idyl subnet - IDYL Docs

View and manage subnets. Subnets define groups of nodes organized by region. Admission is managed separately for developer accounts and provider fleets or nodes. Subnet runtime policy controls which workload isolation intent a subnet accepts. Use —allowed-isolation-class when creating or editing a subnet to allow container, secure-container, microvm, or a combination. Use —allowed-vmm-backend to restrict Kata-backed secure-container nodes by backend. Use —default-isolation-class when workloads that omit —isolation-class should inherit a subnet default. Runtime policy does not install or prove a runtime on provider nodes; scheduled workloads still require matching node capabilities. A globally unique slug is auto-generated when a subnet is created. An optional display name can be set for presentation; it is never used as an identifier.

Usage

idyl subnet

Aliases

subnets

Commands

Command	Description
`idyl subnet admission`	Manage subnet admission
`idyl subnet approve`	Approve a subnet for account deploy access
`idyl subnet create`	Create a subnet
`idyl subnet delete`	Delete a subnet
`idyl subnet edit`	Edit a subnet
`idyl subnet get`	Get managed subnet details or list managed subnets
`idyl subnet show`	Show current subnet details
`idyl subnet unapprove`	Remove subnet deploy access from the account

Inherited flags

Flag	Description
`-a <string>, --account-id <string>`	Account ID to use, overriding the current context.
`-c <string>, --context <string>`	Use the named context for this command.
`--homedir <string>`	Override the configuration directory. Defaults to ~/.config/idyl.
`-n <string>, --namespace <string>`	Namespace to use for this command.
`-o <string>, --output <string>`	Output format (json\|yaml).
`-p <string>, --profile <string>`	Override the access profile for this command.
`--realm <string>`	Override the realm for this command.
`--subnet <string>`	Override the context subnet for this command.

Examples

# Create a subnet (slug auto-generated)
idyl subnet create --region us-east

# Create a subnet that accepts only secure-container isolation intent and defaults omitted isolation
idyl subnet create --region us-east --allowed-isolation-class secure-container --default-isolation-class secure-container

# Create a subnet that accepts only explicit secure-container isolation intent
idyl subnet create --region us-east --allowed-isolation-class secure-container

# Create a subnet that accepts only microVM isolation intent and defaults omitted isolation
idyl subnet create --region us-east --allowed-isolation-class microvm --default-isolation-class microvm

# Create a subnet with subnet-bound Secrets enabled
idyl subnet create --region us-east --enable-secrets

# Create a subnet that accepts only Kata + Firecracker secure-container nodes
idyl subnet create --region us-east --allowed-isolation-class secure-container --allowed-vmm-backend firecracker

# Show current subnet details
idyl subnet show

# List subnets
idyl subnet list

# Get subnet details by slug
idyl subnet get <subnet-slug>

# Set developer admission mode
idyl subnet admission set --subnet <subnet-slug> --admission-type developer --mode approval

# Admit a developer account
idyl subnet admission grant --subnet <subnet-slug> --developer-account <account-id>

# Admit a provider fleet
idyl subnet admission grant --subnet <subnet-slug> --provider-fleet <fleet-id>

# Delete a subnet
idyl subnet delete <subnet-slug>

Subcommand reference

`idyl subnet admission`

Manage typed subnet admission. Developer admission controls which accounts may submit workloads. Provider admission controls which fleets or nodes may join as capacity.

Usage

idyl subnet admission

Aliases

admissions

Commands

Command	Description
`idyl subnet admission get`	Get subnet admission
`idyl subnet admission grant`	Grant subnet admission
`idyl subnet admission revoke`	Revoke subnet admission
`idyl subnet admission set`	Set an admission mode

Examples

idyl subnet admission get --subnet <subnet>
idyl subnet admission set --subnet <subnet> --admission-type developer --mode approval
idyl subnet admission grant --subnet <subnet> --developer-account <account-id>
idyl subnet admission grant --subnet <subnet> --provider-fleet <fleet-id>
idyl subnet admission grant --subnet <subnet> --provider-node <node-id>
idyl subnet admission revoke --subnet <subnet> --grant <grant-id>

`idyl subnet admission get`

Get subnet admission

Usage

idyl subnet admission get [flags]

Aliases

list
ls

Flags

Flag	Description
`-o <string>, --output <string>`	Output format: table, json, or yaml. Default: `table`.
`--subnet <string>`	Required. Canonical subnet slug.

