idyl create - IDYL Docs

Create a resource. Resource types:

deployment
replicaset
daemonset
hostpodset
pod
job
sandbox
vm
cronjob
service
webapp
gateway
httproute
tlsroute
referencegrant
registry-credential
secret
certificate

Most workload resources are created from YAML manifests. A HostPodSet can also be created from flags that state its owner, isolation class, the CPU and memory one host reserves, and its host count. Sandboxes can also be created imperatively from an image, TTL, and target subnet. If —name is omitted for an imperative Sandbox create, the CLI generates a concrete Sandbox name before sending the request. Services and WebApps are created imperatively from their Deployment and Service-port references, and the gateway family (gateways, HTTP and TLS routes, reference grants) from flags.

Usage

idyl create [resource]

Commands

Command	Description
`idyl create certificate`	Create a workload TLS certificate
`idyl create cronjob`	Create a cronjob from a file
`idyl create daemonset`	Create a daemonset from a file
`idyl create deployment`	Create a deployment from a file
`idyl create gateway`	Create a Gateway claiming ingress hostnames
`idyl create hostpodset`	Create a hostpodset from flags or a file
`idyl create httproute`	Create an HTTPRoute from a Gateway to a Service port
`idyl create job`	Create a job from a file
`idyl create pod`	Create a pod from a file
`idyl create referencegrant`	Create a ReferenceGrant admitting cross-namespace routes
`idyl create registry-credential`	Create a private image-pull credential
`idyl create replicaset`	Create a replicaset from a file
`idyl create sandbox`	Create a disposable Sandbox
`idyl create secret`	Create a workload Secret
`idyl create service`	Create a Service over a Deployment port
`idyl create tlsroute`	Create a TLSRoute from a Gateway to a Service port
`idyl create vm`	Create a VirtualMachine
`idyl create webapp`	Create a WebApp for a Service port

Inherited flags

Flag	Description
`-a <string>, --account-id <string>`	Account ID to use, overriding the current context.
`-c <string>, --context <string>`	Use the named context for this command.
`--homedir <string>`	Override the configuration directory. Defaults to ~/.config/idyl.
`-n <string>, --namespace <string>`	Namespace to address, overriding the entered context.
`--network <string>`	Override the Network for this command.
`-p <string>, --profile <string>`	Override the access profile for this command.
`-s <string>, --subnet <string>`	Subnet to use for this command, overriding the current context.

Examples

# Create a deployment from a manifest
idyl create deployment -f deployment.yaml

# Create a Sandbox with a generated name
idyl create sandbox --image ubuntu:24.04 --ttl 2h --subnet <subnet>

# Create a Sandbox with an explicit name and isolation class
idyl create sandbox --name dev --image ubuntu:24.04 --ttl 24h --subnet <subnet> --isolation-class secure-container

# Create a VirtualMachine with a durable root disk
idyl create vm --image ubuntu:26.04 --cpu 4 --mem 4Gi --disk 100Gi --subnet <subnet>

# Create a registry credential
printf '%s' "$GHCR_TOKEN" | idyl create registry-credential ghcr-prod --registry ghcr.io --username <username> --password-stdin --subnet <subnet>

# Publish a Deployment through a generated WebApp hostname
idyl create service --name chat-api --target deployment/chat-api --port http=8080 --subnet <subnet>
idyl create webapp --name chat-api --service chat-api:http --subnet <subnet>

Subcommand reference

`idyl create certificate`

Create a workload TLS certificate

Usage

idyl create certificate <name> [flags]

Aliases

certificates

Flags

Flag	Description
`--ca-file <string>`	Optional PEM CA-chain file.
`--cert-file <string>`	Required. PEM certificate-chain file.
`--key-file <string>`	Required. PEM private-key file.
`-o <string>, --output <string>`	Output format: table, json, yaml. Default: `table`.

