|
Permanently remove a certificate renewal bot from the cluster.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl bots rm <name>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (required)|Name of an existing bot to remove.|
|
|
|
|
## tctl bots update
|
|
|
|
Update an existing bot.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl bots update [<flags>] <name>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--add-logins`|none|Adds a comma-separated list of logins to an existing bot.|
|
|
|`--add-roles`|none|Adds a comma-separated list of roles to an existing bot.|
|
|
|`--set-logins`|none|Sets the bot's logins to the given comma-separated list, replacing any existing logins.|
|
|
|`--set-max-session-ttl`|none|Sets the max session TTL. 168h maximum.|
|
|
|`--set-roles`|none|Sets the bot's roles to the given comma-separated list, replacing any existing roles.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (required)|Name of an existing bot to update.|
|
|
|
|
## tctl bound-keypair request-rotation
|
|
|
|
Request a keypair rotation on the next join attempt.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl bound-keypair request-rotation <name>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (required)|The name of the token|
|
|
|
|
## tctl create
|
|
|
|
Create or update a Teleport resource from a YAML file.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl create [<flags>] [<filename>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`-f`, `--[no-]force`|`false`|Overwrite the resource if already exists|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|filename|none (optional)|resource definition file, empty for stdin|
|
|
|
|
## tctl db ls
|
|
|
|
List all databases registered with the cluster.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl db ls [<flags>] [<labels>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'text', 'json', or 'yaml'|
|
|
|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')|
|
|
|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")|
|
|
|`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)|
|
|
|
|
## tctl desktop bootstrap
|
|
|
|
Generate a PowerShell script to bootstrap Active Directory.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl desktop bootstrap
|
|
```
|
|
|
|
## tctl desktop ls
|
|
|
|
List all desktops registered with the cluster.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl desktop ls [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'text', 'json' or 'yaml'|
|
|
|`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output|
|
|
|
|
## tctl devices add
|
|
|
|
Register managed devices.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl devices add [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--asset-tag`|none|Inventory identifier for the device (e.g., Mac serial number)|
|
|
|`--enroll-ttl`|none|Time duration for the enrollment token|
|
|
|`--format`|`text`|Output format, 'text', 'json', or 'yaml'|
|
|
|`--[no-]current-device`|`false`|Registers the current device. Overrides --os and --asset-tag.|
|
|
|`--[no-]enroll`|`false`|If set, creates a device enrollment token|
|
|
|`--os`|none|Operating system|
|
|
|
|
## tctl devices enroll
|
|
|
|
Creates a new device enrollment token.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl devices enroll [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--asset-tag`|none|Inventory identifier for the device|
|
|
|`--device-id`|none|Device identifier|
|
|
|`--[no-]current-device`|`false`|Enrolls the current device. Overrides --device-id and --asset-tag.|
|
|
|`--ttl`|none|Time duration for the enrollment token|
|
|
|
|
## tctl devices lock
|
|
|
|
Locks a device.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl devices lock [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--asset-tag`|none|Inventory identifier for the device|
|
|
|`--device-id`|none|Device identifier|
|
|
|`--expires`|none|Time point (RFC3339) when the lock expires|
|
|
|`--message`|none|Message to display to locked-out users|
|
|
|`--[no-]current-device`|`false`|Locks the current device. Overrides --device-id and --asset-tag.|
|
|
|`--ttl`|none|Time duration after which the lock expires|
|
|
|
|
## tctl devices ls
|
|
|
|
Lists managed devices.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl devices ls [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'text', 'json', or 'yaml'|
|
|
|
|
## tctl devices rm
|
|
|
|
Removes a managed device.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl devices rm [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--asset-tag`|none|Inventory identifier for the device|
|
|
|`--device-id`|none|Device identifier|
|
|
|`--[no-]current-device`|`false`|Removes the current device. Overrides --device-id and --asset-tag.|
|
|
|
|
## tctl edit
|
|
|
|
Edit a Teleport resource.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl edit [<resource type/resource name>]
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|resource type/resource name|none (optional)|Resource to update, e.g., "user/myuser"|
|
|
|
|
## tctl get
|
|
|
|
Print a YAML declaration of various Teleport resources.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl get [<flags>] <resources>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`yaml`|Output format: 'yaml', 'json' or 'text'|
|
|
|`--[no-]with-secrets`|`false`|Include secrets in resources like certificate authorities or OIDC connectors|
|
|
|`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|resources|none (required)|Resource spec: 'type/\[name\]\[,...\]' or 'all'|
|
|
|
|
## tctl help
|
|
|
|
Show help.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl help [<command>...]
