kyvernon firewall

`kyvernon firewall`

Distributed firewall: groups, services, policies, rules, rollout, counters, logs

Usage

kyvernon firewall <COMMAND>

Subcommands: groups, services, policies, rules, effective, open-port, templates, mode, monitor, stats, simulate, realization, logs, profiles, settings, tag-categories, vnic-profile, bypass

`kyvernon firewall groups`

Security groups: tag criteria, VMs, vNICs, networks, prefixes and nested groups

Usage

kyvernon firewall groups <COMMAND>

Subcommands: list, show, create, update, delete, members

`kyvernon firewall groups list`

List groups

Usage

kyvernon firewall groups list [OPTIONS]

Argument	Description	Required
`--tenant`	Tenant (`tenant-N`); default: the provider's (a tenant user: its own)

API operation: GET /v1/firewall/groups

`kyvernon firewall groups show`

One group

Usage

kyvernon firewall groups show <ID>

Argument	Description	Required
`<ID>`	Group id (`fwgroup-N`)	yes

API operation: GET /v1/firewall/groups/{id}

`kyvernon firewall groups create`

Create a group

Usage

kyvernon firewall groups create [OPTIONS]

Argument	Description	Required
`--name`	Name (unique in its scope; `sys:` is reserved)
`--description`	Description
`--criterion`	Tag criterion `category=value[,category=value]`: a vNIC is a member when its VM has every tag of one criterion (repeat for alternatives)
`--vm`	Every vNIC of this VM (repeat)
`--vnic`	This vNIC, `vm-N:nic-key` (repeat)
`--network`	Every vNIC on this host-bridge network (repeat)
`--mac`	Every vNIC with this MAC address (repeat)
`--prefix`	Address or prefix outside the platform (repeat)
`--group`	Nested group `fwgroup-N` (repeat)
`--shared`	Visible to tenants by name (a provider group) values `true`, `false`
`--tenant`	Tenant of the new group
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: POST /v1/firewall/groups

`kyvernon firewall groups update`

Change a group: the flags given replace those fields (a list flag replaces the whole list), the rest stays. --body replaces the group

Usage

kyvernon firewall groups update [OPTIONS] <ID>

Argument	Description	Required
`<ID>`	Group id	yes
`--name`	Name (unique in its scope; `sys:` is reserved)
`--description`	Description
`--criterion`	Tag criterion `category=value[,category=value]`: a vNIC is a member when its VM has every tag of one criterion (repeat for alternatives)
`--vm`	Every vNIC of this VM (repeat)
`--vnic`	This vNIC, `vm-N:nic-key` (repeat)
`--network`	Every vNIC on this host-bridge network (repeat)
`--mac`	Every vNIC with this MAC address (repeat)
`--prefix`	Address or prefix outside the platform (repeat)
`--group`	Nested group `fwgroup-N` (repeat)
`--shared`	Visible to tenants by name (a provider group) values `true`, `false`
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: PUT /v1/firewall/groups/{id}

`kyvernon firewall groups delete`

Delete a group (refused while it is referenced)

Usage

kyvernon firewall groups delete [OPTIONS] <ID>

Argument	Description	Required
`<ID>`	Group id	yes
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: DELETE /v1/firewall/groups/{id}

`kyvernon firewall groups members`

Resolved members of a group: vNICs and addresses

Usage

kyvernon firewall groups members <ID>

Argument	Description	Required
`<ID>`	Group id	yes

API operation: GET /v1/firewall/groups/{id}/members

`kyvernon firewall services`

Named services (protocol and port sets)

Usage

kyvernon firewall services <COMMAND>

Subcommands: list, show, create, update, delete

`kyvernon firewall services list`

List services

Usage

kyvernon firewall services list [OPTIONS]

Argument	Description	Required
`--tenant`	Tenant (`tenant-N`)

API operation: GET /v1/firewall/services

`kyvernon firewall services show`

One service

Usage

kyvernon firewall services show <ID>

Argument	Description	Required
`<ID>`	Service id (`fwsvc-N`)	yes

API operation: GET /v1/firewall/services/{id}

`kyvernon firewall services create`

Create a service

Usage

kyvernon firewall services create [OPTIONS]

Argument	Description	Required
`--name`	Name
`--description`	Description
`--entry`	Entry `proto[:detail]`: `tcp:22,443`, `udp:53`, `icmp4:8`, `icmp6:128`, `ip:47` (repeat)
`--tenant`	Tenant of the new service
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: POST /v1/firewall/services