`idyl create cronjob`

Create a cronjob from a file

Usage

idyl create cronjob [flags]

Aliases

cronjobs
cj

Flags

Flag	Description
`-f <string>, --filename <string>`	Required. Path to the file containing the cronjob definition.
`--fleet <string>`	Constrain scheduling to eligible members of this fleet within the workload’s subnet, by fleet ID.
`--node <string>`	Constrain scheduling to this single node within the workload’s subnet, by node ID.

`idyl create daemonset`

Create a daemonset from a file

Usage

idyl create daemonset [flags]

Aliases

daemonsets
ds

Flags

Flag	Description
`-f <string>, --filename <string>`	Required. Path to the file containing the daemonset definition.
`--fleet <string>`	Constrain scheduling to eligible members of this fleet within the workload’s subnet, by fleet ID.
`--node <string>`	Constrain scheduling to this single node within the workload’s subnet, by node ID.

`idyl create deployment`

Create a deployment from a file

Usage

idyl create deployment [flags]

Aliases

deployments
deploy

Flags

Flag	Description
`-f <string>, --filename <string>`	Required. Path to the file containing the deployment definition.
`--fleet <string>`	Constrain scheduling to eligible members of this fleet within the workload’s subnet, by fleet ID.
`--node <string>`	Constrain scheduling to this single node within the workload’s subnet, by node ID.

`idyl create gateway`

Create a Gateway that claims public ingress hostnames. Each —hostname becomes one HTTPS listener terminated by the platform with managed certificates; HTTPRoutes attach to it. Each —tls-hostname becomes one TLS passthrough listener that forwards the client’s TLS bytes to the workload; TLSRoutes attach to it.

Usage

idyl create gateway --name <name> --hostname <hostname> --subnet <subnet> [flags]

Aliases

gateways
gw

Flags

Flag	Description
`--hostname <stringArray>`	Hostname served by an HTTPS listener; repeatable.
`--name <string>`	Required. Gateway name.
`--tls-hostname <stringArray>`	Hostname served by a TLS passthrough listener; repeatable.

Examples

idyl create gateway --name web --hostname app.example.com --subnet <subnet>
idyl create gateway --name edge --hostname app.example.com --hostname api.example.com --tls-hostname db.example.com --subnet <subnet>

`idyl create hostpodset`

Create a HostPodSet in the resolved Namespace, from flags or from the manifest named by -f/—filename. A HostPodSet keeps a counted set of host Pods. A host Pod runs no workload of its own: it reserves CPU and memory on a Node for isolated units that a node agent creates inside it later. The HostPodSet decides how many hosts exist, where they may be placed, and the isolation class of the units they hold. Hosts are placed across the eligible Nodes of the subnet, or of one fleet with —fleet. —node is refused, because a HostPodSet is not placed on a single Node. From flags, the name and —owner, —isolation, —cpu, —memory, and —max are required; —count and —min default to 0. A —min above zero is a reservation: that many hosts, and the capacity they reserve, stay placed while nothing runs in them. Hosts are replaced one at a time, with no surge, when the template changes. A manifest can state another replacement strategy or a controller. A host Pod sets no network for its units: each unit states its own.

Usage

idyl create hostpodset [name] [flags]

Aliases

hostpodsets
hps

Flags

Flag	Description
`--count <uint64>`	Number of hosts to keep placed, between —min and —max. Default: `0`.
`--cpu <string>`	CPU one host reserves, such as 500m or 2.
`-f <string>, --filename <string>`	Path to the file containing the hostpodset definition.
`--fleet <string>`	Constrain scheduling to eligible members of this fleet within the workload’s subnet, by fleet ID.
`--gpu <string>`	GPU devices one host reserves, such as h100, 2:h100, or nvidia:24Gi.
`--isolation <string>`	Isolation class of the units the hosts hold: secure-container or microvm.
`--max <uint64>`	Most hosts the set may be scaled to; at least 1. Default: `0`.
`--memory <string>`	Memory one host reserves, such as 512Mi or 4Gi.
`--min <uint64>`	Fewest hosts the set may be scaled to. That many hosts stay placed, reserving their capacity, while they hold nothing. Default: `0`.
`--node <string>`	Constrain scheduling to this single node within the workload’s subnet, by node ID.
`--owner <string>`	Owner label naming whom the hosts serve: 1 to 128 lowercase letters, digits, ’-’, ’.’, and ’/’. Fixed at creation.

