Skip to content

cub worker key

cub worker key

Manage the keys a worker authenticates with

Synopsis

Manage the public keys a worker authenticates with.

The holder of the matching private key authenticates by signing a short-lived assertion, so ConfigHub never receives or stores a secret. This replaces the worker secret, which ConfigHub generates, stores, returns through the API, and receives again on every token refresh.

A key is registered against the worker's bot user, which is the identity the worker runs as. These commands resolve that for you; "cub user key" is the same thing addressed by identity instead.

Registering a key hands out an identity: whoever holds the private key authenticates as that worker from then on. It requires the admin or manager role.

Options

  -h, --help   help for key

Options inherited from parent commands

      --component string   the Component of --variant, when that names the variant alone; --variant <component>/<variant> says the same in one flag
      --context string     The context to use for this command
      --debug              Debug output
      --space string       space to operate in, by slug or UUID. Omitted, a list or bulk operation spans the organization and a single entity is named as <space>/<slug>
      --variant string     variant to operate in, as <component>/<variant>, or as <variant> with --component: the space naming that Component whose Variant label is <variant>. The same scope as --space, named by what it is rather than by the space's slug; the two cannot be combined

SEE ALSO