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|command|none (optional)|Show help on command.|
|
|
|
|
## tctl idp saml test-attribute-mapping
|
|
|
|
Test expression evaluation of attribute mapping.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl idp saml test-attribute-mapping --users=USERS --sp=SP [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|none|output format, 'yaml' or 'json'|
|
|
|`--sp`|none|name of a file containing service provider spec|
|
|
|`-u`, `--users`|none|username or name of a file containing user spec|
|
|
|
|
## tctl inventory list
|
|
|
|
List Teleport instance inventory.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl inventory list [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--exact-version`|none|Filter output by teleport version|
|
|
|`--format`|`text`|Output format, 'text' or 'json'|
|
|
|`--newer-than`|none|Filter for newer teleport versions|
|
|
|`--older-than`|none|Filter for older teleport versions|
|
|
|`--services`|none|Filter output by service (node,kube,proxy,etc)|
|
|
|`--update-group`|none|Filter output by update group|
|
|
|`--upgrader`|none|Filter output by upgrader (kube,unit,none)|
|
|
|
|
## tctl inventory ping
|
|
|
|
Ping locally connected instance.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl inventory ping <server-id>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|server-id|none (required)|ID of target server|
|
|
|
|
## tctl inventory status
|
|
|
|
Show inventory status summary.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl inventory status [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'text' or 'json'|
|
|
|`--[no-]connected`|`false`|Show locally connected instances summary|
|
|
|
|
## tctl kube ls
|
|
|
|
List all Kubernetes clusters registered with the cluster.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl kube ls [<flags>] [<labels>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'text', 'json', or 'yaml'|
|
|
|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')|
|
|
|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")|
|
|
|`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)|
|
|
|
|
## tctl list-kinds
|
|
|
|
Lists all resource kinds supported by this tctl version.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl list-kinds [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--[no-]wide`|`false`|Do not truncate the Description column, even if it exceeds terminal width|
|
|
|
|
## tctl lock
|
|
|
|
Create a new lock.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl lock [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--access-request`|none|UUID of an Access Request to disable.|
|
|
|`--bot-instance-id`|none|UUID of a bot instance to disable|
|
|
|`--device`|none|UUID of a trusted device to disable.|
|
|
|`--expires`|none|Time point (RFC3339) when the lock expires.|
|
|
|`--join-token`|none|Bot join token name to disable|
|
|
|`--login`|none|Name of a local UNIX user to disable.|
|
|
|`--message`|none|Message to display to locked-out users.|
|
|
|`--mfa-device`|none|UUID of a user MFA device to disable.|
|
|
|`--role`|none|Name of a Teleport role to disable.|
|
|
|`--server-id`|none|UUID of a Teleport server to disable.|
|
|
|`--ttl`|none|Time duration after which the lock expires.|
|
|
|`--user`|none|Name of a Teleport user to disable.|
|
|
|`--windows-desktop`|none|Name of a Windows desktop to disable.|
|
|
|
|
## tctl login_rule test
|
|
|
|
Test the parsing and evaluation of login rules.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl login_rule test [<flags>] [<traits-file>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`yaml`|Output format: 'yaml' or 'json'|
|
|
|`--[no-]load-from-cluster`|`false`|load existing login rules from the connected Teleport cluster|
|
|
|`--resource-file`|none|login rule resource file name (YAML or JSON)|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|traits-file|none (optional)|input user traits file name (YAML or JSON), empty for stdin|
|
|
|
|
## tctl nodes add
|
|
|
|
Generate a node invitation token.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl nodes add [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--roles`|`node`|Comma-separated list of roles for the new node to assume \[node\]|
|
|
|`--token`|none|Override the default random generated token with a specified value|
|
|
|`--ttl`|`30m0s`|Time to live for a generated token|
|
|
|
|
## tctl nodes ls
|
|
|
|
List all active SSH nodes within the cluster.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl nodes ls [<flags>] [<labels>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'text', or 'yaml'|
|
|
|`--query`|none|Query by predicate language enclosed in single quotes. Supports ==, !=, &&, and \|\| (e.g. --query='labels\["key1"\] == "value1" && labels\["key2"\] != "value2"')|
|
|
|`--search`|none|List of comma separated search keywords or phrases enclosed in quotations (e.g. --search=foo,bar,"some phrase")|
|
|
|`-v`, `--[no-]verbose`|`false`|Verbose table output, shows full label output|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|labels|none (optional)|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)|
|
|
|
|
## tctl notifications create
|
|
|
|
Create a cluster notification.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl notifications create --title=TITLE --content=CONTENT [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--content`|none|Set the notification's content.|
|
|
|`--labels`|none|List of labels to attach to the notification. For example: key1=value1,key2=value2.|
|
|
|`--[no-]require-all-roles`|`false`|Set whether this notification should target users who have all of the provided roles.|
|
|
|`--[no-]warning`|`false`|Set whether this notification is a warning notification.|
|
|
|`--roles`|none|Target a specific set of roles. By default, this will target all users with any of the provided roles, use --require-all-roles to exclusively target users with all of them.|
|
|
|`-t`, `--title`|none|Set the notification's title.|
|
|
|`--ttl`|`30d`|Time duration after which the notification expires (default 30 days).|
