> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idyl.network/llms.txt
> Use this file to discover all available pages before exploring further.

# idyl subnet

> Manage subnets

View and manage subnets.

Subnets define groups of nodes organized by region. Admission is managed
separately for developer accounts and provider fleets or nodes.

Subnet runtime policy controls which workload isolation intent a subnet accepts.
Use --allowed-isolation-class when creating or editing a subnet to allow
container, secure-container, microvm, or a combination. Use --allowed-vmm-backend to restrict
Kata-backed secure-container nodes by backend. Use --default-isolation-class
when workloads that omit --isolation-class should inherit a subnet default.
Runtime policy does not install or prove a runtime on provider nodes;
scheduled workloads still require matching node capabilities.

A globally unique slug is auto-generated when a subnet is created. An optional
display name can be set for presentation; it is never used as an identifier.

## Usage

```bash theme={null}
idyl subnet
```

## Aliases

* `subnets`

## Commands

| Command                 | Description                                        |
| ----------------------- | -------------------------------------------------- |
| `idyl subnet admission` | Manage subnet admission                            |
| `idyl subnet approve`   | Approve a subnet for account deploy access         |
| `idyl subnet create`    | Create a subnet                                    |
| `idyl subnet delete`    | Delete a subnet                                    |
| `idyl subnet edit`      | Edit a subnet                                      |
| `idyl subnet get`       | Get managed subnet details or list managed subnets |
| `idyl subnet show`      | Show current subnet details                        |
| `idyl subnet unapprove` | Remove subnet deploy access from the account       |

## Inherited flags

| Flag                                 | Description                                                        |
| ------------------------------------ | ------------------------------------------------------------------ |
| `-a <string>, --account-id <string>` | Account ID to use, overriding the current context.                 |
| `-c <string>, --context <string>`    | Use the named context for this command.                            |
| `--homedir <string>`                 | Override the configuration directory. Defaults to \~/.config/idyl. |
| `-n <string>, --namespace <string>`  | Namespace to use for this command.                                 |
| `-o <string>, --output <string>`     | Output format (json\|yaml).                                        |
| `-p <string>, --profile <string>`    | Override the access profile for this command.                      |
| `--realm <string>`                   | Override the realm for this command.                               |
| `--subnet <string>`                  | Override the context subnet for this command.                      |

## Examples

```bash theme={null}
# Create a subnet (slug auto-generated)
idyl subnet create --region us-east

# Create a subnet that accepts only secure-container isolation intent and defaults omitted isolation
idyl subnet create --region us-east --allowed-isolation-class secure-container --default-isolation-class secure-container

# Create a subnet that accepts only explicit secure-container isolation intent
idyl subnet create --region us-east --allowed-isolation-class secure-container

# Create a subnet that accepts only microVM isolation intent and defaults omitted isolation
idyl subnet create --region us-east --allowed-isolation-class microvm --default-isolation-class microvm

# Create a subnet with subnet-bound Secrets enabled
idyl subnet create --region us-east --enable-secrets

# Create a subnet that accepts only Kata + Firecracker secure-container nodes
idyl subnet create --region us-east --allowed-isolation-class secure-container --allowed-vmm-backend firecracker

# Show current subnet details
idyl subnet show

# List subnets
idyl subnet list

# Get subnet details by slug
idyl subnet get <subnet-slug>

# Set developer admission mode
idyl subnet admission set --subnet <subnet-slug> --admission-type developer --mode approval

# Admit a developer account
idyl subnet admission grant --subnet <subnet-slug> --developer-account <account-id>

# Admit a provider fleet
idyl subnet admission grant --subnet <subnet-slug> --provider-fleet <fleet-id>

# Delete a subnet
idyl subnet delete <subnet-slug>
```

## Subcommand reference

### `idyl subnet admission`

Manage typed subnet admission.

Developer admission controls which accounts may submit workloads.
Provider admission controls which fleets or nodes may join as capacity.