`kyvernon firewall services update`

Change a service (flags replace the fields they name; --body replaces the service)

Usage

kyvernon firewall services update [OPTIONS] <ID>

Argument	Description	Required
`<ID>`	Service id	yes
`--name`	Name
`--description`	Description
`--entry`	Entry `proto[:detail]`: `tcp:22,443`, `udp:53`, `icmp4:8`, `icmp6:128`, `ip:47` (repeat)
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: PUT /v1/firewall/services/{id}

`kyvernon firewall services delete`

Delete a service

Usage

kyvernon firewall services delete [OPTIONS] <ID>

Argument	Description	Required
`<ID>`	Service id	yes
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: DELETE /v1/firewall/services/{id}

`kyvernon firewall policies`

Policies (a category, an order and rules)

Usage

kyvernon firewall policies <COMMAND>

Subcommands: list, show, create, update, delete

`kyvernon firewall policies list`

List policies

Usage

kyvernon firewall policies list [OPTIONS]

Argument	Description	Required
`--tenant`	Tenant (`tenant-N`)

API operation: GET /v1/firewall/policies

`kyvernon firewall policies show`

One policy with its rules

Usage

kyvernon firewall policies show <ID>

Argument	Description	Required
`<ID>`	Policy id (`fwpolicy-N`)	yes

API operation: GET /v1/firewall/policies/{id}

`kyvernon firewall policies create`

Create a policy (rules are added with rules add, or come from --body)

Usage

kyvernon firewall policies create [OPTIONS]

Argument	Description	Required
`--name`	Name (unique in its scope)
`--category`	Category values `emergency`, `infrastructure`, `environment`, `application`
`--sequence`	Order inside the category (lower first; default: after the last policy)
`--stateful`	Replies are allowed automatically (default true) values `true`, `false`
`--applied-to`	Group the policy applies to (repeat; none: every vNIC, a tenant's: its own)
`--enabled`	Enabled (default true) values `true`, `false`
`--tenant`	Tenant of the new policy
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: POST /v1/firewall/policies

`kyvernon firewall policies update`

Change a policy; the rules stay unless --body carries rules

Usage

kyvernon firewall policies update [OPTIONS] <ID>

Argument	Description	Required
`<ID>`	Policy id	yes
`--name`	Name (unique in its scope)
`--category`	Category values `emergency`, `infrastructure`, `environment`, `application`
`--sequence`	Order inside the category (lower first; default: after the last policy)
`--stateful`	Replies are allowed automatically (default true) values `true`, `false`
`--applied-to`	Group the policy applies to (repeat; none: every vNIC, a tenant's: its own)
`--enabled`	Enabled (default true) values `true`, `false`
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: PUT /v1/firewall/policies/{id}

`kyvernon firewall policies delete`

Delete a policy with its rules

Usage

kyvernon firewall policies delete [OPTIONS] <ID>

Argument	Description	Required
`<ID>`	Policy id	yes
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: DELETE /v1/firewall/policies/{id}

`kyvernon firewall rules`

Rules of a policy

Usage

kyvernon firewall rules <COMMAND>

Subcommands: list, show, add, update, delete, move

`kyvernon firewall rules list`

List the rules of a policy

Usage

kyvernon firewall rules list [OPTIONS]

Argument	Description	Required
`--policy`	Policy id	yes

API operation: GET /v1/firewall/policies/{id}/rules

`kyvernon firewall rules show`

One rule (id or number)

Usage

kyvernon firewall rules show [OPTIONS] <RULE>

Argument	Description	Required
`<RULE>`	Rule id or number	yes
`--policy`	Policy id	yes

API operation: GET /v1/firewall/policies/{id}/rules/{rid}

`kyvernon firewall rules add`

Add a rule

Usage

kyvernon firewall rules add [OPTIONS]

Argument	Description	Required
`--policy`	Policy id	yes
`--name`	Display name
`--action`	Action values `allow`, `drop`, `reject`, `pass`
`--direction`	Direction relative to the vNIC (default `in-out`) values `in`, `out`, `in-out`
`--source`	Source: group id, address or prefix (repeat; none: any)
`--sources-negated`	Match everything except the sources values `true`, `false`
`--destination`	Destination: group id, address or prefix (repeat; none: any)
`--destinations-negated`	Match everything except the destinations values `true`, `false`
`--service`	Service `proto[:detail]` such as `tcp:22,443`, or `named:fwsvc-N` (repeat; none: any IP traffic)
`--log`	Log matches values `true`, `false`
`--applied-to`	Group the rule applies to (repeat; none: the policy's)
`--enabled`	Enabled (default true) values `true`, `false`
`--ip-version`	IP families (default `any`) values `any`, `v4`, `v6`
`--position`	Position in the policy (0 first; default: last)
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: POST /v1/firewall/policies/{id}/rules