|
|
|`--user`|none|Target a specific user.|
|
|
|
|
## tctl notifications ls
|
|
|
|
List notifications which were manually created using `tctl notifications
|
|
create`. By default, this will list notifications capable of targeting multiple
|
|
users, such as role-based ones. To list notifications directed only at a
|
|
specific user, use the --user flag. To include notifications generated by
|
|
Teleport, use --all.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl notifications ls [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'yaml', 'json', or 'text'|
|
|
|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)|
|
|
|`--[no-]all`|`false`|Set whether all notifications should be included, including those generated by Teleport, as opposed to solely those created using `tctl notifications create`.|
|
|
|`--user`|none|Set which user to list user-specific notifications for, or leave empty to list your own.|
|
|
|
|
## tctl notifications rm
|
|
|
|
Remove a cluster notification.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl notifications rm [<flags>] <id>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--user`|none|The user the notification to remove belongs to, if any.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|id|none (required)|The ID of the notification to remove.|
|
|
|
|
## tctl plugins cleanup
|
|
|
|
Cleans up the given plugin type.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl plugins cleanup [<flags>] <type>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--[no-]dry-run`|`true`|Dry run the cleanup command. Dry run defaults to on.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|type|none (required)|The type of plugin to clean up. Only supports Okta at present.|
|
|
|
|
## tctl plugins delete
|
|
|
|
Remove a plugin instance.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl plugins delete [<name>]
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (optional)|The name of the SCIM plugin resource to delete|
|
|
|
|
## tctl plugins edit awsic
|
|
|
|
Edit an AWS IAM Identity Center integration's settings.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl plugins edit awsic [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--plugin-name`|`aws-identity-center`|Name of the AWS Identity Center integration instance to update. Defaults to aws-identity-center.|
|
|
|`--roles-sync-mode`|none|Control account-assignment role creation. ALL creates roles for all possible account assignments. NONE creates no roles, and also implies a totally-exclusive group import filter.|
|
|
|
|
## tctl plugins install awsic
|
|
|
|
Install an AWS IAM Identity Center integration.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl plugins install awsic --access-list-default-owner=ACCESS-LIST-DEFAULT-OWNER --scim-url=SCIM-URL --scim-token=SCIM-TOKEN --instance-region=INSTANCE-REGION --instance-arn=INSTANCE-ARN [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--access-list-default-owner`|none|Teleport user to set as default owner for the imported Access Lists. Multiple flags allowed.|
|
|
|`--account-id`|none|Add AWS Account to account import list by ID. All AWS accounts will be imported if no items are added to account import list.|
|
|
|`--account-name`|none|Add AWS Account to account import list by name. Can be a glob, or enclosed in ^$ to specify a regular expression. All AWS accounts will be imported if no items are added to account import list.|
|
|
|`--assume-role-arn`|none|ARN of a role that the system credential should assume.|
|
|
|`--exclude-account-id`|none|Exclude AWS account from import list by ID.|
|
|
|`--exclude-account-name`|none|Exclude AWS account from import list by name. Can be a glob or a regular expression (enclosed in ^$).|
|
|
|`--exclude-group-name`|none|Exclude AWS group from import list by name. Can be a glob or a regular expression (enclosed in ^$).|
|
|
|`--group-name`|none|Add AWS group to group import list by name. Can be a glob, or enclosed in ^$ to specify a regular expression. If no filters are supplied then all AWS groups will be imported.|
|
|
|`--instance-arn`|none|AWS Identity center instance ARN|
|
|
|`--instance-region`|none|AWS Identity Center instance region|
|
|
|`--[no-]force-scim-url`|`false`|Use the provided SCIM provisioning endpoint even if it fails scim endpoint validation|
|
|
|`--[no-]use-system-credentials`|`true`|Uses system credentials instead of OIDC.|
|
|
|`--oidc-integration`|none|Name of the Teleport OIDC integration to use when authenticating with AWS. Must be supplied when --no-use-system-credentials is set.|
|
|
|`--roles-sync-mode`|`ALL`|Control account-assignment role creation. ALL creates Teleport Roles for all possible account assignments. NONE creates no Teleport Roles, and also implies a totally-exclusive group import filter.|
|
|
|`--scim-token`|none|AWS Identify Center SCIM provisioning token.|
|
|
|`--scim-url`|none|AWS Identity Center SCIM provisioning endpoint|
|
|
|`--user-label`|none|Add user label filter, in the form of a comma-separated list of "name=value" pairs. If no label filters are supplied, all Teleport users will be provisioned to Identity Center|
|
|
|`--user-origin`|none|Shorthand for "--user-label teleport.dev/origin=ORIGIN"|
|
|
|
|
## tctl plugins install entraid
|
|
|
|
Install an Microsoft Entra ID integration.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl plugins install entraid --default-owner=DEFAULT-OWNER [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--access-list-owners-source`|`plugin`|Source of the Access List owners.|
|
|
|`--auth-connector-name`|`entra-id-default`|Name of the SAML connector resource to create|
|
|
|`--default-owner`|none|List of Teleport users that are default owners for the imported Access Lists. Multiple flags allowed.|
|
|
|`--exclude-group-id`|none|Exclude group matching the specified group ID.|
|
|
|`--exclude-group-name`|none|Exclude groups matching the specified group name regex.|
|
|
|`-f`, `--[no-]force`|`false`|Proceed with installation even if plugin already exists.|
|
|
