fm tenant
Reference for the fm tenant command group (auto-generated from fm tenant --help).
fm tenant
text
Manage tenants within a Frostmoln organization.
Usage:
fm tenant [command]
Aliases:
tenant, tenants
Available Commands:
create Create a tenant in an organization
current Show the active tenant
default-tags Manage the tags every new resource in the tenant starts with
list List tenants in an organization
quota Show resource usage against the tenant's (or organization's) limits
rename Rename a tenant
use Set the active tenant for subsequent commands
Flags:
-h, --help help for tenant
--organization string organization ID (defaults to your only organization)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm tenant [command] --help" for more information about a command.fm tenant create
text
Create an additional tenant in an organization.
The tenant is provisioned asynchronously (isolation, roles, quotas,
billing account); it is returned in status=provisioning and becomes active
once provisioning completes.
If you belong to a single organization it is used automatically; otherwise
pass --organization with the organization ID.
Examples:
fm tenant create --name "Staging"
fm tenant create --name "Production" --organization 0c4f...
Usage:
fm tenant create [flags]
Flags:
-h, --help help for create
--name string tenant display name (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm tenant current
text
Show the tenant the CLI currently operates on (the --tenant flag,
FM_TENANT, the persisted 'fm tenant use' selection, or your default tenant).
Use -o json or -o yaml for a machine-readable value.
Usage:
fm tenant current [flags]
Flags:
-h, --help help for current
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm tenant default-tags
text
Default tags are added to every taggable resource created in the tenant,
as ordinary tags: a key the create request sets itself wins. They are copied
when a resource is created, so a change applies to resources created
afterwards — the services that create resources may take up to about 30 seconds
to see it. A resource that already exists is changed only when you run
'fm tenant default-tags apply'.
Terraform: use Frostmoln provider v0.62.0 or newer. Older versions fail when
they create a resource in a tenant that has default tags.
The tenant is the active one ('fm tenant current'); pass --tenant <id> for
another. Reading them needs membership of the organization that owns the
tenant, changing them an admin or owner role there. An API key needs the
organizations:read / organizations:write scope.
Usage:
fm tenant default-tags [command]
Aliases:
default-tags, default-tag
Available Commands:
apply Add the tenant's default tags to the resources it already has
clear Remove every default tag of the tenant
get Show the tenant's default tags
set Replace (or with --merge, add to) the tenant's default tags
Flags:
-h, --help help for default-tags
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm tenant default-tags [command] --help" for more information about a command.fm tenant default-tags apply
text
Default tags are added to every taggable resource created in the tenant,
as ordinary tags: a key the create request sets itself wins. They are copied
when a resource is created, so a change applies to resources created
afterwards — the services that create resources may take up to about 30 seconds
to see it. A resource that already exists is changed only when you run
'fm tenant default-tags apply'.
Terraform: use Frostmoln provider v0.62.0 or newer. Older versions fail when
they create a resource in a tenant that has default tags.
The tenant is the active one ('fm tenant current'); pass --tenant <id> for
another. Reading them needs membership of the organization that owns the
tenant, changing them an admin or owner role there. An API key needs the
organizations:read / organizations:write scope.
apply adds the tenant's CURRENT default tags to every taggable resource the
tenant already has. It only adds the default keys a resource is missing: a
key the resource already has keeps its value, even when the default's value is
different, and a resource that is missing nothing is left alone. It never
removes a tag. Running it again is safe, and retries what failed.
Not every resource is changed:
- resources the platform manages for you (a managed security group, a load
balancer or public IP a managed service owns, and their load-balancer
children) and the resources inside a managed service are skipped;
- volumes the platform created together with an instance (its boot volume),
instance snapshots and images are not included;
- a resource the added tags would push over its tag limit is skipped.
Managed Kubernetes clusters and node pools are included, each on its own: a
pool gets the defaults it is missing, never a copy of its cluster's tags. The
other managed services (databases, caches, messaging, webservers, Application
Gateways, and their backups, replicas, domains, deploys and gateway objects)
are included as the platform enables them; the result lists each type it
covered, and only those.
It changes every resource in the tenant, so it asks for confirmation; --yes
skips the question, and is required when fm is not reading from a terminal.
