fm kubernetes

Reference for the fm kubernetes command group (auto-generated from fm kubernetes --help).

fm kubernetes

Manage managed Kubernetes clusters.

  fm kubernetes cluster create --name my-cluster --vpc vpc-123 --subnet subnet-456 --node-flavor k8s.gp1.medium
  fm kubernetes cluster list
  fm kubernetes cluster kubeconfig <cluster-id> > ~/.kube/frostmoln
  fm kubernetes node-pool create <cluster-id> --flavor k8s.gp1.large --node-count 3

Discover valid flavors, control-plane tiers, versions, and addons:
  fm kubernetes flavor list
  fm kubernetes tier list
  fm kubernetes version list
  fm kubernetes addon list

Usage:
  fm kubernetes [command]

Aliases:
  kubernetes, k8s

Available Commands:
  addon             View Kubernetes cluster addons
  cluster           Manage Kubernetes clusters
  flavor            View Kubernetes node flavors
  node-pool         Manage cluster node pools
  tier              View Kubernetes control-plane tiers
  version           View Kubernetes versions
  workload-identity Manage Workload Identity Federation for managed Kubernetes

Flags:
  -h, --help   help for kubernetes

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm kubernetes [command] --help" for more information about a command.

fm kubernetes addon

List available cluster addons.

Usage:
  fm kubernetes addon [command]

Aliases:
  addon, addons

Available Commands:
  list        List cluster addons
  versions    List the versions of an addon you can pin

Flags:
  -h, --help   help for addon

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm kubernetes addon [command] --help" for more information about a command.

fm kubernetes addon list

List cluster addons

Usage:
  fm kubernetes addon list [flags]

Flags:
  -h, --help   help for list

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes addon versions

List the versions of one addon you can pin, in the platform's order
(newest-published last). RECOMMENDED marks the version a new selection gets.

The order is not a ranking: do not read the last row as the newest software.
End-of-life versions are not listed; a cluster already pinned to one shows it in
'fm kubernetes cluster addons <cluster-id>'.

Examples:
  fm kubernetes addon versions external-dns

Usage:
  fm kubernetes addon versions <addon> [flags]

Flags:
  -h, --help   help for versions

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster

Manage managed Kubernetes clusters.

Usage:
  fm kubernetes cluster [command]

Aliases:
  cluster, clusters

Available Commands:
  add-addons      Add addons to a running Kubernetes cluster
  addons          Show a cluster's addon versions (pinned and applied)
  create          Create a Kubernetes cluster
  delete          Delete a Kubernetes cluster
  get             Get Kubernetes cluster details
  kubeconfig      Fetch a cluster's kubeconfig
  list            List Kubernetes clusters
  pin-addons      Pin addons a cluster already has to a version
  proxy           Forward a local port to a cluster's Kubernetes API
  remove-addons   Remove addons from a running Kubernetes cluster
  rename          Rename a Kubernetes cluster
  tags            Read and replace a cluster's resource tags

Flags:
  -h, --help   help for cluster

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm kubernetes cluster [command] --help" for more information about a command.

fm kubernetes cluster add-addons

Add catalog addons to an already-running Kubernetes cluster.

This command only ADDS. Name only the keys you want to add; the cluster's
existing addons are kept and re-sent for you, and this command can never remove
one — even if another operator changes the cluster while it runs. To remove an
addon, use 'fm kubernetes cluster remove-addons'.

NOT IMMEDIATE: the request records the new set and returns; the accepted change
starts its own reconciliation, which typically installs the addon on the cluster
within minutes. If that reconciliation cannot be started the platform says so in
a notice and the addon waits for the next scheduled one instead. Re-run
'fm kubernetes cluster get <cluster-id>' to see the recorded set.

The cluster must be running.

EGRESS: an addon's upstream images are pulled from a public registry when its
pods start, not preloaded onto your nodes, so your worker nodes need outbound
HTTPS to that registry (ExternalDNS: registry.k8s.io — and allowing that
hostname alone is not enough if you filter egress by name, because image
downloads are redirected to backing stores on other domains). The platform
cannot check this — reachability belongs to your VPC at the moment of the pull,
and every new node pulls again — so a cluster that cannot reach the registry
accepts the addon here and then leaves its pods in ImagePullBackOff. While the
addon is not running, any DNS records it manages are neither published nor
cleaned up. Run 'fm kubernetes addon list' to see an addon's prerequisites in
its DESCRIPTION.

