Skip to main content
View and manage subnets. Subnets define groups of nodes organized by region. Admission is managed separately for developer accounts and provider fleets or nodes. Subnet runtime policy controls which workload isolation intent a subnet accepts. Use —allowed-isolation-class when creating or editing a subnet to allow container, secure-container, microvm, or a combination. Use —default-isolation-class when workloads that omit —isolation-class should inherit a subnet default. Runtime policy does not install or prove a runtime on provider nodes; scheduled workloads still require matching node capabilities. A globally unique slug is auto-generated when a subnet is created. An optional display name can be set for presentation; it is never used as an identifier.

Usage

Aliases

  • subnets

Commands

Inherited flags

Examples

Subcommand reference

idyl subnet admission

Manage typed subnet admission. Developer admission controls which accounts may submit workloads. Provider admission controls which fleets or nodes may join as capacity. A provider grant naming an account is an invitation: fleets that account creates in the subnet are admitted when they are created, and revoking the invitation revokes them. In approval mode, a fleet another account creates records a request the subnet’s owner decides with ‘idyl subnet admission request’.

Usage

Aliases

  • admissions

Commands

Examples

idyl subnet admission get

Get subnet admission

Usage

Aliases

  • list
  • ls

Flags

idyl subnet admission grant

Grant subnet admission

Usage

Flags

idyl subnet admission request

List and decide the admission requests recorded on a subnet you own. A request is recorded when another account creates a fleet in a subnet whose provider admission mode is approval. Until it is decided, the fleet’s Attached condition reads AwaitingAdmissionApproval and the fleet serves nothing. Approving admits the fleet and creates its admission grant in the same step; rejecting leaves the fleet unadmitted.

Usage

Aliases

  • requests
  • req

Commands

Examples

idyl subnet admission request approve

Approve a pending admission request, admitting its fleet or node to the subnet. The admission grant is created in the same step, and the fleet’s Attached condition turns true once the platform observes it.

Usage

Flags

Examples

idyl subnet admission request get

List every admission request recorded on a subnet you own, newest first.

Usage

Aliases

  • list
  • ls

Flags

Examples

idyl subnet admission request reject

Reject a pending admission request. No grant is created; the fleet stays created but serves nothing, and its Attached condition reads AdmissionRejected. A fleet never changes subnet, so it serves nothing until the subnet’s owner admits it with ‘idyl subnet admission grant’.

Usage

Flags

Examples

idyl subnet admission revoke

Revoke subnet admission

Usage

Flags

idyl subnet admission set

Set an admission mode

Usage

Flags

idyl subnet approve

Approve a subnet for account deploy access. This grants the current account permission to create new workloads in the subnet, provided the subnet’s region is also enabled for the account. Provider capacity admission is managed separately with ‘idyl subnet admission’.

Usage

Flags

Examples

idyl subnet attach

Attach a leased fleet to a subnet. A lease’s subnet is set once: a lease may be created without one and parks unattached, meters nothing, and holds no capacity until it is attached, after which cancelling the lease is the only detach. A fleet is not attached: it names its subnet when it is created, with ‘idyl fleet create —subnet’, and serves that subnet for its whole life.

Usage

Flags

Examples

idyl subnet create

Create a new subnet in a region. A globally unique slug is auto-generated server-side. Use —display-name for optional presentation text; display names are not identifiers and need not be unique. Use runtime policy flags when the subnet should accept only specific workload isolation intent. If —default-isolation-class is set, workloads that omit —isolation-class inherit that default. If a runtime policy has no default, workloads must set —isolation-class explicitly. Runtime policy does not install or prove a runtime on provider nodes; scheduling still requires matching node capabilities. Registry Credentials and Vault have separate policies. Use —enable-registry-credentials for private image-pull credentials and —enable-vault for workload Secret and TLSCertificate projection. New subnets default to the denied root policy: workloads whose image would run as uid 0 are rejected at start. Pass —root-policy allowed to honor image users as-is.

Usage

Flags

Examples

idyl subnet delete

Delete a subnet. The argument is the subnet’s canonical slug. You will be prompted for confirmation unless the —yes flag is provided.

Usage

Flags

Examples

idyl subnet edit

Edit a subnet’s properties. The argument is the subnet’s canonical slug. Use —set-display-name to set presentation text or —clear-display-name to remove it. Display names are not identifiers and need not be unique. Runtime policy flags replace the subnet runtime policy. Use —allowed-isolation-class to set the allowed workload isolation intent. Use —default-isolation-class when workloads without explicit —isolation-class should inherit a subnet default. A runtime policy admits VirtualMachines and DaemonSets only with —allow-virtual-machines and —allow-daemonsets, so state them again on every replacement that should keep them; a policy without —allow-daemonsets stops the pods of every DaemonSet in the subnet. Use —clear-runtime-policy to remove subnet runtime policy. Runtime policy does not install or prove a runtime on provider nodes; scheduling still requires matching node capabilities. Use —root-policy to set the subnet’s root-user policy: denied rejects workloads whose image would run as uid 0 (with a reason-coded start failure on the node); allowed honors the image user as-is. The policy applies to assignments dispatched after the change; running pods keep running until their next restart or reschedule. DaemonSet terms flags replace the subnet’s terms whole: the accounts whose DaemonSets may run on fleets other accounts own, and what those DaemonSets may reserve together on one node (—daemonset-terms-cpu and —daemonset-terms-memory are required, —daemonset-terms-gpus defaults to 0). Narrower terms apply to every fleet at once and stop the pods they no longer admit; wider terms reach a fleet only when its owner accepts the new revision. —clear-daemonset-terms removes the terms and requires confirmation unless —yes is provided. Registry Credentials and Vault policy flags are independent. Disable operations require confirmation unless —yes is provided and do not destroy stored ciphertext.

Usage

Flags

Examples

idyl subnet get

Get details of a specific managed subnet, or list managed subnets. With no arguments, lists subnets owned by the current account. With a slug argument, gets details of that managed subnet.

Usage

Aliases

  • list
  • ls

Flags

Examples

idyl subnet show

Show details of the current subnet from the active context. The subnet is resolved from the —subnet flag, IDYL_SUBNET environment variable, or the current context.

Usage

Flags

Examples

idyl subnet store-admission

Admit Stores to a subnet, as its owner. Computers and Filesystems created in the subnet keep their saved versions in an admitted Store: the one they name, or the subnet’s default. Admission governs only new placement; existing Computers and Filesystems keep their Store and stay readable when it is removed. ‘idyl store get’ lists the admitted Stores.

Usage

Aliases

  • store-admissions

Commands

Examples

idyl subnet store-admission add

Admit a Store to the subnet named by —subnet. —default makes it the subnet’s only default Store; —default=false admits it without changing the default. Without —default the server keeps its own choice.

Usage

Flags

idyl subnet store-admission edit

Change whether an admitted Store is the default of the subnet named by —subnet. —default makes it the only default; —default=false withdraws it, leaving the subnet without a default rather than choosing another.

Usage

Flags

idyl subnet store-admission remove

Stop new placement on a Store in the subnet named by —subnet. Computers and Filesystems already in the Store keep it and stay readable. Removing the default leaves the subnet without one.

Usage

idyl subnet unapprove

Remove subnet deploy access from the account. Existing workloads are not stopped, but new deployments to the subnet will be blocked once access is removed.

Usage

Flags

Examples