#### Usage

```bash theme={null}
idyl subnet admission
```

#### Aliases

* `admissions`

#### Commands

| Command                        | Description             |
| ------------------------------ | ----------------------- |
| `idyl subnet admission get`    | Get subnet admission    |
| `idyl subnet admission grant`  | Grant subnet admission  |
| `idyl subnet admission revoke` | Revoke subnet admission |
| `idyl subnet admission set`    | Set an admission mode   |

#### Examples

```bash theme={null}
idyl subnet admission get --subnet <subnet>
idyl subnet admission set --subnet <subnet> --admission-type developer --mode approval
idyl subnet admission grant --subnet <subnet> --developer-account <account-id>
idyl subnet admission grant --subnet <subnet> --provider-fleet <fleet-id>
idyl subnet admission grant --subnet <subnet> --provider-node <node-id>
idyl subnet admission revoke --subnet <subnet> --grant <grant-id>
```

### `idyl subnet admission get`

Get subnet admission

#### Usage

```bash theme={null}
idyl subnet admission get [flags]
```

#### Aliases

* `list`
* `ls`

#### Flags

| Flag                             | Description                                            |
| -------------------------------- | ------------------------------------------------------ |
| `-o <string>, --output <string>` | Output format: table, json, or yaml. Default: `table`. |
| `--subnet <string>`              | Required. Canonical subnet slug.                       |

### `idyl subnet admission grant`

Grant subnet admission

#### Usage

```bash theme={null}
idyl subnet admission grant [flags]
```

#### Flags

| Flag                             | Description                                            |
| -------------------------------- | ------------------------------------------------------ |
| `--developer-account <string>`   | Account ID to grant developer admission.               |
| `-o <string>, --output <string>` | Output format: table, json, or yaml. Default: `table`. |
| `--provider-fleet <string>`      | Fleet ID to grant provider admission.                  |
| `--provider-node <string>`       | Node ID to grant provider admission.                   |
| `--subnet <string>`              | Required. Canonical subnet slug.                       |

### `idyl subnet admission revoke`

Revoke subnet admission

#### Usage

```bash theme={null}
idyl subnet admission revoke [flags]
```

#### Flags

| Flag                | Description                      |
| ------------------- | -------------------------------- |
| `--grant <string>`  | Required. Admission grant ID.    |
| `--subnet <string>` | Required. Canonical subnet slug. |

### `idyl subnet admission set`

Set an admission mode

#### Usage

```bash theme={null}
idyl subnet admission set [flags]
```

#### Flags

| Flag                             | Description                                            |
| -------------------------------- | ------------------------------------------------------ |
| `--admission-type <string>`      | Required. Admission type: developer or provider.       |
| `--mode <string>`                | Required. Admission mode: open, approval, or invite.   |
| `-o <string>, --output <string>` | Output format: table, json, or yaml. Default: `table`. |
| `--subnet <string>`              | Required. Canonical subnet slug.                       |

### `idyl subnet approve`

Approve a subnet for account deploy access.

This grants the current account permission to create new workloads in the
subnet, provided the subnet's region is also enabled for the account.

Provider capacity admission is managed separately with 'idyl subnet admission'.

#### Usage

```bash theme={null}
idyl subnet approve <slug> [flags]
```

#### Flags

| Flag                             | Description                                            |
| -------------------------------- | ------------------------------------------------------ |
| `-o <string>, --output <string>` | Output format: table, json, or yaml. Default: `table`. |

#### Examples

```bash theme={null}
idyl subnet approve <subnet-slug>
```

### `idyl subnet create`

Create a new subnet in a region.

A globally unique slug is auto-generated server-side. Use --display-name for
optional presentation text; display names are not identifiers and need not be
unique.

Use runtime policy flags when the subnet should accept only specific workload
isolation intent or Kata VMM backends. If --default-isolation-class is set,
workloads that omit --isolation-class inherit that default. If a runtime policy
has no default, workloads must set --isolation-class explicitly. Runtime policy
does not install or prove a runtime on provider nodes; scheduling still
requires matching node capabilities.

Use --enable-secrets when the subnet should accept subnet-bound Secrets for
registry credentials, workload secret references, and node reads.

New subnets default to the denied root policy: workloads whose
image would run as uid 0 are rejected at start. Pass
\--root-policy allowed to honor image users as-is.