Examples

# Keep two microvm hosts that reserve 2 CPUs and 4Gi each, up to four
idyl create hostpodset sandbox-hosts --owner team-a --isolation microvm --cpu 2 --memory 4Gi --count 2 --max 4

# Place the hosts on one fleet's nodes
idyl create hostpodset sandbox-hosts --owner team-a --isolation secure-container --cpu 1 --memory 2Gi --max 8 --fleet 100000000201

# Create from a manifest
idyl create hostpodset -f hostpodset.yaml

`idyl create httproute`

Create an HTTPRoute that routes HTTP traffic from a Gateway’s HTTPS listeners to one Service port by hostname and path. —port names a Service port, never a number. Route hostnames are intersected with the listener’s hostname at admission.

Usage

idyl create httproute --name <name> --parent <gateway> --hostname <hostname> --service <service> --port <portName> --subnet <subnet> [flags]

Aliases

httproutes

Flags

Flag	Description
`--hostname <stringArray>`	Required. Hostname the route serves; repeatable.
`--name <string>`	Required. HTTPRoute name.
`--parent <string>`	Required. Gateway the route attaches to.
`--path <string>`	Request path the rule matches.
`--path-type <string>`	Path match type (PathPrefix\|Exact). Default: `PathPrefix`.
`--port <string>`	Required. Service port name on the backend.
`--section <string>`	Gateway listener name to attach to. Defaults to every compatible listener.
`--service <string>`	Required. Service backend name.

Examples

idyl create httproute --name web --parent edge --hostname app.example.com --service chat-api --port http --subnet <subnet>
idyl create httproute --name api --parent edge --section web-0 --hostname app.example.com --service chat-api --port http --path /api --path-type PathPrefix --subnet <subnet>

`idyl create job`

Create a job from a file

Usage

idyl create job [flags]

Aliases

jobs

Flags

Flag	Description
`-f <string>, --filename <string>`	Required. Path to the file containing the job definition.
`--fleet <string>`	Constrain scheduling to eligible members of this fleet within the workload’s subnet, by fleet ID.
`--node <string>`	Constrain scheduling to this single node within the workload’s subnet, by node ID.

`idyl create pod`

Create a pod from a file

Usage

idyl create pod [flags]

Aliases

pods

Flags

Flag	Description
`-f <string>, --filename <string>`	Required. Path to the file containing the pod definition.
`--fleet <string>`	Constrain scheduling to eligible members of this fleet within the workload’s subnet, by fleet ID.
`--node <string>`	Constrain scheduling to this single node within the workload’s subnet, by node ID.

`idyl create referencegrant`

Create a ReferenceGrant that permits routes in another namespace to reference Services in the grant’s own namespace. The grant lives in the target namespace and grants inward; absent a grant, a cross-namespace reference fails closed. Omit —to-service to cover every Service in the namespace.

Usage

idyl create referencegrant --name <name> --from-kind <HTTPRoute|TLSRoute> --from-namespace <namespace> --subnet <subnet> [flags]

Aliases

referencegrants

Flags

Flag	Description
`--from-kind <string>`	Required. Route kind the grant admits (HTTPRoute or TLSRoute).
`--from-namespace <string>`	Required. Namespace the granted routes originate from.
`--name <string>`	Required. ReferenceGrant name.
`--to-service <string>`	Service the grant covers. Defaults to every Service in the namespace.