VERSIONS: an added addon gets its recommended version unless you pin one with
--version addon=version (repeatable; see 'fm kubernetes addon versions <addon>').
Only the addons you name in --version are re-pinned; every other pin is left alone.

Examples:
  fm kubernetes cluster add-addons <cluster-id> --addons external-dns
  fm kubernetes cluster add-addons <cluster-id> --addons external-dns --version external-dns=<version>
  # <version>: one listed by 'fm kubernetes addon versions external-dns'

Usage:
  fm kubernetes cluster add-addons <cluster-id> [flags]

Flags:
      --addons strings        addon keys to ADD (comma-separated; required — see 'addon list'). Existing addons are kept; use 'remove-addons' to remove one
  -h, --help                  help for add-addons
      --version stringArray   pin an addon to a version, addon=version (repeatable; see 'addon versions <addon>'). Only the named addons are re-pinned

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster addons

Show, per addon, the version the cluster is PINNED to and the version the platform
last confirmed it APPLIED, in the platform's order: the current selection first,
then any addon still being removed.

The applied version lags the pin while a change converges, so the two are always
shown together. STATE and PINNED STATUS are shown exactly as the platform reports
them; a pin whose status is deprecated or eol gets a warning — the cluster keeps
running it, but move the pin with 'fm kubernetes cluster pin-addons'.

Examples:
  fm kubernetes cluster addons <cluster-id>
  fm kubernetes cluster addons <cluster-id> -o json

Usage:
  fm kubernetes cluster addons <cluster-id> [flags]

Flags:
  -h, --help   help for addons

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster create

Create a managed Kubernetes cluster with an initial node pool.

--version, --tier and --region are optional; when omitted the server applies its
defaults (discover valid values with 'fm kubernetes version list' / 'tier list').

Addons: by default the server applies the catalog's default addons. Use --addons
to select an explicit set, or --no-addons to create the cluster with none. An
addon may need outbound HTTPS from your worker nodes to the public registry its
upstream images come from; 'fm kubernetes addon list' shows an addon's
prerequisites in its DESCRIPTION.

Addon versions: each addon gets its recommended version unless you pin one with
--addon-version addon=version (repeatable). List an addon's pinnable versions with
'fm kubernetes addon versions <addon>' and send one back exactly as listed. Every
addon you pin must be one the cluster gets: those named in --addons, or the
catalog defaults when --addons is omitted. (--version is the Kubernetes version.)

Tags: --tag key=value (repeatable) sets the cluster's resource tags — your own
metadata for search and filtering, never applied to the cluster or its nodes. The
tenant's default tags are merged in (a key you set wins). The initial node pool
gets a one-time COPY of the cluster's merged tags at create; later changes to the
cluster's tags do not reach it. Manage a pool's own tags with
'fm kubernetes node-pool tags set'.

Examples:
  fm kubernetes cluster create --name prod --vpc vpc-123 --subnet subnet-456 --node-flavor k8s.gp1.medium
  # external-dns publishes hostnames to your Frostmoln DNS zones
  fm kubernetes cluster create --name prod --vpc vpc-123 --subnet subnet-456 \
    --node-flavor k8s.gp1.large --node-count 3 --tier production --version 1.35 \
    --addons external-dns --addon-version external-dns=<version>
  # <version>: one listed by 'fm kubernetes addon versions external-dns'

Usage:
  fm kubernetes cluster create [flags]