#### Usage

```bash theme={null}
idyl subnet create [flags]
```

#### Flags

| Flag                                      | Description                                                                                                                         |
| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `--allow-virtual-machines`                | Admit VirtualMachine workloads into the subnet. Subnets with a runtime policy must opt in explicitly.                               |
| `--allowed-isolation-class <stringSlice>` | Allowed workload isolation intent for this subnet (container, secure-container, microvm); repeat the flag or comma-separate values. |
| `--allowed-vmm-backend <stringSlice>`     | Allowed Kata VMM backend for secure-container nodes in this subnet (qemu, firecracker); repeat the flag or comma-separate values.   |
| `--default-isolation-class <string>`      | Default isolation intent for workloads that omit --isolation-class; must be one of the allowed classes.                             |
| `--description <string>`                  | Subnet description.                                                                                                                 |
| `--disable-secrets`                       | Disable subnet-bound Secrets for secret creation, workload references, and node reads.                                              |
| `--display-name <string>`                 | Optional user-facing subnet display name.                                                                                           |
| `--enable-secrets`                        | Enable subnet-bound Secrets for secret creation, workload references, and node reads.                                               |
| `-o <string>, --output <string>`          | Output format: table, json, or yaml. Default: `table`.                                                                              |
| `--region <string>`                       | Region to host the subnet in.                                                                                                       |
| `--root-policy <string>`                  | Root policy for this subnet: allowed or denied. When denied, the subnet rejects workloads whose image would run as uid 0.           |

#### Examples

```bash theme={null}
# Interactive — prompts for all required values
idyl subnet create

# Fully non-interactive
idyl subnet create --region us-east --display-name "Production"

# Create a subnet with Secrets enabled
idyl subnet create --region us-east --enable-secrets

# Create a subnet that allows root workloads
idyl subnet create --region us-east --root-policy allowed

# Create a subnet that accepts only secure-container isolation intent and defaults omitted isolation
idyl subnet create --region us-east --allowed-isolation-class secure-container --default-isolation-class secure-container

# Create a subnet that accepts only explicit secure-container isolation intent
idyl subnet create --region us-east --allowed-isolation-class secure-container

# Create a subnet that accepts only microVM isolation intent and defaults omitted isolation
idyl subnet create --region us-east --allowed-isolation-class microvm --default-isolation-class microvm

# Create a subnet that accepts only Kata + Firecracker secure-container nodes
idyl subnet create --region us-east --allowed-isolation-class secure-container --allowed-vmm-backend firecracker

# Create a subnet that also admits VirtualMachine workloads
idyl subnet create --region us-east --allowed-isolation-class container --allow-virtual-machines

# Accept both container and secure-container isolation intent
idyl subnet create --region us-east --allowed-isolation-class container --allowed-isolation-class secure-container
```

### `idyl subnet delete`

Delete a subnet.

The argument is the subnet's canonical slug.
You will be prompted for confirmation unless the --yes flag is provided.

#### Usage

```bash theme={null}
idyl subnet delete <slug> [flags]
```

#### Flags

| Flag        | Description                |
| ----------- | -------------------------- |
| `-y, --yes` | Skip confirmation prompts. |

#### Examples

```bash theme={null}
# Delete a subnet by slug (with confirmation)
idyl subnet delete <subnet-slug>

# Delete without confirmation
idyl subnet delete <subnet-slug> --yes
```

### `idyl subnet edit`

Edit a subnet's properties.

The argument is the subnet's canonical slug.

Use --set-display-name to set presentation text or --clear-display-name to
remove it. Display names are not identifiers and need not be unique.

Runtime policy flags replace the subnet runtime policy. Use
\--allowed-isolation-class to set the allowed workload isolation intent and
\--allowed-vmm-backend to restrict Kata-backed secure-container nodes by backend. Use
\--default-isolation-class when workloads without explicit --isolation-class
should inherit a subnet default. Use --clear-runtime-policy to remove subnet
runtime policy. Runtime policy does not install or prove a runtime on provider
nodes; scheduling still requires matching node capabilities.

Use --root-policy to set the subnet's root-user policy:
denied rejects workloads whose image would run as uid 0 (with a reason-coded
start failure on the node); allowed honors the image user as-is. The
policy applies to assignments dispatched after the change; running pods keep
running until their next restart or reschedule.

Secrets policy flags replace the subnet Secrets policy. Use --enable-secrets to
allow subnet-bound secret creation, workload secret references, and node secret
reads. Use --disable-secrets to stop those flows; this requires confirmation
unless --yes is provided.

