airsh is the CLI client for Airlock users: log in to a cluster, SSH, Kubernetes, databases, and file copying.
Full reference: airsh help <command>.
Environment variables
| Variable | Description | Example |
|---|---|---|
AIRLOCK_AUTH | Authentication connector name (SAML, OIDC, GitHub, local) | github |
AIRLOCK_CLUSTER | Root or leaf cluster name | cluster.example.com |
AIRLOCK_LOGIN | Default OS login on the remote host | root |
AIRLOCK_LOGIN_BROWSER | none — do not open the browser during SSO | none |
AIRLOCK_PROXY | Proxy Service address | cluster.example.com:3080 |
AIRLOCK_HOME | airsh configuration directory | ~/.airsh |
AIRLOCK_USER | Airlock username | alice |
AIRLOCK_USE_LOCAL_SSH_AGENT | ssh-agent integration | true, false |
AIRLOCK_GLOBAL_AIRSH_CONFIG | Path to global config | /etc/airsh.yaml |
AIRLOCK_IDENTITY_FILE | Path to identity file | /opt/identity |
Global flags
| Flag | Description |
|---|---|
-l, --login | OS login on the remote host |
--proxy | Proxy Service address: host:https_port[,ssh_proxy_port] |
--user | Airlock username |
--ttl | Certificate validity in minutes (default 720) |
-i, --identity | Identity file |
--auth | Authentication connector (default local) |
--insecure | Do not verify the server certificate (tests only) |
-d, --debug | Verbose output |
-J, --jumphost | SSH jump host |
airsh login
Log in to the cluster. The certificate is saved to ~/.airsh.
airsh login [<flags>] [<cluster>]| Flag | Description |
|---|---|
-o, --out | Save identity to a file |
--format | file, openssh, kubernetes |
--browser | none — do not open the browser |
--no-use-local-ssh-agent | Do not load the certificate into ssh-agent |
airsh --proxy=proxy.example.com login
airsh --proxy=proxy.example.com --auth=local --user=admin login
airsh --proxy=proxy.example.com --auth=github login
airsh --ttl=1 login
airsh login --format=kubernetes -o kubeconfigairsh logout
Removes the client certificate.
airsh logoutairsh status
Shows the current profile, roles, logins, and certificate expiry.
airsh statusairsh ls
List cluster nodes.
airsh ls [<flags>] [<label>]| Flag | Description |
|---|---|
-v, --verbose | Show Node ID |
--cluster | Leaf cluster |
airsh ls
airsh ls os=linux
airsh ls -vairsh ssh
SSH connection or command execution.
airsh ssh [<flags>] <[user@]host> [<command>...]| Flag | Description |
|---|---|
-p, --port | SSH port |
-A, --forward-agent | Agent forwarding |
-L, --forward | Local port forwarding |
-D, --dynamic-forward | SOCKS5 proxy |
--cluster | Leaf cluster |
-X, --x11-untrusted | X11 forwarding |
-Y, --x11-trusted | Trusted X11 forwarding |
airsh ssh root@grav-00
airsh ssh -o ForwardAgent=yes root@grav-00
airsh ssh root@env=prod hostnameairsh scp
Copy files.
airsh scp [<flags>] <source>... <dest>| Flag | Description |
|---|---|
-r, --recursive | Recursive copy |
-P, --port | Port |
--cluster | Leaf cluster |
airsh join
Join an active session.
airsh join [<flags>] <session-id>airsh clusters
List trusted clusters.
airsh clusters [--quiet]airsh kube ls
List available Kubernetes clusters.
airsh kube lsairsh kube login
Log in to a Kubernetes cluster, update kubeconfig.
airsh kube login <kube-cluster>| Flag | Description |
|---|---|
--all | Kubeconfig for all available clusters |
--as | Kubernetes user impersonation |
--as-groups | Kubernetes group impersonation |
--cluster | Airlock cluster |
-n, --kube-namespace | Default namespace |
airsh db ls
List available databases.
airsh db lsairsh db connect
Connect to a database using the built-in client.
airsh db connect --db-user=<user> --db-name=<db> <database>airsh proxy db
Local proxy for connecting to a database.
airsh proxy db [<flags>] <db>| Flag | Description |
|---|---|
--db-user | Database user |
--db-name | Database name |
--port | Local port |
--tunnel | Authenticated tunnel without additional credentials |
--cluster | Leaf cluster |
airsh proxy db mysql-db
airsh proxy db --port 10700 mysql-db
airsh proxy db --tunnel mysql-dbairsh recordings ls
List recorded sessions.
airsh recordings ls [--last=6h0m0s] [--from-utc=YYYY-MM-DD] [--to-utc=YYYY-MM-DD]airsh play
Play back a recorded session.
airsh play <session-id>airsh config
Print the OpenSSH configuration for use with Airlock.
airsh config >> ~/.ssh/configairsh proxy ssh
Local TLS proxy for SSH (TLS routing mode).
airsh proxy ssh [<flags>] <[user@]host>airsh version
Client and server version.
airsh version [--format=json] [--client]airsh mfa add / ls / rm
Manage MFA devices.
airsh mfa add
airsh mfa ls
airsh mfa rm <type>airsh request create / ls / review / show / drop / search
Manage Access Requests.
airsh request create --roles=prod --reason="..."
airsh request ls [--my-requests] [--reviewable]
airsh request review --approve <request-id>
airsh request show <request-id>
airsh request drop [<request-id>...]
airsh request search --kind=node --labels=env=dev