Flags:
      --addon-version stringArray   pin an addon to a version, addon=version (repeatable; see 'addon versions <addon>'). An addon not named gets its recommended version
      --addons strings              explicit addon keys (comma-separated; see 'addon list'). Omit for catalog defaults
  -h, --help                        help for create
      --name string                 cluster name (required)
      --no-addons                   create the cluster with no addons (mutually exclusive with --addons and --addon-version)
      --no-wait                     return immediately instead of waiting for the cluster to become ready
      --node-count int              number of nodes in the initial node pool (default 1)
      --node-flavor string          flavor ID for the initial node pool (required, e.g. k8s.gp1.medium — see 'flavor list')
      --node-pool-name string       name for the initial node pool (server-generated when empty)
      --region string               region ID (server default when empty)
      --subnet string               subnet ID (required)
      --tag strings                 resource tag in key=value format (repeatable). The initial node pool gets a one-time copy of the cluster's merged tags
      --tier string                 control-plane tier key (server default when empty — see 'tier list')
      --version string              Kubernetes version (server default when empty — see 'version list')
      --vpc string                  VPC ID (required)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster delete

Delete a managed Kubernetes cluster and all of its node pools.

Usage:
  fm kubernetes cluster delete <cluster-id> [flags]

Flags:
      --force   skip the confirmation prompt
  -h, --help    help for delete
      --wait    wait for the deletion to complete before returning

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster get

Get detailed information about a specific Kubernetes cluster.

Usage:
  fm kubernetes cluster get <cluster-id> [flags]

Flags:
  -h, --help   help for get

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster kubeconfig

Fetch the kubeconfig for a Kubernetes cluster.

By default the raw kubeconfig YAML is written to stdout (redirect it or use
--file). With -o json|yaml the full {endpoint, kubeconfig} object is printed.
The kubeconfig is only available once the cluster is running.

An enclave cluster's API server has no route from your machine (ADR-0103), so it
is reached through a local tunnel. Two flags write one:

  --exec   kubectl starts the tunnel itself, on demand, via an 'fm' credential
           plugin. One terminal, and the file holds no key — the credential is
           fetched per call. Needs kubernetes:write AND sessions:write. The local
           port is derived from the cluster id so two clusters practically never
           share one. If two of yours do, they are stuck with it — the derivation
           is deterministic — and the symptom is a certificate error from the
           second cluster. Pin one of them with --exec=<port>.
  --proxy  the file points at a tunnel you run yourself with
           'fm kubernetes cluster proxy' in a second terminal.

Examples:
  fm kubernetes cluster kubeconfig <cluster-id> > ~/.kube/frostmoln
  fm kubernetes cluster kubeconfig <cluster-id> --file ./kubeconfig.yaml
  fm kubernetes cluster kubeconfig <cluster-id> --exec --file ./kubeconfig
  KUBECONFIG=$(fm kubernetes cluster kubeconfig <cluster-id> --file /dev/stdout) kubectl get nodes

Usage:
  fm kubernetes cluster kubeconfig <cluster-id> [flags]

Flags:
      --exec int[=0]        write a kubeconfig that starts the proxy tunnel itself via an 'fm' credential plugin, so kubectl needs no second terminal (--exec, or --exec=<port> to pin a local port)
      --file string         write the kubeconfig to this file instead of stdout
  -h, --help                help for kubeconfig
      --proxy int[=46443]   point the kubeconfig at a local 'fm kubernetes cluster proxy' tunnel instead of the cluster endpoint (--proxy, or --proxy=<port> to match a non-default proxy port) (default 46443)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster list

List all managed Kubernetes clusters in the active tenant.

--tag key=value (repeatable) lists only the clusters carrying EVERY given tag with
exactly that value; key= matches a tag whose value is empty.

Examples:
  fm kubernetes cluster list
  fm kubernetes cluster list --tag env=prod --tag team=platform

Usage:
  fm kubernetes cluster list [flags]

Flags:
  -h, --help          help for list
      --tag strings   only clusters with this tag, key=value (repeatable; every one must match)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster pin-addons

Move the version pin of addons already selected on a running cluster, without
changing which addons it has.

Name each addon=version with --version (repeatable). Only those addons are
re-pinned; every other addon keeps its current pin. Send a version string exactly
as 'fm kubernetes addon versions <addon>' lists it.

NOT IMMEDIATE: the pin is recorded and applied by the reconciliation the
accepted change starts, typically within minutes. If that reconciliation cannot
be started the platform says so in a notice and the pin waits for the next
scheduled one instead. 'fm kubernetes cluster addons <cluster-id>' shows the
pinned and the applied version side by side while it converges.