#### Usage

```bash theme={null}
idyl subnet edit <slug> [flags]
```

#### Flags

| Flag                                      | Description                                                                                                                         |
| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `--allow-virtual-machines`                | Admit VirtualMachine workloads into the subnet. Subnets with a runtime policy must opt in explicitly.                               |
| `--allowed-isolation-class <stringSlice>` | Allowed workload isolation intent for this subnet (container, secure-container, microvm); repeat the flag or comma-separate values. |
| `--allowed-vmm-backend <stringSlice>`     | Allowed Kata VMM backend for secure-container nodes in this subnet (qemu, firecracker); repeat the flag or comma-separate values.   |
| `--clear-display-name`                    | Remove the subnet display name.                                                                                                     |
| `--clear-runtime-policy`                  | Clear the subnet runtime policy so the subnet no longer filters by workload isolation intent.                                       |
| `--default-isolation-class <string>`      | Default isolation intent for workloads that omit --isolation-class; must be one of the allowed classes.                             |
| `--disable-secrets`                       | Disable subnet-bound Secrets for secret creation, workload references, and node reads.                                              |
| `--enable-secrets`                        | Enable subnet-bound Secrets for secret creation, workload references, and node reads.                                               |
| `-o <string>, --output <string>`          | Output format: table, json, or yaml. Default: `table`.                                                                              |
| `--root-policy <string>`                  | Root policy for this subnet: allowed or denied. When denied, the subnet rejects workloads whose image would run as uid 0.           |
| `--set-description <string>`              | Set the subnet description.                                                                                                         |
| `--set-display-name <string>`             | Set the user-facing subnet display name.                                                                                            |
| `-y, --yes`                               | Skip confirmation prompts.                                                                                                          |

#### Examples

```bash theme={null}
# Set a user-facing display name
idyl subnet edit <subnet-slug> --set-display-name "Production"

# Remove the display name
idyl subnet edit <subnet-slug> --clear-display-name

# Update subnet description
idyl subnet edit <subnet-slug> --set-description "New description"

# Enable subnet-bound Secrets
idyl subnet edit <subnet-slug> --enable-secrets

# Disable subnet-bound Secrets without an interactive prompt
idyl subnet edit <subnet-slug> --disable-secrets --yes

# Accept only secure-container isolation intent and default omitted isolation
idyl subnet edit <subnet-slug> --allowed-isolation-class secure-container --default-isolation-class secure-container

# Accept only explicit secure-container isolation intent
idyl subnet edit <subnet-slug> --allowed-isolation-class secure-container

# Accept only microVM isolation intent and default omitted isolation
idyl subnet edit <subnet-slug> --allowed-isolation-class microvm --default-isolation-class microvm

# Accept only Kata + Firecracker secure-container nodes
idyl subnet edit <subnet-slug> --allowed-isolation-class secure-container --allowed-vmm-backend firecracker

# Accept both container and secure-container isolation intent
idyl subnet edit <subnet-slug> --allowed-isolation-class container --allowed-isolation-class secure-container

# Clear runtime policy
idyl subnet edit <subnet-slug> --clear-runtime-policy

# Allow root workloads on this subnet (a deliberate, recorded operator act)
idyl subnet edit <subnet-slug> --root-policy allowed

# Deny root workloads
idyl subnet edit <subnet-slug> --root-policy denied

# Update typed admission policy
idyl subnet admission set --subnet <subnet-slug> --admission-type developer --mode approval
```

### `idyl subnet get`

Get details of a specific managed subnet, or list managed subnets.

With no arguments, lists subnets owned by the current account.
With a slug argument, gets details of that managed subnet.

#### Usage

```bash theme={null}
idyl subnet get [slug] [flags]
```

#### Aliases

* `list`
* `ls`

#### Flags

| Flag                             | Description                                            |
| -------------------------------- | ------------------------------------------------------ |
| `-o <string>, --output <string>` | Output format: table, json, or yaml. Default: `table`. |

#### Examples

```bash theme={null}
# List subnets
idyl subnet get

# Get subnet details by slug
idyl subnet get <subnet-slug>

# Get in JSON format
idyl subnet get <subnet-slug> -o json
```

### `idyl subnet show`

Show details of the current subnet from the active context.

The subnet is resolved from the --subnet flag, IDYL\_SUBNET environment
variable, or the current context.

#### Usage

```bash theme={null}
idyl subnet show [flags]
```

#### Flags

| Flag                             | Description                                            |
| -------------------------------- | ------------------------------------------------------ |
| `-o <string>, --output <string>` | Output format: table, json, or yaml. Default: `table`. |

#### Examples

```bash theme={null}
# Show current subnet details
idyl subnet show

# Show current subnet in JSON format
idyl subnet show -o json
```

### `idyl subnet unapprove`

Remove subnet deploy access from the account.

Existing workloads are not stopped, but new deployments to the subnet will be
blocked once access is removed.

#### Usage

```bash theme={null}
idyl subnet unapprove <slug> [flags]
```

#### Flags

| Flag        | Description                |
| ----------- | -------------------------- |
| `-y, --yes` | Skip confirmation prompts. |

#### Examples

```bash theme={null}
idyl subnet unapprove <subnet-slug> --yes
```