|`--group-id`|none|Include group matching the specified group ID.|
|
|
|`--group-name`|none|Include groups matching the specified group name regex.|
|
|
|`-m`, `--[no-]manual-setup`|`false`|Manually set up the EntraID integration.|
|
|
|`--name`|`entra-id`|Name of the plugin resource to create|
|
|
|`--[no-]access-graph`|`true`|Enables Access Graph cache build.|
|
|
|`--[no-]use-system-credentials`|`false`|Uses system credentials instead of OIDC.|
|
|
|
|
## tctl plugins install github
|
|
|
|
Install an Access Graph Github integration.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl plugins install github [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--start-date`|`<today>`|Start date for the audit log ingest in the YYYY-MM-DD format.|
|
|
|
|
## tctl plugins install netiq
|
|
|
|
Install an Access Graph NetIQ integration.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl plugins install netiq [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--[no-]insecure-skip-verify`|`false`|Skip verification of the NetIQ server's SSL certificate.|
|
|
|
|
## tctl plugins install okta
|
|
|
|
Install an Okta integration.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl plugins install okta --org=ORG --saml-connector=SAML-CONNECTOR [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`-a`, `--app-filter`|none|Add an app filter. Supports globbing by default. Enclose in `^pattern$` for full regex support.|
|
|
|`--api-token`|none|Okta API token for the plugin to use|
|
|
|`--app-id`|none|Okta ID of the APP used for SSO via SAML|
|
|
|`-g`, `--group-filter`|none|Add a group filter. Supports globbing by default. Enclose in `^pattern$` for full regex support.|
|
|
|`--name`|`okta`|Name of the plugin resource to create|
|
|
|`--[no-]accesslist-sync`|`true`|Enable group to Access List synchronization|
|
|
|`--[no-]appgroup-sync`|`true`|Enable Okta Applications and Groups sync|
|
|
|`--[no-]assign-default-roles`|`true`|If user synchronization is enabled, assign the builtin okta-requester role to synchronized users|
|
|
|`--[no-]scim`|`false`|Enable SCIM Okta integration|
|
|
|`--[no-]system-logs-export`|`false`|Enables the Teleport Identity Security SIEM integration for Okta.|
|
|
|`--[no-]users-sync`|`true`|Enable user synchronization|
|
|
|`-o`, `--owner`|none|Add default owners for synced Access Lists|
|
|
|`--org`|none|URL of Okta organization|
|
|
|`--saml-connector`|none|SAML connector used for Okta SSO login.|
|
|
|
|
## tctl plugins install scim
|
|
|
|
Install a Teleport SCIM plugin.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl plugins install scim --connector=CONNECTOR [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--auth`|`oauth`|Plugin Authentication type.|
|
|
|`--connector`|none|Name of the Teleport connector to use.|
|
|
|`--connector-type`|none|Type of the Teleport connector to use.|
|
|
|
|
## tctl plugins rotate awsic
|
|
|
|
Rotate the AWS Identity Center SCIM bearer token.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl plugins rotate awsic [<flags>] TOKEN
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--[no-]validate-token`|`true`|Validate that the supplied token is valid for the configured downstream SCIM service|
|
|
|`--plugin-name`|`aws-identity-center`|Name of the AWSIC plugin instance to update. Defaults to aws-identity-center.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|token|none (required)|The new SCIM bearer token.|
|
|
|
|
## tctl proxy ls
|
|
|
|
Lists proxies connected to the cluster.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl proxy ls [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`yaml`|Output format: 'yaml', 'json' or 'text'|
|
|
|
|
## tctl recordings download
|
|
|
|
Download session recordings.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl recordings download [<flags>] <session-id>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`-o`, `--output-dir`|`<current working directory>`|Directory to download session recordings to.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|session-id|none (required)|ID of the session to download recordings for.|
|
|
|
|
## tctl recordings encryption complete-rotation
|
|
|
|
Completes an in-progress encryption key rotation.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl recordings encryption complete-rotation
|
|
```
|
|
|
|
## tctl recordings encryption rollback-rotation
|
|
|
|
Rolls back an in-progress encryption key rotation.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl recordings encryption rollback-rotation
|
|
```
|
|
|
|
## tctl recordings encryption rotate
|
|
|
|
Rotate encryption keys used for encrypting session recordings.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl recordings encryption rotate
|
|
```
|
|
|
|
## tctl recordings encryption status
|
|
|
|
Show current rotation status.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl recordings encryption status [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Format output (text, json, yaml).. Defaults to 'text'.|
|
|
|
|
## tctl recordings ls
|
|
|
|
List recorded sessions.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl recordings ls [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Format output (text, json, yaml).. Defaults to 'text'.|
|
|
|`--from-utc`|none|Start of time range in which recordings are listed. Format 2006-01-02. Defaults to 24 hours ago.|
|
|
|`--last`|none|Duration into the past from which session recordings should be listed. Format 5h30m40s|
|
|
|`--limit`|`50`|Maximum number of recordings to show. Default 50.|
|
|
|`--to-utc`|none|End of time range in which recordings are listed. Format 2006-01-02. Defaults to current time.|
|
|
|
|
## tctl requests approve
|
|
|
|
Approve pending Access Request.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl requests approve [<flags>] <request-id>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--annotations`|none|Resolution attributes \<key\>=\<val\>\[,...\]|
|
|
|`--assume-start-time`|none|Sets time roles can be assumed by requestor (RFC3339 e.g. 2023-12-12T23:20:50.52Z)|
|
|