Examples:
  fm kubernetes cluster pin-addons <cluster-id> --version external-dns=<version>
  # <version>: one listed by 'fm kubernetes addon versions external-dns'

Usage:
  fm kubernetes cluster pin-addons <cluster-id> [flags]

Flags:
  -h, --help                  help for pin-addons
      --version stringArray   pin an addon to a version, addon=version (repeatable; see 'addon versions <addon>'). Only the named addons are re-pinned (required)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster proxy

Forward a local TCP port to a managed cluster's Kubernetes API server over a
secure session — no public IP, no open port, and no VPN.

The control plane is private (ADR-0103): its API server has no route from the
internet, and this session is the customer-facing way to reach it. The target is
resolved server-side from the cluster you own — there is nothing to point at a
host or a port, by design.

Leave this running and use a second terminal:

  fm kubernetes cluster kubeconfig <cluster-id> --proxy --file ./kubeconfig
  KUBECONFIG=./kubeconfig kubectl get nodes

To skip the second terminal entirely, write the kubeconfig with --exec instead:
kubectl then starts this tunnel itself the first time it needs one.

The local port defaults to 46443, which is what --proxy writes into the
kubeconfig. If you override it here, pass the same port to --proxy.

Sessions are time-limited by the platform: they end after 10 minutes idle or 60
minutes in total, and they do not survive their connection — there is no resume.
If the tunnel drops, run this command again. A dropped tunnel says nothing about
the health of your cluster.

While the proxy runs, 127.0.0.1:<port> is reachable by any process on this
machine, including ones that cannot read your kubeconfig. Such a process cannot
use your cluster credentials — those stay in the kubeconfig and are verified by
the API server, not by this tunnel — but it can read what the API server serves
anonymously, which includes the cluster CA and the server version. Stop the
proxy when you are done, and prefer a machine you trust.

Usage:
  fm kubernetes cluster proxy <cluster-id> [local-port] [flags]

Examples:
  # Default: listen on 127.0.0.1:46443
  fm kubernetes cluster proxy <cluster-id>

  # A different local port (pass the same one to --proxy)
  fm kubernetes cluster proxy <cluster-id> 15443

Flags:
  -h, --help   help for proxy

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster remove-addons

Remove catalog addons from an already-running Kubernetes cluster.

DESTRUCTIVE: this DELETES the objects the addon installed in your cluster. Name
the keys you want removed; everything else the cluster has is kept for you.

NOT IMMEDIATE: the request records the new set and returns; the accepted change
starts its own reconciliation, which typically deletes the objects within
minutes. If that reconciliation cannot be started the platform says so in a
notice and the deletion waits for the next scheduled one instead.

NOT EVERY CLUSTER CAN: removal reaches your cluster through the control-plane
image its VMs booted, and images are immutable — so a cluster created before the
platform could remove an addon is refused, and says so. Adding is unaffected.

WHAT IS LEFT BEHIND, because the platform will not delete it for you: the
addon's namespace, and any CustomResourceDefinition, StorageClass or CSIDriver
it created, together with anything YOU put in that namespace. For ExternalDNS
that means the 'external-dns' namespace and the DNS-write credential Secret you
created in it both survive — the platform does not touch credential material you
own, so removing it is yours to do. The DNS records ExternalDNS published also
survive and are no longer managed by anything: if you later delete the load
balancer a record points at, that address can be reallocated while the record
still resolves to it. Re-selecting the addon on the same cluster re-adopts its
own records and resumes managing them.

For External Secrets Operator the CustomResourceDefinitions survive, and every
ExternalSecret keeps a cleanup finalizer that only the ESO controller removes.
Once the controller is gone, an ExternalSecret left in the cluster cannot finish
deleting, and neither can a namespace that contains one. Under the default
creationPolicy: Owner, deleting an ExternalSecret also deletes the Secret it
synced; to keep one, set creationPolicy: Orphan and remove the Secret's owner
reference first, then delete your ExternalSecrets before removing the add-on.
Removing external-secrets therefore asks for confirmation, and needs --yes when
stdin is not a terminal.

