Usage
Aliases
subnets
Commands
Inherited flags
Examples
Subcommand reference
idyl subnet admission
Manage typed subnet admission.
Developer admission controls which accounts may submit workloads.
Provider admission controls which fleets or nodes may join as capacity.
A provider grant naming an account is an invitation: fleets that account
creates in the subnet are admitted when they are created, and revoking the
invitation revokes them. In approval mode, a fleet another account creates
records a request the subnet’s owner decides with ‘idyl subnet admission
request’.
Usage
Aliases
admissions
Commands
Examples
idyl subnet admission get
Get subnet admission
Usage
Aliases
listls
Flags
idyl subnet admission grant
Grant subnet admission
Usage
Flags
idyl subnet admission request
List and decide the admission requests recorded on a subnet you own.
A request is recorded when another account creates a fleet in a subnet whose
provider admission mode is approval. Until it is decided, the fleet’s
Attached condition reads AwaitingAdmissionApproval and the fleet serves
nothing. Approving admits the fleet and creates its admission grant in the
same step; rejecting leaves the fleet unadmitted.
Usage
Aliases
requestsreq
Commands
Examples
idyl subnet admission request approve
Approve a pending admission request, admitting its fleet or node to the
subnet. The admission grant is created in the same step, and the fleet’s
Attached condition turns true once the platform observes it.
Usage
Flags
Examples
idyl subnet admission request get
List every admission request recorded on a subnet you own, newest first.
Usage
Aliases
listls
Flags
Examples
idyl subnet admission request reject
Reject a pending admission request. No grant is created; the fleet stays
created but serves nothing, and its Attached condition reads
AdmissionRejected. A fleet never changes subnet, so it serves nothing until
the subnet’s owner admits it with ‘idyl subnet admission grant’.
Usage
Flags
Examples
idyl subnet admission revoke
Revoke subnet admission
Usage
Flags
idyl subnet admission set
Set an admission mode
Usage
Flags
idyl subnet approve
Approve a subnet for account deploy access.
This grants the current account permission to create new workloads in the
subnet, provided the subnet’s region is also enabled for the account.
Provider capacity admission is managed separately with ‘idyl subnet admission’.
Usage
Flags
Examples
idyl subnet attach
Attach a leased fleet to a subnet.
A lease’s subnet is set once: a lease may be created without one and parks
unattached, meters nothing, and holds no capacity until it is attached, after
which cancelling the lease is the only detach.
A fleet is not attached: it names its subnet when it is created, with
‘idyl fleet create —subnet’, and serves that subnet for its whole life.
Usage
Flags
Examples
idyl subnet create
Create a new subnet in a region.
A globally unique slug is auto-generated server-side. Use —display-name for
optional presentation text; display names are not identifiers and need not be
unique.
Use runtime policy flags when the subnet should accept only specific workload
isolation intent. If —default-isolation-class is set, workloads that omit
—isolation-class inherit that default. If a runtime policy has no default,
workloads must set —isolation-class explicitly. Runtime policy does not
install or prove a runtime on provider nodes; scheduling still requires
matching node capabilities.
Registry Credentials and Vault have separate policies. Use
—enable-registry-credentials for private image-pull credentials and
—enable-vault for workload Secret and TLSCertificate projection.
New subnets default to the denied root policy: workloads whose
image would run as uid 0 are rejected at start. Pass
—root-policy allowed to honor image users as-is.
Usage
Flags
Examples
idyl subnet delete
Delete a subnet.
The argument is the subnet’s canonical slug.
You will be prompted for confirmation unless the —yes flag is provided.
Usage
Flags
Examples
idyl subnet edit
Edit a subnet’s properties.
The argument is the subnet’s canonical slug.
Use —set-display-name to set presentation text or —clear-display-name to
remove it. Display names are not identifiers and need not be unique.
Runtime policy flags replace the subnet runtime policy. Use
—allowed-isolation-class to set the allowed workload isolation intent. Use
—default-isolation-class when workloads without explicit —isolation-class
should inherit a subnet default. A runtime policy admits VirtualMachines and
DaemonSets only with —allow-virtual-machines and —allow-daemonsets, so state
them again on every replacement that should keep them; a policy without
—allow-daemonsets stops the pods of every DaemonSet in the subnet. Use
—clear-runtime-policy to remove subnet runtime policy. Runtime policy does not
install or prove a runtime on provider nodes; scheduling still requires
matching node capabilities.
Use —root-policy to set the subnet’s root-user policy:
denied rejects workloads whose image would run as uid 0 (with a reason-coded
start failure on the node); allowed honors the image user as-is. The
policy applies to assignments dispatched after the change; running pods keep
running until their next restart or reschedule.
DaemonSet terms flags replace the subnet’s terms whole: the accounts whose
DaemonSets may run on fleets other accounts own, and what those DaemonSets may
reserve together on one node (—daemonset-terms-cpu and
—daemonset-terms-memory are required, —daemonset-terms-gpus defaults to 0).
Narrower terms apply to every fleet at once and stop the pods they no longer
admit; wider terms reach a fleet only when its owner accepts the new revision.
—clear-daemonset-terms removes the terms and requires confirmation unless
—yes is provided.
Registry Credentials and Vault policy flags are independent. Disable operations
require confirmation unless —yes is provided and do not destroy stored
ciphertext.
Usage
Flags
Examples
idyl subnet get
Get details of a specific managed subnet, or list managed subnets.
With no arguments, lists subnets owned by the current account.
With a slug argument, gets details of that managed subnet.
Usage
Aliases
listls
Flags
Examples
idyl subnet show
Show details of the current subnet from the active context.
The subnet is resolved from the —subnet flag, IDYL_SUBNET environment
variable, or the current context.
Usage
Flags
Examples
idyl subnet store-admission
Admit Stores to a subnet, as its owner. Computers and Filesystems created in
the subnet keep their saved versions in an admitted Store: the one they name,
or the subnet’s default. Admission governs only new placement; existing
Computers and Filesystems keep their Store and stay readable when it is
removed. ‘idyl store get’ lists the admitted Stores.
Usage
Aliases
store-admissions

