Skip to content

cub user key

cub user key

Manage the public keys registered against an identity

Synopsis

Manage the public keys an identity can authenticate with.

The holder of the matching private key authenticates by signing a short-lived assertion, so ConfigHub never receives or stores a secret. This replaces the worker secret, which ConfigHub generates, stores, returns through the API, and receives again on every token refresh.

Identities are named one of two ways. Use --worker to name a worker and have it resolved to the bot user it runs as, which is what an operator usually wants; use --user to name an identity directly.

Registering a key hands out an identity: whoever holds the private key authenticates as that identity from then on. It requires the admin or manager role, and you cannot register a key for yourself.

Options

      --component string   the Component of --variant, when that names the variant alone; --variant <component>/<variant> says the same in one flag
  -h, --help               help for key
      --space string       space to operate in, by slug or UUID. Omitted, a list or bulk operation spans the organization and a single entity is named as <space>/<slug>
      --user string        identity to manage keys for, by username or UUID
      --variant string     variant to operate in, as <component>/<variant>, or as <variant> with --component: the space naming that Component whose Variant label is <variant>. The same scope as --space, named by what it is rather than by the space's slug; the two cannot be combined
      --worker string      worker whose bot user to manage keys for, by slug or UUID

Options inherited from parent commands

      --context string   The context to use for this command
      --debug            Debug output

SEE ALSO