Examples:
  fm kubernetes cluster remove-addons <cluster-id> --addons external-dns
  fm kubernetes cluster remove-addons <cluster-id> --addons external-secrets --yes

Usage:
  fm kubernetes cluster remove-addons <cluster-id> [flags]

Flags:
      --addons strings        addon keys to REMOVE (comma-separated; required). DELETES the objects they installed; the addon's namespace and anything you created in it are kept
  -h, --help                  help for remove-addons
      --version stringArray   pin an addon to a version, addon=version (repeatable; see 'addon versions <addon>'). Only the named addons are re-pinned (a kept addon only)
      --yes                   skip the external-secrets removal confirmation (non-interactive use)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster rename

Rename a managed Kubernetes cluster.

Usage:
  fm kubernetes cluster rename <cluster-id> [flags]

Flags:
  -h, --help          help for rename
      --name string   new cluster name (required)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster tags

Read and replace a cluster's resource tags

Usage:
  fm kubernetes cluster tags [command]

Aliases:
  tags, tag

Available Commands:
  get         Show a cluster's resource tags
  set         Replace a cluster's resource tags

Flags:
  -h, --help   help for tags

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm kubernetes cluster tags [command] --help" for more information about a command.

fm kubernetes cluster tags get

Show a cluster's resource tags

Usage:
  fm kubernetes cluster tags get <cluster-id> [flags]

Flags:
  -h, --help   help for get

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes cluster tags set

Replace a cluster's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Nothing else about the
cluster changes, and the running cluster is not touched.

The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm kubernetes cluster tags get' and pass
them all back. Use --clear to remove every tag. The tenant's default tags are not
re-applied.

The cluster's node pools are NOT changed: the initial pool got a copy of the
cluster's tags once, at create. Manage a pool's tags with
'fm kubernetes node-pool tags set'.

Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.

Examples:
  fm kubernetes cluster tags set k8s-123 --tag env=prod --tag owner=team-a
  fm kubernetes cluster tags set k8s-123 --clear

Usage:
  fm kubernetes cluster tags set <cluster-id> --tag <key=value> [--tag <key=value> ...] [flags]

Flags:
      --clear         remove ALL tags (mutually exclusive with --tag)
  -h, --help          help for set
      --tag strings   tag in key=value format (repeatable; replace semantics)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes flavor

List available node flavors (instance sizes) for Kubernetes clusters, or get one by ID.

Usage:
  fm kubernetes flavor [command]

Aliases:
  flavor, flavors

Available Commands:
  get         Get node flavor details
  list        List node flavors

Flags:
  -h, --help   help for flavor

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm kubernetes flavor [command] --help" for more information about a command.

fm kubernetes flavor get

Get detailed information about a specific Kubernetes node flavor.

Usage:
  fm kubernetes flavor get <flavor-id> [flags]

Flags:
  -h, --help   help for get

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes flavor list

List node flavors

Usage:
  fm kubernetes flavor list [flags]

Flags:
  -h, --help   help for list

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes node-pool

Manage node pools for a Kubernetes cluster.

Usage:
  fm kubernetes node-pool [command]

Aliases:
  node-pool, node-pools, nodepool, np

Available Commands:
  create      Create a node pool
  delete      Delete a node pool
  get         Get node pool details
  list        List a cluster's node pools
  scale       Scale a node pool
  tags        Read and replace a node pool's resource tags (not node labels)

Flags:
  -h, --help   help for node-pool

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm kubernetes node-pool [command] --help" for more information about a command.

fm kubernetes node-pool create

Add a node pool to a Kubernetes cluster.

--tag key=value (repeatable) sets the pool's resource tags — your own metadata for
search and filtering, not Kubernetes node labels. The tenant's default tags are
merged in (a key you set wins). A new pool does not inherit the cluster's tags.

Example:
  fm kubernetes node-pool create <cluster-id> --flavor k8s.gp1.large --node-count 3 --name workers --tag env=prod

Usage:
  fm kubernetes node-pool create <cluster-id> [flags]

Flags:
      --flavor string    flavor ID (required, e.g. k8s.gp1.large — see 'flavor list')
  -h, --help             help for create
      --name string      node pool name (server-generated when empty)
      --no-wait          return immediately instead of waiting for the pool to become active
      --node-count int   number of nodes (default 1)
      --tag strings      resource tag in key=value format (repeatable; not a node label)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes node-pool delete

Delete a node pool from a Kubernetes cluster.