`kyvernon firewall rules update`

Change a rule: the flags given replace those fields

Usage

kyvernon firewall rules update [OPTIONS] <RULE>

Argument	Description	Required
`<RULE>`	Rule id or number	yes
`--policy`	Policy id	yes
`--name`	Display name
`--action`	Action values `allow`, `drop`, `reject`, `pass`
`--direction`	Direction relative to the vNIC (default `in-out`) values `in`, `out`, `in-out`
`--source`	Source: group id, address or prefix (repeat; none: any)
`--sources-negated`	Match everything except the sources values `true`, `false`
`--destination`	Destination: group id, address or prefix (repeat; none: any)
`--destinations-negated`	Match everything except the destinations values `true`, `false`
`--service`	Service `proto[:detail]` such as `tcp:22,443`, or `named:fwsvc-N` (repeat; none: any IP traffic)
`--log`	Log matches values `true`, `false`
`--applied-to`	Group the rule applies to (repeat; none: the policy's)
`--enabled`	Enabled (default true) values `true`, `false`
`--ip-version`	IP families (default `any`) values `any`, `v4`, `v6`
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: PUT /v1/firewall/policies/{id}/rules/{rid}

`kyvernon firewall rules delete`

Delete a rule

Usage

kyvernon firewall rules delete [OPTIONS] <RULE>

Argument	Description	Required
`<RULE>`	Rule id or number	yes
`--policy`	Policy id	yes
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: DELETE /v1/firewall/policies/{id}/rules/{rid}

`kyvernon firewall rules move`

Move a rule inside its policy

Usage

kyvernon firewall rules move [OPTIONS] <RULE>

Argument	Description	Required
`<RULE>`	Rule id or number	yes
`--policy`	Policy id	yes
`--position`	New position (0 first; beyond the end: last)	yes
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: POST /v1/firewall/policies/{id}/rules/{rid}/move

`kyvernon firewall effective`

Effective rules of a VM's vNICs in evaluation order, with counters

Usage

kyvernon firewall effective [OPTIONS] <VM>

Argument	Description	Required
`<VM>`	VM id	yes
`--nic`	Only this vNIC (NIC key, e.g. `4000`)

API operation: GET /v1/vms/{id}/firewall

`kyvernon firewall open-port`

Open a port of a VM: an inbound allow rule in the VM's own policy

Usage

kyvernon firewall open-port [OPTIONS] <VM>

Argument	Description	Required
`<VM>`	VM id	yes
`--tcp`	TCP port or range to open, e.g. `443` or `8000-8100` (repeat)
`--udp`	UDP port or range to open (repeat)
`--from`	Source allowed: address or prefix (repeat; none: any)
`--ip-version`	IP families values `any`, `v4`, `v6`
`--name`	Rule name (default `open <protocol> <ports>`)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: POST /v1/vms/{id}/firewall/open-port

`kyvernon firewall templates`

Rule templates (ssh-only, web, mail-server)

Usage

kyvernon firewall templates <COMMAND>

Subcommands: list, show, set, delete, apply

`kyvernon firewall templates list`

List the templates with the rules they add

Usage

kyvernon firewall templates list

API operation: GET /v1/firewall/templates

`kyvernon firewall templates show`

Show one template

Usage

kyvernon firewall templates show <TEMPLATE>

Argument	Description	Required
`<TEMPLATE>`	Template id	yes

API operation: GET /v1/firewall/templates/{id}

`kyvernon firewall templates set`

Create or replace a provider template from a JSON body ({description, note, rules: [{name, services, from, ipVersion}]})

Usage

kyvernon firewall templates set [OPTIONS] <TEMPLATE>

Argument	Description	Required
`<TEMPLATE>`	Template id	yes
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: PUT /v1/firewall/templates/{id}

`kyvernon firewall templates delete`

Delete a provider template

Usage

kyvernon firewall templates delete [OPTIONS] <TEMPLATE>

Argument	Description	Required
`<TEMPLATE>`	Template id	yes
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: DELETE /v1/firewall/templates/{id}

`kyvernon firewall templates apply`

Apply a template to a VM (a task)