Examples

idyl create referencegrant --name from-web --from-kind HTTPRoute --from-namespace web --subnet <subnet>
idyl create referencegrant --name from-edge --from-kind TLSRoute --from-namespace edge --to-service postgres --subnet <subnet>

`idyl create registry-credential`

Create a RegistryCredential in the selected namespace and subnet. The password is read only from stdin or an interactive hidden prompt. There is no flag that accepts the password as a command argument.

Usage

idyl create registry-credential <name> [flags]

Aliases

registry-credentials

Flags

Flag	Description
`-o <string>, --output <string>`	Output format: table, json, yaml. Default: `table`.
`--password-stdin`	Read the registry password from stdin.
`--registry <string>`	Required. Registry host, such as ghcr.io.
`--repository-prefix <stringArray>`	Allowed repository prefix; repeatable.
`--username <string>`	Required. Registry username.

Examples

printf '%s' "$GHCR_TOKEN" | idyl create registry-credential ghcr-prod --registry ghcr.io --username <username> --password-stdin --subnet <subnet>

`idyl create replicaset`

Create a replicaset from a file

Usage

idyl create replicaset [flags]

Aliases

replicasets
rs

Flags

Flag	Description
`-f <string>, --filename <string>`	Required. Path to the file containing the replicaset definition.
`--fleet <string>`	Constrain scheduling to eligible members of this fleet within the workload’s subnet, by fleet ID.
`--node <string>`	Constrain scheduling to this single node within the workload’s subnet, by node ID.

`idyl create sandbox`

Create a disposable Sandbox workload inside an IDYL subnet. Provide a container image, a required TTL duration, and a target subnet. TTL uses duration strings such as 15m, 2h, or 24h. If —name is omitted, the CLI generates a concrete Sandbox name before sending the create request. Command and args values are split using shell-style quoting, so quoted substrings stay together as one container argument. By default, IDYL keeps the Sandbox open until its TTL expires or it is deleted. Use —use-image-entrypoint to let the image ENTRYPOINT/CMD control the process, or —command with optional —args to run an explicit command. Use —isolation-class container, secure-container, or microvm to request the Sandbox pod template isolation class when that value is allowed by the target subnet.

Usage

idyl create sandbox --image <image> --ttl <duration> --subnet <subnet> [--name <name>] [flags]

Aliases

sandboxes

Flags

Flag	Description
`--args <string>`	Override the container CMD arguments, split as shell-style words.
`--command <string>`	Override the container ENTRYPOINT, split as shell-style words.
`--cpu <string>`	CPU limit, such as 100m or 0.5. Defaults to the configured value.
`-e <stringArray>, --env <stringArray>`	Environment variable in KEY=VALUE form; repeatable.
`--fleet <string>`	Constrain scheduling to eligible members of this fleet within the workload’s subnet, by fleet ID.
`--gpu <string>`	GPU requirement, such as rtx5090, 2:h100, or nvidia:24Gi.
`--image <string>`	Required. Container image URI for the Sandbox pod template.
`--image-pull-credential <string>`	RegistryCredential name in the workload namespace.
`--isolation-class <string>`	Workload isolation class (container, secure-container, or microvm); must be allowed by the target subnet.
`--memory <string>`	Memory limit, such as 128Mi or 512Mi. Defaults to the configured value.
`--name <string>`	Sandbox name. If omitted, the CLI generates a concrete name before creating the Sandbox.
`--network-class <string>`	Workload network class (internet, none, restricted-egress, or unrestricted); when omitted the server applies internet, the public internet with local networks blocked, whatever the isolation class.
`--node <string>`	Constrain scheduling to this single node within the workload’s subnet, by node ID.
`--platform <string>`	Target workload platform: linux/amd64 or linux/arm64.
`--ttl <string>`	Required. Sandbox TTL duration, such as 15m, 2h, or 24h.
`--use-image-entrypoint`	Use the image ENTRYPOINT and CMD lifecycle instead of holding the Sandbox open.