Usage:
  fm kubernetes node-pool delete <cluster-id> <pool-id> [flags]

Flags:
      --force   skip the confirmation prompt
  -h, --help    help for delete
      --wait    wait for the deletion to complete before returning

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes node-pool get

Get detailed information about a specific node pool.

Usage:
  fm kubernetes node-pool get <cluster-id> <pool-id> [flags]

Flags:
  -h, --help   help for get

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes node-pool list

List all node pools for a Kubernetes cluster.

--tag key=value (repeatable) lists only the pools carrying EVERY given resource tag
with exactly that value; key= matches a tag whose value is empty. Resource tags
only — never Kubernetes node labels.

Usage:
  fm kubernetes node-pool list <cluster-id> [flags]

Flags:
  -h, --help          help for list
      --tag strings   only pools with this resource tag, key=value (repeatable; every one must match)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes node-pool scale

Change the number of nodes in a node pool.

Example:
  fm kubernetes node-pool scale <cluster-id> <pool-id> --node-count 5

Usage:
  fm kubernetes node-pool scale <cluster-id> <pool-id> [flags]

Flags:
  -h, --help             help for scale
      --no-wait          return immediately instead of waiting for the scale to complete
      --node-count int   target number of nodes (required)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes node-pool tags

Read and replace a node pool's resource tags (not node labels)

Usage:
  fm kubernetes node-pool tags [command]

Aliases:
  tags, tag

Available Commands:
  get         Show a node pool's resource tags
  set         Replace a node pool's resource tags

Flags:
  -h, --help   help for tags

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm kubernetes node-pool tags [command] --help" for more information about a command.

fm kubernetes node-pool tags get

Show a node pool's resource tags

Usage:
  fm kubernetes node-pool tags get <cluster-id> <pool-id> [flags]

Flags:
  -h, --help   help for get

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes node-pool tags set

Replace a node pool's resource tags in place with exactly the given set
(replace semantics — any tag not listed is removed). Resource tags are your own
metadata; they are not Kubernetes node labels, and changing them touches no node.

The set you pass IS the resulting set. To ADD one tag without disturbing the
others, read the current ones first with 'fm kubernetes node-pool tags get' and
pass them all back. Use --clear to remove every tag.

This is how the initial node pool's tags are managed: it got a one-time copy of
the cluster's tags at create, and later cluster tag changes do not reach it.

Keys beginning frostmoln_ or frostmoln- (any letter case) are reserved and
refused. At most 32 tags; a key is 1-64 bytes, a value at most 256 bytes.

Examples:
  fm kubernetes node-pool tags set k8s-123 np-456 --tag env=prod
  fm kubernetes node-pool tags set k8s-123 np-456 --clear

Usage:
  fm kubernetes node-pool tags set <cluster-id> <pool-id> --tag <key=value> [--tag <key=value> ...] [flags]

Flags:
      --clear         remove ALL tags (mutually exclusive with --tag)
  -h, --help          help for set
      --tag strings   tag in key=value format (repeatable; replace semantics)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes tier

List available control-plane tiers for Kubernetes clusters.

Usage:
  fm kubernetes tier [command]

Aliases:
  tier, tiers

Available Commands:
  list        List control-plane tiers

Flags:
  -h, --help   help for tier

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm kubernetes tier [command] --help" for more information about a command.

fm kubernetes tier list

List control-plane tiers

Usage:
  fm kubernetes tier list [flags]

Flags:
  -h, --help   help for list

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes version

List available Kubernetes versions.

Usage:
  fm kubernetes version [command]

Aliases:
  version, versions

Available Commands:
  list        List Kubernetes versions

Flags:
  -h, --help   help for version

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm kubernetes version [command] --help" for more information about a command.

fm kubernetes version list

List Kubernetes versions

Usage:
  fm kubernetes version list [flags]

Flags:
  -h, --help   help for list

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes workload-identity

Manage Workload Identity Federation bindings (ADR-0095).

A binding maps a Kubernetes (namespace, serviceAccount) in one of your managed
clusters to a least-privilege Frostmoln grant. A pod running as that
ServiceAccount can then exchange its projected token for a short-lived, scoped
Frostmoln credential — no long-lived secret in the pod.

