Skip to content
Kindgi

kindgi service-accounts

Service accounts: non-human principals with their own grants, acting through API keys (create / list / get / grant / ungrant / unregister).

kindgi service-accounts create

Section titled “kindgi service-accounts create”

Create a service account with its first grants, written before it answers: a key minted for it works at once. It reads the tenant's settings only with --tenant-member.

Terminal window
kindgi service-accounts create <name> [--description=<text>] [--tenant-admin] [--tenant-member] [--project=<project-id>:<role>]…

Flags:

  • --description <value>: What it is for.
  • --project <value>: A role on a project, <project-id>:<role> (repeatable); roles: viewer, editor, owner, admin. (repeatable)
  • --tenant-admin: Make it a tenant admin.
  • --tenant-member: Tenant member: read the tenant's settings (providers, policies, adapters, signing keys, deployments), not its projects. Not given by default; give it only to an account whose job needs it.

kindgi service-accounts list

Section titled “kindgi service-accounts list”

List service accounts, oldest first; --all includes unregistered ones.

Terminal window
kindgi service-accounts list [--all] [--limit=<n>] [--cursor=<c>] [--table]

Flags:

  • --all: Unregistered accounts too.
  • --cursor <value>: The next page, from nextCursor.
  • --limit <value>: Page size.

kindgi service-accounts get

Section titled “kindgi service-accounts get”

One service account, with its grants.

Terminal window
kindgi service-accounts get <service-account-id>

kindgi service-accounts grant

Section titled “kindgi service-accounts grant”

Grant a service account tenant admin, tenant member (read the tenant's settings), or a role on a project (replacing its role there). Written before it answers.

Terminal window
kindgi service-accounts grant <service-account-id> (--tenant-admin | --tenant-member | --project=<project-id> --role=<role>)

Flags:

  • --project <value>: A project, by id.
  • --role <value>: Its role there: viewer, editor, owner, admin.
  • --tenant-admin: Tenant admin.
  • --tenant-member: Tenant member: read the tenant's settings (providers, policies, adapters, signing keys, deployments), not its projects. Not given by default; give it only to an account whose job needs it.

kindgi service-accounts ungrant

Section titled “kindgi service-accounts ungrant”

Remove tenant admin, tenant member, or the role on a project, from a service account.

Terminal window
kindgi service-accounts ungrant <service-account-id> (--tenant-admin | --tenant-member | --project=<project-id>)

Flags:

  • --project <value>: A project, by id.
  • --tenant-admin: Tenant admin.
  • --tenant-member: Tenant member.

kindgi service-accounts unregister

Section titled “kindgi service-accounts unregister”

Unregister a service account: its grants go and its keys are revoked. It stays readable.

Terminal window
kindgi service-accounts unregister <service-account-id>

Every command also takes the global flags.