`idyl subnet admission grant`

Grant subnet admission

Usage

idyl subnet admission grant [flags]

Flags

Flag	Description
`--developer-account <string>`	Account ID to grant developer admission.
`-o <string>, --output <string>`	Output format: table, json, or yaml. Default: `table`.
`--provider-fleet <string>`	Fleet ID to grant provider admission.
`--provider-node <string>`	Node ID to grant provider admission.
`--subnet <string>`	Required. Canonical subnet slug.

`idyl subnet admission revoke`

Revoke subnet admission

Usage

idyl subnet admission revoke [flags]

Flags

Flag	Description
`--grant <string>`	Required. Admission grant ID.
`--subnet <string>`	Required. Canonical subnet slug.

`idyl subnet admission set`

Set an admission mode

Usage

idyl subnet admission set [flags]

Flags

Flag	Description
`--admission-type <string>`	Required. Admission type: developer or provider.
`--mode <string>`	Required. Admission mode: open, approval, or invite.
`-o <string>, --output <string>`	Output format: table, json, or yaml. Default: `table`.
`--subnet <string>`	Required. Canonical subnet slug.

`idyl subnet approve`

Approve a subnet for account deploy access. This grants the current account permission to create new workloads in the subnet, provided the subnet’s region is also enabled for the account. Provider capacity admission is managed separately with ‘idyl subnet admission’.

Usage

idyl subnet approve <slug> [flags]

Flags

Flag	Description
`-o <string>, --output <string>`	Output format: table, json, or yaml. Default: `table`.

Examples

idyl subnet approve <subnet-slug>

`idyl subnet create`

Create a new subnet in a region. A globally unique slug is auto-generated server-side. Use —display-name for optional presentation text; display names are not identifiers and need not be unique. Use runtime policy flags when the subnet should accept only specific workload isolation intent or Kata VMM backends. If —default-isolation-class is set, workloads that omit —isolation-class inherit that default. If a runtime policy has no default, workloads must set —isolation-class explicitly. Runtime policy does not install or prove a runtime on provider nodes; scheduling still requires matching node capabilities. Use —enable-secrets when the subnet should accept subnet-bound Secrets for registry credentials, workload secret references, and node reads. New subnets default to the denied root policy: workloads whose image would run as uid 0 are rejected at start. Pass —root-policy allowed to honor image users as-is.

Usage

idyl subnet create [flags]

Flags

Flag	Description
`--allow-virtual-machines`	Admit VirtualMachine workloads into the subnet. Subnets with a runtime policy must opt in explicitly.
`--allowed-isolation-class <stringSlice>`	Allowed workload isolation intent for this subnet (container, secure-container, microvm); repeat the flag or comma-separate values.
`--allowed-vmm-backend <stringSlice>`	Allowed Kata VMM backend for secure-container nodes in this subnet (qemu, firecracker); repeat the flag or comma-separate values.
`--default-isolation-class <string>`	Default isolation intent for workloads that omit —isolation-class; must be one of the allowed classes.
`--description <string>`	Subnet description.
`--disable-secrets`	Disable subnet-bound Secrets for secret creation, workload references, and node reads.
`--display-name <string>`	Optional user-facing subnet display name.
`--enable-secrets`	Enable subnet-bound Secrets for secret creation, workload references, and node reads.
`-o <string>, --output <string>`	Output format: table, json, or yaml. Default: `table`.
`--region <string>`	Region to host the subnet in.
`--root-policy <string>`	Root policy for this subnet: allowed or denied. When denied, the subnet rejects workloads whose image would run as uid 0.