Usage

kyvernon firewall templates apply [OPTIONS] <TEMPLATE> <VM>

Argument	Description	Required
`<TEMPLATE>`	Template id	yes
`<VM>`	VM id	yes
`--wait`	Wait for the task to finish and print it

API operation: POST /v1/firewall/templates/{id}/apply

`kyvernon firewall mode`

Switch the firewall mode of a VM's vNICs (off, monitor, enforce), or confirm a switch that waits for confirmation

Usage

kyvernon firewall mode [OPTIONS] [VM] [MODE] <COMMAND>

Argument	Description	Required
`<VM>`	VM id
`<MODE>`	New mode values `off`, `monitor`, `enforce`
`--confirm-within`	The previous mode comes back unless `mode confirm` runs within this time (30s to 24h, e.g. `10m`)
`--nic`	Only this vNIC (NIC key; repeat; default: every host-bridge vNIC of the VM)
`--reason`	Why (kept in the event)
`--wait`	Wait for the task to finish and print it

API operation: POST /v1/vms/{id}/firewall/mode

Subcommands: confirm

`kyvernon firewall mode confirm`

Keep the new mode of a switch that waits for confirmation

Usage

kyvernon firewall mode confirm <VM>

Argument	Description	Required
`<VM>`	VM id	yes

API operation: POST /v1/vms/{id}/firewall/mode/confirm

`kyvernon firewall monitor`

What a VM's rules would have dropped in mode monitor, and a proposal

Usage

kyvernon firewall monitor <VM>

Argument	Description	Required
`<VM>`	VM id	yes

API operation: GET /v1/vms/{id}/firewall/monitor

`kyvernon firewall stats`

Hit counters of a policy's rules or of one rule number

Usage

kyvernon firewall stats [OPTIONS]

Argument	Description	Required
`--policy`	Counters of every rule of this policy
`--rule`	Counters of this rule number

API operation: GET /v1/firewall/policies/{id}/stats

`kyvernon firewall simulate`

The verdict and deciding rule for a described packet at a vNIC

Usage

kyvernon firewall simulate [OPTIONS]

Argument	Description	Required
`--vm`	VM id	yes
`--nic`	vNIC (NIC key; default: the VM's first host-bridge vNIC)
`--in`	Packet arriving at the vNIC
`--out`	Packet leaving the vNIC
`--proto`	`tcp`, `udp`, `icmp4`, `icmp6` or a protocol number default `tcp`
`--port`	Destination port (TCP, UDP)
`--icmp-type`	ICMP type
`--icmp-code`	ICMP code
`--peer`	The other end's address	yes
`--local`	The vNIC's own address (default: its first address of the peer's family)
`--state`	Connection state values `new`, `established`

API operation: POST /v1/firewall/simulate

`kyvernon firewall realization`

Realization per host: wanted and applied plan version, error, flows, preconditions

Usage

kyvernon firewall realization [OPTIONS]

Argument	Description	Required
`--host`	Only this host

API operation: GET /v1/firewall/realization

`kyvernon firewall logs`

Firewall log records, newest first

Usage

kyvernon firewall logs [OPTIONS]

Argument	Description	Required
`--vm`	Only this VM's records
`--host`	Only this host's records
`--rule`	Only this rule number's records
`--limit`	Most records (default 500, at most 5,000)

API operation: GET /v1/firewall/logs

`kyvernon firewall profiles`

Default profiles (the default actions and the baseline of a vNIC)

Usage

kyvernon firewall profiles <COMMAND>

Subcommands: list, show, create, set, delete

`kyvernon firewall profiles list`

List the profiles

Usage

kyvernon firewall profiles list

API operation: GET /v1/firewall/profiles

`kyvernon firewall profiles show`

One profile (every profile without an id)

Usage

kyvernon firewall profiles show [ID]

Argument	Description	Required
`<ID>`	Profile id (`public-default`, `private-default`, `closed`, `open` or `fwprofile-N`)

API operation: GET /v1/firewall/profiles/{id}

`kyvernon firewall profiles create`

Create a provider profile (--name, --inbound and --outbound are required)

Usage

kyvernon firewall profiles create [OPTIONS]

Argument	Description	Required
`--name`	Name
`--inbound`	Default action for traffic arriving at the vNIC values `allow`, `drop`, `reject`
`--outbound`	Default action for traffic leaving the vNIC values `allow`, `drop`, `reject`
`--baseline`	Baseline policy id (`none` removes it)
`--selectable`	Tenants may choose it values `true`, `false`
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: POST /v1/firewall/profiles