|`--delegator`|none|Optional delegating identity|
|
|
|`--reason`|none|Optional reason message|
|
|
|`--roles`|none|Override requested roles \<role\>\[,...\]|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|request-id|none (required)|ID of target request(s)|
|
|
|
|
## tctl requests create
|
|
|
|
Create pending Access Request.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl requests create [<flags>] <username>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--[no-]dry-run`|`false`|Don't actually generate the Access Request|
|
|
|`--reason`|none|Optional reason message|
|
|
|`--resource`|none|Resource ID to be requested|
|
|
|`--roles`|none|Roles to be requested|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|username|none (required)|Name of target user|
|
|
|
|
## tctl requests deny
|
|
|
|
Deny pending Access Request.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl requests deny [<flags>] <request-id>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--annotations`|none|Resolution annotations \<key\>=\<val\>\[,...\]|
|
|
|`--delegator`|none|Optional delegating identity|
|
|
|`--reason`|none|Optional reason message|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|request-id|none (required)|ID of target request(s)|
|
|
|
|
## tctl requests get
|
|
|
|
Show Access Request by ID.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl requests get <request-id>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|request-id|none (required)|ID of target request(s)|
|
|
|
|
## tctl requests ls
|
|
|
|
Show active Access Requests.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl requests ls [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--sort-index`|`created`|Request sort index, 'created' or 'state'|
|
|
|`--sort-order`|`descending`|Request sort order, 'ascending' or 'descending'|
|
|
|
|
## tctl requests review
|
|
|
|
Review an Access Request.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl requests review --author=AUTHOR [<flags>] <request-id>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--author`|none|Username of reviewer|
|
|
|`--[no-]approve`|`false`|Review proposes approval|
|
|
|`--[no-]deny`|`false`|Review proposes denial|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|request-id|none (required)|ID of target request|
|
|
|
|
## tctl requests rm
|
|
|
|
Delete an Access Request.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl requests rm [<flags>] <request-id>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`-f`, `--[no-]force`|`false`|Force the deletion of an active Access Request|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|request-id|none (required)|ID of target request(s)|
|
|
|
|
## tctl rm
|
|
|
|
Delete a resource.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl rm [<resource type/resource name>]
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|resource type/resource name|none (optional)|Resource to delete
|
|
\<resource type\> Type of a resource \[for example: connector,user,cluster,token\]
|
|
\<resource name\> Resource name to delete
|
|
|
|
Examples:
|
|
$ tctl rm role/devs
|
|
$ tctl rm cluster/main|
|
|
|
|
## tctl saml export
|
|
|
|
Export a SAML signing key in .crt format.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl saml export <connector_name>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|connector_name|none (required)|name of the SAML connector to export the key from|
|
|
|
|
## tctl scoped status
|
|
|
|
Show the status of scoped resources.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl scoped status
|
|
```
|
|
|
|
## tctl scoped tokens add
|
|
|
|
Create a scoped invitation token.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl scoped tokens add --type=TYPE [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--assign-scope`|none|Scope that should be applied to resources provisioned by this token|
|
|
|`--format`|none|Output format, 'text', 'json', or 'yaml'|
|
|
|`--labels`|none|Set token labels, e.g. env=prod,region=us-west|
|
|
|`--mode`|none|Usage mode of a token (default: unlimited, single_use)|
|
|
|`--name`|none|Override the default, randomly generated token name with a specified name|
|
|
|`--scope`|none|Scope assigned to the token itself|
|
|
|`--ssh-labels`|none|Set immutable ssh labels the token should assign to provisioned resources, e.g. env=prod,region=us-west|
|
|
|`--ttl`|`30m0s`|Set expiration time for token, default is 30 minutes|
|
|
|`--type`|none|Type(s) of token to add, e.g. --type=node|
|
|
|
|
## tctl scoped tokens ls
|
|
|
|
List invitation tokens.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl scoped tokens ls [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|none|Output format, 'text', 'json' or 'yaml'|
|
|
|`--[no-]with-secrets`|`false`|Do not redact join tokens|
|
|
|
|
## tctl scoped tokens rm
|
|
|
|
Delete/revoke a scoped invitation token.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl scoped tokens rm [<token>]
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|token|none (optional)|Token to delete|
|
|
|
|
## tctl sso configure github
|
|
|
|
Configure GitHub auth connector.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl sso configure github --teams-to-roles=org,team,role1,role2,... --id=ID --secret=SECRET [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--api-endpoint-url`|`https://api.github.com`|API endpoint URL for GitHub instance.|
|
|
|`--display`|none|Sets the connector display name.|
|
|
|`--endpoint-url`|`https://github.com`|Endpoint URL for GitHub instance.|
|
|
|`--id`|none|GitHub app client ID.|
|
|
|`-n`, `--name`|`github`|Connector name.|
|
|
|`--[no-]ignore-missing-roles`|`false`|Ignore missing roles referenced in --teams-to-roles.|
|
|
|`--redirect-url`|none|Authorization callback URL.|
|
|
|`-r`, `--teams-to-roles`|none|Sets teams-to-roles mapping using format 'organization,name,role1,role2,...'. Repeatable.|
|
|
|`--secret`|none|GitHub app client secret.|
|
|
|
|
## tctl sso configure oidc
|
|
|
|
Configure OIDC auth connector, optionally using a preset. Available presets:
|
|
[google gitlab okta].