Examples

# Interactive — prompts for all required values
idyl subnet create

# Fully non-interactive
idyl subnet create --region us-east --display-name "Production"

# Create a subnet with Secrets enabled
idyl subnet create --region us-east --enable-secrets

# Create a subnet that allows root workloads
idyl subnet create --region us-east --root-policy allowed

# Create a subnet that accepts only secure-container isolation intent and defaults omitted isolation
idyl subnet create --region us-east --allowed-isolation-class secure-container --default-isolation-class secure-container

# Create a subnet that accepts only explicit secure-container isolation intent
idyl subnet create --region us-east --allowed-isolation-class secure-container

# Create a subnet that accepts only microVM isolation intent and defaults omitted isolation
idyl subnet create --region us-east --allowed-isolation-class microvm --default-isolation-class microvm

# Create a subnet that accepts only Kata + Firecracker secure-container nodes
idyl subnet create --region us-east --allowed-isolation-class secure-container --allowed-vmm-backend firecracker

# Create a subnet that also admits VirtualMachine workloads
idyl subnet create --region us-east --allowed-isolation-class container --allow-virtual-machines

# Accept both container and secure-container isolation intent
idyl subnet create --region us-east --allowed-isolation-class container --allowed-isolation-class secure-container

`idyl subnet delete`

Delete a subnet. The argument is the subnet’s canonical slug. You will be prompted for confirmation unless the —yes flag is provided.

Usage

idyl subnet delete <slug> [flags]

Flags

Flag	Description
`-y, --yes`	Skip confirmation prompts.

Examples

# Delete a subnet by slug (with confirmation)
idyl subnet delete <subnet-slug>

# Delete without confirmation
idyl subnet delete <subnet-slug> --yes

`idyl subnet edit`

Edit a subnet’s properties. The argument is the subnet’s canonical slug. Use —set-display-name to set presentation text or —clear-display-name to remove it. Display names are not identifiers and need not be unique. Runtime policy flags replace the subnet runtime policy. Use —allowed-isolation-class to set the allowed workload isolation intent and —allowed-vmm-backend to restrict Kata-backed secure-container nodes by backend. Use —default-isolation-class when workloads without explicit —isolation-class should inherit a subnet default. Use —clear-runtime-policy to remove subnet runtime policy. Runtime policy does not install or prove a runtime on provider nodes; scheduling still requires matching node capabilities. Use —root-policy to set the subnet’s root-user policy: denied rejects workloads whose image would run as uid 0 (with a reason-coded start failure on the node); allowed honors the image user as-is. The policy applies to assignments dispatched after the change; running pods keep running until their next restart or reschedule. Secrets policy flags replace the subnet Secrets policy. Use —enable-secrets to allow subnet-bound secret creation, workload secret references, and node secret reads. Use —disable-secrets to stop those flows; this requires confirmation unless —yes is provided.

Usage

idyl subnet edit <slug> [flags]

Flags

Flag	Description
`--allow-virtual-machines`	Admit VirtualMachine workloads into the subnet. Subnets with a runtime policy must opt in explicitly.
`--allowed-isolation-class <stringSlice>`	Allowed workload isolation intent for this subnet (container, secure-container, microvm); repeat the flag or comma-separate values.
`--allowed-vmm-backend <stringSlice>`	Allowed Kata VMM backend for secure-container nodes in this subnet (qemu, firecracker); repeat the flag or comma-separate values.
`--clear-display-name`	Remove the subnet display name.
`--clear-runtime-policy`	Clear the subnet runtime policy so the subnet no longer filters by workload isolation intent.
`--default-isolation-class <string>`	Default isolation intent for workloads that omit —isolation-class; must be one of the allowed classes.
`--disable-secrets`	Disable subnet-bound Secrets for secret creation, workload references, and node reads.
`--enable-secrets`	Enable subnet-bound Secrets for secret creation, workload references, and node reads.
`-o <string>, --output <string>`	Output format: table, json, or yaml. Default: `table`.
`--root-policy <string>`	Root policy for this subnet: allowed or denied. When denied, the subnet rejects workloads whose image would run as uid 0.
`--set-description <string>`	Set the subnet description.
`--set-display-name <string>`	Set the user-facing subnet display name.
`-y, --yes`	Skip confirmation prompts.