`kyvernon firewall profiles set`

Change a profile: the flags given replace those fields (a built-in profile is overridden, not deleted)

Usage

kyvernon firewall profiles set [OPTIONS] <ID>

Argument	Description	Required
`<ID>`	Profile id	yes
`--name`	Name
`--inbound`	Default action for traffic arriving at the vNIC values `allow`, `drop`, `reject`
`--outbound`	Default action for traffic leaving the vNIC values `allow`, `drop`, `reject`
`--baseline`	Baseline policy id (`none` removes it)
`--selectable`	Tenants may choose it values `true`, `false`
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: PUT /v1/firewall/profiles/{id}

`kyvernon firewall profiles delete`

Delete a profile that no vNIC uses

Usage

kyvernon firewall profiles delete [OPTIONS] <ID>

Argument	Description	Required
`<ID>`	Profile id	yes
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: DELETE /v1/firewall/profiles/{id}

`kyvernon firewall settings`

Domain-wide firewall settings

Usage

kyvernon firewall settings <COMMAND>

Subcommands: show, set

`kyvernon firewall settings show`

Show the settings

Usage

kyvernon firewall settings show

API operation: GET /v1/firewall/settings

`kyvernon firewall settings set`

Change settings: the flags given replace those values

Usage

kyvernon firewall settings set [OPTIONS]

Argument	Description	Required
`--log-rate-pps`	Log rate per host, packets per second
`--reject-rate-pps`	Reject answers per second per bridge
`--flow-limit-per-bridge`	Firewall flows per host bridge
`--ct-limit-per-port`	Connection-tracking entries per vNIC
`--monitor-report-days`	Days a monitor report covers (1 to 90)
`--enforce-new`	New vNICs get mode `enforce` (stored; this release starts new vNICs in mode `off`) values `true`, `false`
`--body`	Inline JSON body
`--body-file`	File with the JSON body (`-` for stdin)
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: PUT /v1/firewall/settings

`kyvernon firewall tag-categories`

Tag categories and whether they are provider-managed

Usage

kyvernon firewall tag-categories <COMMAND>

Subcommands: list, set

`kyvernon firewall tag-categories list`

List the tag categories

Usage

kyvernon firewall tag-categories list

API operation: GET /v1/firewall/tag-categories

`kyvernon firewall tag-categories set`

Mark a category provider-managed or not

Usage

kyvernon firewall tag-categories set [OPTIONS] <ID>

Argument	Description	Required
`<ID>`	Category id (`category-N`)	yes
`--provider-managed`	Only the provider attaches its tags, and provider groups evaluate only such categories values `true`, `false`	yes
`--if-match`	Record version the write is based on (`If-Match`); a stale version fails with a conflict. Updates made with flags read the object first and use the version they read
`--wait`	Answer when the hosts concerned applied the change (`?wait=realized`); the hosts that did not in time are listed in `pendingHosts` and the exit code is 1
`--wait-timeout`	Longest `--wait`, in seconds (server default 30, at most 300)

API operation: PUT /v1/firewall/tag-categories/{id}

`kyvernon firewall vnic-profile`

Show or set the profile of one vNIC

Usage

kyvernon firewall vnic-profile [OPTIONS] <VM> <NIC>

Argument	Description	Required
`<VM>`	VM id	yes
`<NIC>`	NIC key (e.g. `4000`)	yes
`--profile`	Set this profile (a tenant user: a selectable one). Without `--profile` and `--reset` the vNIC's firewall is shown
`--reset`	Back to the profile of the NIC kind

API operation: PUT /v1/vms/{id}/nics/{key}/firewall

`kyvernon firewall bypass`

Emergency bypass of a host for a limited time (needs Kyvernon.Firewall.Bypass)

Usage

kyvernon firewall bypass [OPTIONS] <COMMAND>

Argument	Description	Required
`--host`	Host id
`--reason`	Why the host is opened (kept in the audit record)
`--for`	How long the bypass lasts, e.g. `30m` (it expires by itself)
`--wait`	Wait for the task to finish and print it

API operation: POST /v1/firewall/bypass

Subcommands: list, remove

`kyvernon firewall bypass list`

The bypasses in force

Usage

kyvernon firewall bypass list

API operation: GET /v1/firewall/bypass

`kyvernon firewall bypass remove`

End a bypass now

Usage

kyvernon firewall bypass remove [OPTIONS] <ID>

Argument	Description	Required
`<ID>`	Bypass id	yes
`--wait`	Wait for the task to finish and print it

API operation: DELETE /v1/firewall/bypass/{id}