Examples

# Create a Sandbox with a generated name
idyl create sandbox --image ubuntu:24.04 --ttl 2h --subnet <subnet>

# Create a Sandbox that uses the image ENTRYPOINT/CMD
idyl create sandbox --image my-image --ttl 2h --subnet <subnet> --use-image-entrypoint

# Create a Sandbox that runs an explicit command
idyl create sandbox --image my-image --ttl 2h --subnet <subnet> --command "/app/dev-server" --args "--port 8080"

# Create a named Sandbox that requests secure-container isolation
idyl create sandbox --name dev --image ubuntu:24.04 --ttl 24h --subnet <subnet> --isolation-class secure-container

# Create a Sandbox from a private registry using a stored RegistryCredential
idyl create sandbox --image ghcr.io/acme/dev:latest --ttl 2h --subnet <subnet> --image-pull-credential ghcr-prod

`idyl create secret`

Create a workload Secret

Usage

idyl create secret <name> [flags]

Aliases

secrets

Flags

Flag	Description
`--data-stdin <string>`	Read one value from stdin for this key.
`--from-env-file <stringArray>`	Read KEY=VALUE entries from a bounded env file; repeatable.
`--from-file <stringArray>`	Read one value from key=path; repeatable.
`--key <string>`	Key used by the interactive hidden prompt. Default: `value`.
`-o <string>, --output <string>`	Output format: table, json, yaml. Default: `table`.

`idyl create service`

Create a Service that defines a stable named HTTP port over one Deployment target.

Usage

idyl create service --name <name> --target deployment/<deploymentName> --port <portName>=<targetPort> --subnet <subnet> [flags]

Aliases

services

Flags

Flag	Description
`--name <string>`	Required. Service name.
`--port <stringArray>`	Required. HTTP Service port in name=targetPort form; repeatable.
`--target <string>`	Required. Deployment target in deployment/<name> form.

Examples

idyl create service --name chat-api --target deployment/chat-api --port http=8080 --subnet <subnet>
idyl create service --name api --target deployment/api --port http=8080 --port metrics=9090 --subnet <subnet>

`idyl create tlsroute`

Create a TLSRoute that routes TLS traffic from a Gateway’s TLS passthrough listeners to one Service port by SNI hostname. The client’s TLS runs end-to-end to the workload. —port names a Service port, never a number.

Usage

idyl create tlsroute --name <name> --parent <gateway> --hostname <hostname> --service <service> --port <portName> --subnet <subnet> [flags]

Aliases

tlsroutes

Flags

Flag	Description
`--hostname <stringArray>`	Required. SNI hostname the route serves; repeatable.
`--name <string>`	Required. TLSRoute name.
`--parent <string>`	Required. Gateway the route attaches to.
`--port <string>`	Required. Service port name on the backend.
`--service <string>`	Required. Service backend name.

Examples

idyl create tlsroute --name db --parent edge --hostname db.example.com --service postgres --port pg --subnet <subnet>

`idyl create vm`

Create a durable VirtualMachine inside an IDYL subnet. The CLI sends the VM image alias as supplied, such as ubuntu:26.04. Image aliases are resolved by the platform before node assignment; the CLI does not resolve aliases to artifact URLs. If —name is omitted, the CLI generates a concrete VirtualMachine name before sending the request.

Usage

idyl create vm --image <image> --cpu <cpu> --mem <memory> --disk <size> --subnet <subnet> [--name <name>] [flags]