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl sso configure oidc --claims-to-roles=name,value,role1,role2,... --secret=SECRET [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--acr`|none|Authentication Context Class Reference values.|
|
|
|`--display`|none|Sets the connector display name.|
|
|
|`--google-acc`|none|Google only. String containing Google service account credentials.|
|
|
|`--google-acc-uri`|none|Google only. URI pointing at service account credentials. Example: file:///var/lib/teleport/gworkspace-creds.json.|
|
|
|`--google-admin`|none|Google only. Email of a Google admin to impersonate.|
|
|
|`--google-id`|none|Shorthand for setting the --id flag to \<GOOGLE_WORKSPACE_CLIENT_ID\>.apps.googleusercontent.com|
|
|
|`--id`|none|OIDC app client ID.|
|
|
|`--issuer-url`|none|Issuer URL.|
|
|
|`-n`, `--name`|none|Connector name. Required, unless implied from preset.|
|
|
|`--[no-]google-legacy`|`false`|Google only. Flag to select groups with direct membership filtered by domain (legacy behavior). Disabled by default. More info: https://goteleport.com/docs/enterprise/sso/google-workspace/#how-teleport-uses-google-workspace-apis|
|
|
|`--[no-]ignore-missing-roles`|`false`|Ignore missing roles referenced in --claims-to-roles.|
|
|
|`-p`, `--preset`|none|Preset. One of: \[google gitlab okta\]|
|
|
|`--prompt`|none|Optional OIDC prompt. Example values: none, select_account, login, consent.|
|
|
|`--provider`|none|Sets the external identity provider type to enable IdP specific workarounds. Examples: ping, adfs, netiq, okta.|
|
|
|`-r`, `--claims-to-roles`|none|Sets claim-to-roles mapping using format 'claim_name,claim_value,role1,role2,...'. Repeatable.|
|
|
|`--redirect-url`|none|Authorization callback URL(s). Each repetition of the flag declares one redirectURL.|
|
|
|`--scope`|none|Scope specifies additional scopes set by provider. Each repetition of the flag declares one scope. Examples: email, groups, openid.|
|
|
|`--secret`|none|OIDC app client secret.|
|
|
|
|
## tctl sso configure saml
|
|
|
|
Configure SAML auth connector, optionally using a preset. Available presets:
|
|
[okta onelogin ad adfs].
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl sso configure saml --attributes-to-roles=ATTRIBUTES-TO-ROLES [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--acs`|none|AssertionConsumerService is a URL for assertion consumer service on the service provider (Teleport's side).|
|
|
|`--assertion-cert-file`|none|A file with cert used for securing SAML assertions. Must be used together with --assertion-key-file.|
|
|
|`--assertion-key-file`|none|A file with key used for securing SAML assertions. Must be used together with --assertion-cert-file.|
|
|
|`--audience`|none|Audience uniquely identifies our service provider.|
|
|
|`--cert`|none|Cert file with the IdP certificate PEM. IdP signs \<Response\> responses using this certificate.|
|
|
|`--display`|none|Sets the connector display name.|
|
|
|`-e`, `--entity-descriptor`|none|Set the Entity Descriptor. Valid values: file, URL, XML content. Supplies configuration parameters as single XML instead of individual elements.|
|
|
|`--issuer`|none|Issuer is the identity provider issuer.|
|
|
|`-n`, `--name`|none|Connector name. Required, unless implied from preset.|
|
|
|`--[no-]allow-idp-initiated`|`false`|Allow the IdP to initiate the SSO flow.|
|
|
|`--[no-]ignore-missing-roles`|`false`|Ignore missing roles referenced in --attributes-to-roles.|
|
|
|`-p`, `--preset`|none|Preset. One of: \[okta onelogin ad adfs\]|
|
|
|`--provider`|none|Sets the external identity provider type. Examples: ping, adfs.|
|
|
|`-r`, `--attributes-to-roles`|none|Sets attribute-to-role mapping using format 'attr_name,attr_value,role1,role2,...'. Repeatable.|
|
|
|`--service-provider-issuer`|none|ServiceProviderIssuer is the issuer of the service provider (Teleport).|
|
|
|`--signing-cert-file`|none|A file with request certificate. Must be used together with --signing-key-file.|
|
|
|`--signing-key-file`|none|A file with request signing key. Must be used together with --signing-cert-file.|
|
|
|`--sso`|none|SSO is the URL of the identity provider's SSO service.|
|
|
|
|
## tctl sso test
|
|
|
|
Perform end-to-end test of SSO flow using provided auth connector definition.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl sso test [<flags>] [<filename>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--browser`|none|Set to 'none' to suppress browser opening on login.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|filename|none (optional)|Connector resource definition filename. Empty for stdin.|
|
|
|
|
## tctl stable-unix-users ls
|
|
|
|
List the stable UNIX users currently persisted in the cluster.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl stable-unix-users ls [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|`text`|Output format, 'text', or 'json'|
|
|
|
|
## tctl status
|
|
|
|
Report cluster status.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl status
|
|
```
|
|
|
|
## tctl terraform env
|
|
|
|
Obtain certificates and load them into environments variables. This creates a
|
|
temporary MachineID bot.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl terraform env [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--bot-ttl`|`1h`|Time-to-live of the Bot resource. The bot will be removed after this period. Defaults to \[1h\]|
|
|
|`--resource-prefix`|`tctl-terraform-env-`|Resource prefix to use when creating the Terraform role and bots. Defaults to \[tctl-terraform-env-\]|
|
|
|`--role`|none|Role used by Terraform. The role must already exist in Teleport. When not specified, uses the default role "terraform-provider"|
|
|
|
|
## tctl tokens add
|
|
|
|
