airctl is the administrator CLI tool for managing cluster resources: users, nodes, tokens, certificates, and configuration.
airctl authentication
Before running commands, the administrator must authenticate to the cluster.
With an identity file on a remote host
airctl --identity=identity.pem --auth-server=proxy.example.com:443 statusThe identity file is created via airctl auth sign or airsh login --out=<path>.
On the same host as Auth Service
If /etc/airlock.yaml exists on the host, airctl authenticates to the Auth Service from the configuration.
When run locally on the Auth Service host, the audit log records the action as performed by the Auth Service itself. It is recommended to restrict direct SSH access to the Auth Service.
After airsh login on a remote host
If there is no local config file or identity file, airctl uses the airsh profile created by airsh login. Ensure AIRLOCK_CONFIG_FILE is empty or /etc/airlock.yaml is absent.
Global flags
| Flag | Description |
|---|---|
-d, --debug | Verbose output |
-c, --config | Config path (default /etc/airlock.yaml) |
--auth-server | Auth/Proxy Service address |
-i, --identity | Identity file |
--insecure | Do not verify TLS certificate (dangerous) |
airctl status
Cluster status.
airctl status
airctl status --auth-server=192.168.99.102:3025 --identity=identity.pemairctl users add
Create a user and an invitation token.
airctl users add [<flags>] <account>| Flag | Description |
|---|---|
--roles | Roles (comma-separated) |
--logins | Permitted SSH logins |
--kubernetes-groups | Kubernetes groups |
--kubernetes-users | Kubernetes users |
--db-users | Database users |
--db-names | Database names |
--ttl | Token validity (max 48h) |
airctl users add joe --roles=access,editor --logins=joe,ubuntuairctl users ls
List users.
airctl users lsairctl users rm
Delete users.
airctl users rm <logins>
airctl users rm sally,timairctl users reset
Reset a local user’s password.
airctl users reset <account> [--ttl=8h]airctl users update
Update an account.
airctl users update [<flags>] <account>airctl nodes add
Generate a token for joining a node.
airctl nodes add [<flags>]| Flag | Description |
|---|---|
--roles | proxy, auth, node, db, app, windowsdesktop |
--ttl | Token validity (default 30m) |
--token | Custom token value |
airctl nodes add
airctl nodes add --roles=node,proxy --ttl=1hairctl nodes ls
List active SSH nodes.
airctl nodes ls [--namespace=<ns>]airctl tokens add
Create an invitation token.
airctl tokens add --type=TYPE [<flags>]| Flag | Description |
|---|---|
--type | proxy, auth, trusted_cluster, node, db, kube, app, windowsdesktop |
--ttl | Validity (default 1h) |
--labels | Token labels |
--value | Token value |
airctl tokens add --type=node
airctl tokens add --type=trusted_cluster --ttl=5m
airctl tokens add --type=kube
airctl tokens add --type=node,dbairctl tokens ls
List tokens.
airctl tokens ls [--format=json]airctl tokens rm
Remove (revoke) a token.
airctl tokens rm <token>airctl get
Get resources in YAML/JSON.
airctl get [<flags>] <resource-type/resource-name>,...| Flag | Description |
|---|---|
--format | yaml, json, text |
--with-secrets | Include secrets |
airctl get users
airctl get user/joe > joe.yaml
airctl get cluster/east
airctl get clusters,users
airctl get all > state.yamlairctl create
Create a resource from a file.
airctl create -f <file.yaml>airctl edit
Edit a resource in a text editor.
airctl edit <resource-type/resource-name>Editor priority: AIRLOCK_EDITOR → VISUAL → EDITOR → vi.
airctl edit role/sre
AIRLOCK_EDITOR=nano airctl edit user/aliceairctl rm
Delete a resource.
airctl rm <resource-type/resource-name>airctl rm users/admin
airctl rm role/old-roleairctl auth export
Export the cluster’s public CA certificates.
airctl auth export [--type=tls-host] [--fingerprint=SHA256:...]| Flag | Description |
|---|---|
--type | user, host, tls-host, tls-user, db, openssh, saml-idp |
--fingerprint | Filter by fingerprint |
--keys | Export private keys |
airctl auth sign
Create an identity file for a user or host.
airctl auth sign -o <filepath> [--user <user> | --host <host>] [<flags>]| Flag | Description |
|---|---|
--user | Airlock username |
--host | Airlock host name |
-o, --out | File path |
--format | file, openssh, tls, kubernetes |
--ttl | Validity (default 12h) |
airctl auth sign --ttl=24h --user=jenkins --out=jenkins.pem
airctl auth sign --format=openssh --host grav-00
airctl auth sign --user=admin --out=identity.pemairctl auth rotate
Rotate certificate authorities.
airctl auth rotate [--type=user|host] [--grace-period=200h]airctl request create / approve / deny / ls / rm
Manage Access Requests.
airctl request create myuser --roles=prod --reason="Fix an outage"
airctl request approve request-id-1,request-id-2
airctl request deny request-id-1
airctl request ls
airctl request rm request-id-1airctl alerts create / list / ack
Manage cluster alerts.
airctl alerts create --severity=LOW "System under maintenance"
airctl alerts list
airctl alerts ack --reason="scheduled" upgrade-suggestion
airctl alerts ack --clear upgrade-suggestionairctl top
Diagnostic information (requires airlock start --diag-addr=<bind-addr>).
airctl top http://127.0.0.1:3000 5sairctl help
airctl help
airctl help users add