Examples

# Set a user-facing display name
idyl subnet edit <subnet-slug> --set-display-name "Production"

# Remove the display name
idyl subnet edit <subnet-slug> --clear-display-name

# Update subnet description
idyl subnet edit <subnet-slug> --set-description "New description"

# Enable subnet-bound Secrets
idyl subnet edit <subnet-slug> --enable-secrets

# Disable subnet-bound Secrets without an interactive prompt
idyl subnet edit <subnet-slug> --disable-secrets --yes

# Accept only secure-container isolation intent and default omitted isolation
idyl subnet edit <subnet-slug> --allowed-isolation-class secure-container --default-isolation-class secure-container

# Accept only explicit secure-container isolation intent
idyl subnet edit <subnet-slug> --allowed-isolation-class secure-container

# Accept only microVM isolation intent and default omitted isolation
idyl subnet edit <subnet-slug> --allowed-isolation-class microvm --default-isolation-class microvm

# Accept only Kata + Firecracker secure-container nodes
idyl subnet edit <subnet-slug> --allowed-isolation-class secure-container --allowed-vmm-backend firecracker

# Accept both container and secure-container isolation intent
idyl subnet edit <subnet-slug> --allowed-isolation-class container --allowed-isolation-class secure-container

# Clear runtime policy
idyl subnet edit <subnet-slug> --clear-runtime-policy

# Allow root workloads on this subnet (a deliberate, recorded operator act)
idyl subnet edit <subnet-slug> --root-policy allowed

# Deny root workloads
idyl subnet edit <subnet-slug> --root-policy denied

# Update typed admission policy
idyl subnet admission set --subnet <subnet-slug> --admission-type developer --mode approval

`idyl subnet get`

Get details of a specific managed subnet, or list managed subnets. With no arguments, lists subnets owned by the current account. With a slug argument, gets details of that managed subnet.

Usage

idyl subnet get [slug] [flags]

Aliases

list
ls

Flags

Flag	Description
`-o <string>, --output <string>`	Output format: table, json, or yaml. Default: `table`.

Examples

# List subnets
idyl subnet get

# Get subnet details by slug
idyl subnet get <subnet-slug>

# Get in JSON format
idyl subnet get <subnet-slug> -o json

`idyl subnet show`

Show details of the current subnet from the active context. The subnet is resolved from the —subnet flag, IDYL_SUBNET environment variable, or the current context.

Usage

idyl subnet show [flags]

Flags

Flag	Description
`-o <string>, --output <string>`	Output format: table, json, or yaml. Default: `table`.

Examples

# Show current subnet details
idyl subnet show

# Show current subnet in JSON format
idyl subnet show -o json

`idyl subnet unapprove`

Remove subnet deploy access from the account. Existing workloads are not stopped, but new deployments to the subnet will be blocked once access is removed.

Usage

idyl subnet unapprove <slug> [flags]

Flags

Flag	Description
`-y, --yes`	Skip confirmation prompts.

Examples

idyl subnet unapprove <subnet-slug> --yes

​Usage

​Aliases

​Commands

​Inherited flags

​Examples

​Subcommand reference

​idyl subnet admission

​Usage

​Aliases

​Commands

​Examples

​idyl subnet admission get

​Usage

​Aliases

​Flags

​idyl subnet admission grant

​Usage

​Flags

​idyl subnet admission revoke

​Usage

​Flags

​idyl subnet admission set

​Usage

​Flags

​idyl subnet approve

​Usage

​Flags

​Examples

​idyl subnet create

​Usage

​Flags

​Examples

​idyl subnet delete

​Usage

​Flags

​Examples

​idyl subnet edit

​Usage

​Flags

​Examples

​idyl subnet get

​Usage

​Aliases

​Flags

​Examples

​idyl subnet show

​Usage

​Flags

​Examples

​idyl subnet unapprove

​Usage

​Flags

​Examples

Usage

Aliases

Commands

Inherited flags

Examples

Subcommand reference

`idyl subnet admission`

Usage

Aliases

Commands

Examples

`idyl subnet admission get`

Usage

Aliases

Flags

`idyl subnet admission grant`

Usage

Flags

`idyl subnet admission revoke`

Usage

Flags

`idyl subnet admission set`

Usage

Flags

`idyl subnet approve`

Usage

Flags

Examples

`idyl subnet create`

Usage

Flags

Examples

`idyl subnet delete`

Usage

Flags

Examples

`idyl subnet edit`

Usage

Flags

Examples

`idyl subnet get`

Usage

Aliases

Flags

Examples

`idyl subnet show`

Usage

Flags

Examples

`idyl subnet unapprove`

Usage

Flags

Examples