Create a invitation token.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl tokens add --type=TYPE [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--app-name`|`example-app`|Name of the application to add|
|
|
|`--app-uri`|`http://localhost:8080`|URI of the application to add|
|
|
|`--db-name`|none|Name of the database to add|
|
|
|`--db-protocol`|none|Database protocol to use. Supported are: \[postgres mysql mongodb oracle cockroachdb redis snowflake sqlserver cassandra elasticsearch opensearch dynamodb clickhouse clickhouse-http spanner\]|
|
|
|`--db-uri`|none|Address the database is reachable at|
|
|
|`--format`|none|Output format, 'text', 'json', or 'yaml'|
|
|
|`--labels`|none|Set token labels, e.g. env=prod,region=us-west|
|
|
|`--ttl`|`30m0s`|Set expiration time for token, default is 30 minutes|
|
|
|`--type`|none|Type(s) of token to add, e.g. --type=node,app,db,proxy,etc|
|
|
|`--value`|none|Override the default random generated token with a specified value|
|
|
|
|
## tctl tokens configure-kube
|
|
|
|
Creates a token allowing workload from the Kubernetes cluster to join the
|
|
Teleport cluster.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl tokens configure-kube --service-account=SERVICE-ACCOUNT [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--bot`|none|Name of the bot that this token will grant access to. When set, creates a bot token. Overrides --type|
|
|
|`--cluster-name`|none|Name of the Kubernetes cluster. When not set, defaults to the context name.|
|
|
|`--context`|none|Kubernetes context to use. When not set, defaults to the active context.|
|
|
|`-f`, `--[no-]force`|`false`|Force the token creation, even if the token already exists|
|
|
|`-j`, `--join-with`|`auto`|Kubernetes joining type, possible values are 'oidc', 'jwks', and 'auto'. See https://goteleport.com/docs/reference/join-methods/#kubernetes-kubernetes for more details.|
|
|
|`-n`, `--namespace`|`teleport`|Namespace of the Kubernetes Service Account using the token. For 'teleport-kube-agent' and 'tbot' Helm charts, this is release namespace.|
|
|
|`-o`, `--out`|`./values.yaml`|Path of the output file.|
|
|
|`-s`, `--service-account`|none|Name of the Kubernetes Service Account using the token. For 'teleport-kube-agent' and 'tbot' Helm charts, this is the release name.|
|
|
|`--token-name`|none|Optional name of the created join token. When not set, default to '\<CLUSTER_NAME\>(-\<BOT_NAME\>)'|
|
|
|`--type`|`kube,app,discovery`|Type(s) of token to add, e.g. --type=kube,app,db,discovery,proxy,etc|
|
|
|`--update-group`|none|Optional update group used for version detection and agent updater configuration|
|
|
|
|
## tctl tokens ls
|
|
|
|
List node and user invitation tokens.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl tokens ls [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--format`|none|Output format, 'text', 'json' or 'yaml'|
|
|
|`--labels`|none|List of comma separated labels to filter by labels (e.g. key1=value1,key2=value2)|
|
|
|`--[no-]with-secrets`|`false`|Do not redact join tokens|
|
|
|
|
## tctl tokens rm
|
|
|
|
Delete/revoke an invitation token.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl tokens rm [<token>]
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|token|none (optional)|Token to delete|
|
|
|
|
## tctl top
|
|
|
|
Report diagnostic information.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl top [<diag-addr>] [<refresh>]
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|diag-addr|none (optional)|Diagnostic HTTP URL|
|
|
|refresh|`5s` (optional)|Refresh period|
|
|
|
|
## tctl update
|
|
|
|
Update resource fields.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl update [<flags>] [<resource type/resource name>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--set-labels`|none|Set labels|
|
|
|`--set-ttl`|none|Set TTL|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|resource type/resource name|none (optional)|Resource to update
|
|
\<resource type\> Type of a resource \[for example: rc\]
|
|
\<resource name\> Resource name to update
|
|
|
|
Example:
|
|
$ tctl update rc/remote|
|
|
|
|
## tctl users add
|
|
|
|
Generate a user invitation token [Teleport local users only].
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl users add --roles=ROLES [<flags>] <account>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--aws-role-arns`|none|List of allowed AWS role ARNs for the new user|
|
|
|`--azure-identities`|none|List of allowed Azure identities for the new user|
|
|
|`--db-names`|none|List of allowed database names for the new user|
|
|
|`--db-roles`|none|List of database roles for automatic database user provisioning|
|
|
|`--db-users`|none|List of allowed database users for the new user|
|
|
|`--default-relay-addr`|none|Relay address that clients should use by default|
|
|
|`--gcp-service-accounts`|none|List of allowed GCP service accounts for the new user|
|
|
|`--host-user-gid`|none|GID for auto provisioned host users to use|
|
|
|`--host-user-uid`|none|UID for auto provisioned host users to use|
|
|
|`--kubernetes-groups`|none|List of allowed Kubernetes groups for the new user|
|
|
|`--kubernetes-users`|none|List of allowed Kubernetes users for the new user|
|
|
|`--logins`|none|List of allowed SSH logins for the new user|
|
|
|`--mcp-tools`|none|List of allowed MCP tools for the new user|
|
|
|`--roles`|none|List of roles for the new user to assume|
|
|
|`--ttl`|`1h0m0s`|Set expiration time for token, default is 1h0m0s, maximum is 48h0m0s|
|
|
|`--windows-logins`|none|List of allowed Windows logins for the new user|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|account|none (required)|Teleport user account name|
|
|
|
|
## tctl users ls
|
|
|
|
Lists all user accounts.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl users ls
|
|
```
|
|
|
|
## tctl users reset
|
|
|
|
Reset user password and generate a new token [Teleport local users only].