The grant is either flat scopes on the binding, or an access policy attached to
it with "fm iam policy attach --type workload_identity" (directly or through a
group). Prefer the policy: it can name individual targets, add constraints and
deny explicitly, none of which a flat scope can express.

Usage:
  fm kubernetes workload-identity [command]

Aliases:
  workload-identity, wi

Available Commands:
  binding     Manage workload identity bindings
  token       Exchange a ServiceAccount token for a Frostmoln workload token (debug)

Flags:
  -h, --help   help for workload-identity

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm kubernetes workload-identity [command] --help" for more information about a command.

fm kubernetes workload-identity binding

Manage workload identity bindings

Usage:
  fm kubernetes workload-identity binding [command]

Aliases:
  binding, bindings

Available Commands:
  create      Create a workload identity binding
  delete      Delete a workload identity binding
  list        List workload identity bindings

Flags:
  -h, --help   help for binding

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

Use "fm kubernetes workload-identity binding [command] --help" for more information about a command.

fm kubernetes workload-identity binding create

Create a workload identity binding.

The binding's grant is either flat --scope values or an access policy attached to
it with "fm iam policy attach". Scopes must be explicit and least-privilege:
wildcards ("*" or "<resource>:*") are rejected for workload identities.

Omit --scope entirely to create a POLICY-GRANTED binding. Prefer that — a flat
scope grants a verb across every resource of a service, while a policy names
individual targets, adds constraints and can deny explicitly. Such a binding is
INERT until a policy is attached: with no grant at all the token exchange refuses
it rather than minting a credential that grants nothing.

Examples:
  fm kubernetes workload-identity binding create \
    --cluster <cluster-id> \
    --namespace default \
    --service-account my-app \
    --scope compute:read --scope storage:read

  # Policy-granted: create the binding, then attach a policy to it.
  fm kubernetes workload-identity binding create \
    --cluster <cluster-id> --namespace ops --service-account reaper
  fm iam policy attach <policy-id> --type workload_identity --id <binding-id>

Usage:
  fm kubernetes workload-identity binding create [flags]

Flags:
      --cluster string           managed cluster id the binding applies to (required)
  -h, --help                     help for create
      --namespace string         Kubernetes namespace (required)
      --scope strings            least-privilege scope (repeatable, e.g. compute:read); wildcards rejected. Omit for a policy-granted binding
      --service-account string   Kubernetes ServiceAccount name (required)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes workload-identity binding delete

Delete a workload identity binding

Usage:
  fm kubernetes workload-identity binding delete <id> [flags]

Flags:
      --force   skip confirmation prompt
  -h, --help    help for delete

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes workload-identity binding list

List the current tenant's workload identity bindings.

Results are cursor-paginated: when the output includes a non-empty nextCursor,
pass it back with --cursor to fetch the next page.

Usage:
  fm kubernetes workload-identity binding list [flags]

Flags:
      --all              fetch all pages (auto-follow nextCursor)
      --cluster string   filter by cluster id
      --cursor string    opaque pagination cursor from a previous response's nextCursor
  -h, --help             help for list
      --limit int        maximum bindings per page

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)

fm kubernetes workload-identity token

Debug/support helper: exchange a raw Kubernetes ServiceAccount JWT for a
short-lived Frostmoln workload token and print it.

Pods obtain this automatically via the injected in-guest helper; use this only to
troubleshoot a binding. The subject token is a live credential, so it is read
only from a file or stdin (never a command-line argument, which would leak it to
the process list and shell history):

  fm kubernetes workload-identity token --subject-token-file /var/run/secrets/.../token
  cat token.jwt | fm kubernetes workload-identity token --subject-token-file -

Usage:
  fm kubernetes workload-identity token [flags]

Flags:
  -h, --help                        help for token
      --subject-token-file string   read the ServiceAccount JWT from a file ("-" for stdin)

Global Flags:
      --config string   config file (default is $HOME/.fm/config.yaml)
  -d, --debug           enable debug/verbose output
      --no-color        disable colored output
  -o, --output string   output format: table, json, yaml, wide (default "table")
  -q, --quiet           suppress non-essential output
      --tenant string   tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)