Aliases

vms
virtualmachine
virtualmachines

Flags

Flag	Description
`--cpu <string>`	Required. VM CPU request, such as 500m, 2, or 4.
`--disk <string>`	Required. Durable root disk size, such as 20Gi or 100Gi.
`--fleet <string>`	Constrain scheduling to eligible members of this fleet within the workload’s subnet, by fleet ID.
`--hostname <string>`	Guest hostname for first boot.
`--image <string>`	Required. Curated VM image alias, such as ubuntu:26.04.
`--mem <string>`	Required. VM memory request, such as 1Gi or 4096Mi.
`--name <string>`	VirtualMachine name. If omitted, the CLI generates a concrete name before creating the VirtualMachine.
`--network-class <string>`	VM network class: none or unrestricted.
`--node <string>`	Constrain scheduling to this single node within the workload’s subnet, by node ID.
`--platform <string>`	Guest platform, such as linux/amd64.
`--ssh-key <stringArray>`	SSH public key to inject at first boot; repeatable.
`--user-data-ref <string>`	Vault Secret name for cloud-init user-data.

Examples

# Create a VirtualMachine with a generated name
idyl create vm --image ubuntu:26.04 --cpu 4 --mem 4Gi --disk 100Gi --subnet <subnet>

# Create a named VirtualMachine with an unrestricted network
idyl create vm --name dev-vm --image ubuntu:26.04 --cpu 2 --mem 2Gi --disk 40Gi --subnet <subnet> --network-class unrestricted

`idyl create webapp`

Create a WebApp that publishes one Service port through an IDYL-generated HTTPS hostname.

Usage

idyl create webapp --name <name> --service <serviceName>:<portName> --subnet <subnet> [flags]

Aliases

webapps

Flags

Flag	Description
`--name <string>`	Required. WebApp name.
`--service <string>`	Required. Service port in serviceName:portName form.

Examples

idyl create webapp --name chat-api --service chat-api:http --subnet <subnet>

​Usage

​Commands

​Inherited flags

​Examples

​Subcommand reference

​idyl create certificate

​Usage

​Aliases

​Flags

​idyl create cronjob

​Usage

​Aliases

​Flags

​idyl create daemonset

​Usage

​Aliases

​Flags

​idyl create deployment

​Usage

​Aliases

​Flags

​idyl create gateway

​Usage

​Aliases

​Flags

​Examples

​idyl create hostpodset

​Usage

​Aliases

​Flags

​Examples

​idyl create httproute

​Usage

​Aliases

​Flags

​Examples

​idyl create job

​Usage

​Aliases

​Flags

​idyl create pod

​Usage

​Aliases

​Flags

​idyl create referencegrant

​Usage

​Aliases

​Flags

​Examples

​idyl create registry-credential

​Usage

​Aliases

​Flags

​Examples

​idyl create replicaset

​Usage

​Aliases

​Flags

​idyl create sandbox

​Usage

​Aliases

​Flags

​Examples

​idyl create secret

​Usage

​Aliases

​Flags

​idyl create service

​Usage

​Aliases

​Flags

​Examples

​idyl create tlsroute

​Usage

​Aliases

​Flags

​Examples

​idyl create vm

​Usage

​Aliases

Usage

Commands

Inherited flags

Examples

Subcommand reference

`idyl create certificate`

Usage

Aliases

Flags

`idyl create cronjob`

Usage

Aliases

Flags

`idyl create daemonset`

Usage

Aliases

Flags

`idyl create deployment`

Usage

Aliases

Flags

`idyl create gateway`

Usage

Aliases

Flags

Examples

`idyl create hostpodset`

Usage

Aliases

Flags

Examples

`idyl create httproute`

Usage

Aliases

Flags

Examples

`idyl create job`

Usage

Aliases

Flags

`idyl create pod`

Usage

Aliases

Flags

`idyl create referencegrant`

Usage

Aliases

Flags

Examples

`idyl create registry-credential`

Usage

Aliases

Flags

Examples

`idyl create replicaset`

Usage

Aliases

Flags

`idyl create sandbox`

Usage

Aliases

Flags

Examples

`idyl create secret`

Usage

Aliases

Flags

`idyl create service`

Usage

Aliases

Flags

Examples

`idyl create tlsroute`

Usage

Aliases

Flags

Examples

`idyl create vm`

Usage

Aliases