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl users reset [<flags>] <account>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--ttl`|`8h0m0s`|Set expiration time for token, default is 8h0m0s, maximum is 24h0m0s|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|account|none (required)|Teleport user account name|
|
|
|
|
## tctl users rm
|
|
|
|
Deletes user accounts.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl users rm <logins>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|logins|none (required)|Comma-separated list of user logins to delete|
|
|
|
|
## tctl users update
|
|
|
|
Update user account.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl users update [<flags>] <account>
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--set-aws-role-arns`|none|List of allowed AWS role ARNs for the user, replaces current AWS role ARNs|
|
|
|`--set-azure-identities`|none|List of allowed Azure identities for the user, replaces current Azure identities|
|
|
|`--set-db-names`|none|List of allowed database names for the user, replaces current database names|
|
|
|`--set-db-roles`|none|List of allowed database roles for automatic database user provisioning, replaces current database roles|
|
|
|`--set-db-users`|none|List of allowed database users for the user, replaces current database users|
|
|
|`--set-default-relay-addr`|none|Relay address that clients should use by default. Value can be reset by providing an empty string|
|
|
|`--set-gcp-service-accounts`|none|List of allowed GCP service accounts for the user, replaces current service accounts|
|
|
|`--set-host-user-gid`|none|GID for auto provisioned host users to use. Value can be reset by providing an empty string|
|
|
|`--set-host-user-uid`|none|UID for auto provisioned host users to use. Value can be reset by providing an empty string|
|
|
|`--set-kubernetes-groups`|none|List of allowed Kubernetes groups for the user, replaces current Kubernetes groups|
|
|
|`--set-kubernetes-users`|none|List of allowed Kubernetes users for the user, replaces current Kubernetes users|
|
|
|`--set-logins`|none|List of allowed SSH logins for the user, replaces current logins|
|
|
|`--set-mcp-tools`|none|List of allowed MCP tools for the user, replaces current allowed MCP tools.|
|
|
|`--set-roles`|none|List of roles for the user to assume, replaces current roles|
|
|
|`--set-windows-logins`|none|List of allowed Windows logins for the user, replaces current Windows logins|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|account|none (required)|Teleport user account name|
|
|
|
|
## tctl version
|
|
|
|
Print the version of your tctl binary.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl version
|
|
```
|
|
|
|
## tctl workload-identity ls
|
|
|
|
List workload identity configurations.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl workload-identity ls
|
|
```
|
|
|
|
## tctl workload-identity revocations add
|
|
|
|
Create a new revocation.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl workload-identity revocations add --serial=SERIAL --type=TYPE --reason=REASON [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--expires-at`|none|Time that the revocation should expire, usually this should match the expiry time of the credential. This should be specified using RFC3339 e.g. '2024-02-05T15:04:00Z'. If unspecified, the time 1 week from now is used.|
|
|
|`--reason`|none|Reason for revocation.|
|
|
|`--serial`|none|Serial number of the certificate to revoke.|
|
|
|`--type`|none|Type of credential to revoke (x509)|
|
|
|
|
## tctl workload-identity revocations crl
|
|
|
|
Fetch the signed CRL for existing revocations.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl workload-identity revocations crl [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--[no-]follow`|`false`|Follow the stream of CRL updates.|
|
|
|`--out`|none|Path to write the CRL as a file to. If unspecified, STDOUT will be used.|
|
|
|
|
## tctl workload-identity revocations ls
|
|
|
|
List revocations.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl workload-identity revocations ls
|
|
```
|
|
|
|
## tctl workload-identity revocations rm
|
|
|
|
Delete a revocation.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl workload-identity revocations rm --serial=SERIAL --type=TYPE
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--serial`|none|Serial number of the certificate to remove the revocation for.|
|
|
|`--type`|none|Type of credential to remove the revocation for (x509).|
|
|
|
|
## tctl workload-identity rm
|
|
|
|
Delete a workload identity configuration.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl workload-identity rm <name>
|
|
```
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|name|none (required)|Name of the workload identity configuration to delete.|
|
|
|
|
## tctl workload-identity x509-issuer-overrides create
|
|
|
|
Create an issuer override from the given certificate chains.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl workload-identity x509-issuer-overrides create [<flags>] <fullchain.pem>...
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`-f`, `--[no-]force`|`false`|Overwrite the existing override if it exists.|
|
|
|`--name`|`default`|The name of the override resource to write.|
|
|
|`--[no-]dry-run`|`false`|Print the workload_identity_x509_issuer_override that would have been created, without actually creating it.|
|
|
|
|
Arguments:
|
|
|
|
|Argument|Default|Description|
|
|
|---|---|---|
|
|
|fullchain.pem|none (required)|PEM files containing an issuer and its optional chain each.|
|
|
|
|
## tctl workload-identity x509-issuer-overrides sign-csrs
|
|
|
|
Sign CSRs with the SPIFFE X.509 CA keys.
|
|
|
|
Usage:
|
|
|
|
```code
|
|
$ tctl workload-identity x509-issuer-overrides sign-csrs [<flags>]
|
|
```
|
|
|
|
Flags:
|
|
|
|
|Flag|Default|Description|
|
|
|---|---|---|
|
|
|`--creation-mode`|`same`|How the attributes of the issuer are encoded in the CSR: "same", "empty".|
|
|
|`-f`, `--[no-]force`|`false`|Attempt to sign as many CSRs as possible even in the presence of errors.|
|
|
|