CLI reference
The kyvernon command-line client: connection, output, exit codes, global options, completion and every command.
Connection
--server (or KYVERNON_SERVER) names the controller. The bearer token comes from --token / KYVERNON_TOKEN, from --token-file / KYVERNON_TOKEN_FILE (a file with the token on its first line, for example an API token created with auth api-tokens create), or from the credentials file written by kyvernon login --save (default $XDG_CONFIG_HOME/kyvernon/credentials.json, %APPDATA%\kyvernon\credentials.json on Windows; written mode 0600 in a 0700 directory on Unix). The saved token is bound to the server it was saved for: with another --server the CLI refuses (exit 3) instead of sending it there; log in to that server or pass a token explicitly. Passwords are read from KYVERNON_PASSWORD or from stdin, never from the command line.
Output
--json prints the raw response; otherwise lists render as a table and objects as key: value lines. Long-running operations return the task; --wait polls it until it ends.
Exit codes
| Exit code | Meaning |
|---|---|
0 | success |
1 | failure |
2 | usage or connection error |
3 | not authenticated or not permitted |
4 | not found |
Global options
| Argument | Description | Required |
|---|---|---|
--server | Controller URL, e.g. https://controller.example.com:8443environment variable KYVERNON_SERVER | |
--token | Bearer token (or KYVERNON_TOKEN) environment variable KYVERNON_TOKEN | |
--token-file | File holding the bearer token (one line; or KYVERNON_TOKEN_FILE) environment variable KYVERNON_TOKEN_FILE | |
--credentials | Credentials file (default: platform config dir / kyvernon / credentials.json) environment variable KYVERNON_CREDENTIALS | |
--insecure | Skip TLS certificate verification (bootstrap certificates only) | |
--json | Print raw JSON | |
--output, -o | Output format: table (default) or json (-o json is --json)values table, json | |
--timeout | Request timeout in seconds default 30 |
Shell completion
kyvernon completion bash|zsh|fish|powershell|elvish prints a completion script: source <(kyvernon completion bash) or kyvernon completion powershell | Out-String | Invoke-Expression.
Commands
| Command | Description |
|---|---|
kyvernon login | Log in with a password (read from KYVERNON_PASSWORD or stdin) and print the token |
kyvernon logout | Revoke the current session |
kyvernon whoami | Show the current identity |
kyvernon about | Service information |
kyvernon depot | Offline depot: verify, install, sign (no controller needed) |
kyvernon completion | Print a shell completion script (source <(kyvernon completion bash)) |
kyvernon system | Liveness, readiness and the controller's Prometheus metrics |
kyvernon auth | Own session: browser-login settings, API tokens, TOTP, password |
kyvernon self | Own account on the identity endpoints (password, MFA enrolment) |
kyvernon users | User administration |
kyvernon roles | Roles |
kyvernon permissions | Permissions (principal, role, entity) |
kyvernon privileges | Privilege catalogue and checks |
kyvernon sessions | Active sessions |
kyvernon audit | Audit log |
kyvernon inventory | Inventory |
kyvernon vm | Virtual machine operations |
kyvernon host | Host operations |
kyvernon cluster | Cluster operations |
kyvernon network | Host-bridge networks / standard port groups |
kyvernon datastore | Datastore files |
kyvernon tasks | Tasks |
kyvernon events | Events |
kyvernon alarms | Alarms |
kyvernon scheduled-tasks | Scheduled power tasks |
kyvernon webhooks | Webhook subscriptions |
kyvernon ip-pools | Public IP pools on host-bridge networks and their allocations |
kyvernon firewall | Distributed firewall: groups, services, policies, rules, rollout, counters, logs |
kyvernon addresses | Public addresses and reverse DNS of one VM |
kyvernon traffic | Monthly traffic, limits and extra packages |
kyvernon metrics | Performance counters and samples of hosts, VMs and datastores |
kyvernon usage | Usage ledger (vCPU, memory, storage and network per VM, tenant and period) |
kyvernon backup | Backup sessions, changed-block areas and restores |
kyvernon content | Content libraries, items and update sessions |
kyvernon ovf | OVF descriptor parse, import-spec, and create-descriptor |
kyvernon nfc | Native NFC leases (ImportVApp / ExportVm file transfer) |
kyvernon customization | Guest customization specifications |
kyvernon licence | Licence entitlements (free tier and installed files, L-121) |
kyvernon tenants | Self-service tenants: quota, lifecycle, users, usage |
kyvernon servers | Self-service servers of a tenant |
kyvernon plans | VM plans (operator) |
kyvernon catalogue | The self-service image catalogue (operator) |
Version 0.1.