kindgi service-accounts

`kindgi service-accounts`

Synopsis

kindgi service-accounts <command>

Signature

Service accounts: non-human principals with their own grants, acting through API keys (create / list / get / grant / ungrant / unregister).

Commands

Command	Description
`kindgi service-accounts create`	Create a service account with its first grants, written before it answers: a key minted for it works at once.
`kindgi service-accounts list`	List service accounts, oldest first; `--all` includes unregistered ones.
`kindgi service-accounts get`	One service account, with its grants.
`kindgi service-accounts grant`	Grant a service account tenant admin, tenant member (read the tenant's settings), or a role on a project (replacing its role there).
`kindgi service-accounts ungrant`	Remove tenant admin, tenant member, or the role on a project, from a service account.
`kindgi service-accounts unregister`	Unregister a service account: its grants go and its keys are revoked.

See also

People, API keys and service accounts

`kindgi service-accounts create`

Synopsis

kindgi service-accounts create <name> [--description=<text>] [--tenant-admin] [--tenant-member] [--project=<project-id>:<role>]…

Signature

Create a service account with its first grants, written before it answers: a key minted for it works at once. It reads the tenant's settings only with --tenant-member.

Options

Option	Default	Description
`--description <value>`	none	What it is for.
`--project <value>`	none	A role on a project, `<project-id>:<role>` (repeatable); roles: viewer, editor, owner, admin. Repeatable.
`--tenant-admin`	off	Make it a tenant admin.
`--tenant-member`	off	Tenant member: read the tenant's settings (providers, policies, adapters, signing keys, deployments), not its projects. Not given by default; give it only to an account whose job needs it.

Every command also takes the global flags.

Examples

From People, API keys and service accounts:

npx --yes @kindgi/cli@0.1 service-accounts create acme-deploy --description="Deploys" --tenant-admin
npx --yes @kindgi/cli@0.1 service-accounts create acme-ci --description="Deploys from CI" --project=<project-id>:editor

See also

`kindgi service-accounts list`

Synopsis

kindgi service-accounts list [--all] [--limit=<n>] [--cursor=<c>] [--table]

Signature

List service accounts, oldest first; --all includes unregistered ones.

Options

Option	Default	Description
`--all`	off	Unregistered accounts too.
`--cursor <value>`	none	The next page, from `nextCursor`.
`--limit <value>`	`25` (at most `100`)	Page size.

Every command also takes the global flags.

Examples

List every service account, including unregistered ones, as a table.

kindgi service-accounts list --all --table

Read the next page of 20.

kindgi service-accounts list --limit=20 --cursor=<cursor>

See also

`kindgi service-accounts get`

Synopsis

kindgi service-accounts get <service-account-id>

Signature

One service account, with its grants.

Options

Every command also takes the global flags.

Examples

Show one service account with its grants.

kindgi service-accounts get <service-account-id>

See also

`kindgi service-accounts grant`

Synopsis

kindgi service-accounts grant <service-account-id> (--tenant-admin | --tenant-member | --project=<project-id> --role=<role>)

Signature

Grant a service account tenant admin, tenant member (read the tenant's settings), or a role on a project (replacing its role there). Written before it answers.

Options

Option	Default	Description
`--project <value>`	none	A project, by id.
`--role <value>`	required with `--project`	Its role there: viewer, editor, owner, admin.
`--tenant-admin`	off	Tenant admin.
`--tenant-member`	off	Tenant member: read the tenant's settings (providers, policies, adapters, signing keys, deployments), not its projects. Not given by default; give it only to an account whose job needs it.

Every command also takes the global flags.

Examples

Give a service account the editor role on a project.

kindgi service-accounts grant <service-account-id> --project=<project-id> --role=editor

Let a service account read the tenant's settings.

kindgi service-accounts grant <service-account-id> --tenant-member

See also

`kindgi service-accounts ungrant`

Synopsis

kindgi service-accounts ungrant <service-account-id> (--tenant-admin | --tenant-member | --project=<project-id>)

Signature

Remove tenant admin, tenant member, or the role on a project, from a service account.

Options

Option	Default	Description
`--project <value>`	none	A project, by id.
`--tenant-admin`	off	Tenant admin.
`--tenant-member`	off	Tenant member.

Every command also takes the global flags.

Examples

Remove a service account's role on a project.

kindgi service-accounts ungrant <service-account-id> --project=<project-id>

Take tenant member away from a service account.

kindgi service-accounts ungrant <service-account-id> --tenant-member

See also

`kindgi service-accounts unregister`

Synopsis

kindgi service-accounts unregister <service-account-id>

Signature

Unregister a service account: its grants go and its keys are revoked. It stays readable.

Options

Every command also takes the global flags.

Examples

Unregister a service account and revoke its keys.

kindgi service-accounts unregister <service-account-id>

See also