It needs an admin or owner role in the organization that owns the tenant; an
API key also needs the organizations:write scope.
The apply runs in the background and can take a long time in a large tenant;
there is no time limit. fm waits for it as long as it takes, showing its
progress, then prints how many resources of each type were updated, left
unchanged, skipped or failed, and lists the failed and skipped ones (up to 200
each; reasons fm does not know are printed as sent). Resources that failed do
not make the command fail: it exits 0 and lists them, and running it again
retries them. It exits non-zero when the apply as a whole could not run.
Ctrl-C stops fm waiting, not the apply: fm prints the operation ID and exits
130, and the apply goes on. --no-wait returns once the apply has started, with
its operation ID. Under -o json / -o yaml the completed operation is printed:
its operationId, and the whole result under result.
Only one apply runs in a tenant at a time. If one is already running, fm says
so, waits for it to finish, and then starts yours, so that it applies the
default tags as they are now; with --no-wait it only reports the running one.
Terraform: a provider older than v0.62.0 removes the tags this adds on the
next 'terraform apply' of each resource it manages. Upgrade first.
Examples:
fm tenant default-tags apply
fm tenant default-tags apply --yes -o json
fm tenant default-tags apply --yes --no-wait
Usage:
fm tenant default-tags apply [flags]
Flags:
-h, --help help for apply
--no-wait return once the apply has started, with its operation ID, instead of waiting for the result
--yes skip the confirmation prompt (required when not on a terminal)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm tenant default-tags clear
text
Default tags are added to every taggable resource created in the tenant,
as ordinary tags: a key the create request sets itself wins. They are copied
when a resource is created, so a change applies to resources created
afterwards — the services that create resources may take up to about 30 seconds
to see it. A resource that already exists is changed only when you run
'fm tenant default-tags apply'.
Terraform: use Frostmoln provider v0.62.0 or newer. Older versions fail when
they create a resource in a tenant that has default tags.
The tenant is the active one ('fm tenant current'); pass --tenant <id> for
another. Reading them needs membership of the organization that owns the
tenant, changing them an admin or owner role there. An API key needs the
organizations:read / organizations:write scope.
clear removes every default tag. Resources already created keep the tags they
were given. It asks for confirmation; --yes skips the question, and is required
when fm is not reading from a terminal.
Usage:
fm tenant default-tags clear [flags]
Flags:
-h, --help help for clear
--yes skip the confirmation prompt (required when not on a terminal)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm tenant default-tags get
text
Default tags are added to every taggable resource created in the tenant,
as ordinary tags: a key the create request sets itself wins. They are copied
when a resource is created, so a change applies to resources created
afterwards — the services that create resources may take up to about 30 seconds
to see it. A resource that already exists is changed only when you run
'fm tenant default-tags apply'.
Terraform: use Frostmoln provider v0.62.0 or newer. Older versions fail when
they create a resource in a tenant that has default tags.
The tenant is the active one ('fm tenant current'); pass --tenant <id> for
another. Reading them needs membership of the organization that owns the
tenant, changing them an admin or owner role there. An API key needs the
organizations:read / organizations:write scope.
Prints the default tags one key=value per line. Under -o json or -o yaml they
are printed as one flat map.
Usage:
fm tenant default-tags get [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm tenant default-tags set
text
Default tags are added to every taggable resource created in the tenant,
as ordinary tags: a key the create request sets itself wins. They are copied
when a resource is created, so a change applies to resources created
afterwards — the services that create resources may take up to about 30 seconds
to see it. A resource that already exists is changed only when you run
'fm tenant default-tags apply'.
Terraform: use Frostmoln provider v0.62.0 or newer. Older versions fail when
they create a resource in a tenant that has default tags.
The tenant is the active one ('fm tenant current'); pass --tenant <id> for
another. Reading them needs membership of the organization that owns the
tenant, changing them an admin or owner role there. An API key needs the
organizations:read / organizations:write scope.
set REPLACES the whole set with the --tag values given: a default tag you
leave out is removed. With --merge it reads the current set, adds yours (a key
you pass takes your value) and writes the result back. There is no concurrency
control on this setting: a change someone else makes between that read and the
write is overwritten.
A default tag is added to every kind of resource, so it must be accepted by all
of them, and the rules are the strictest of each:
- at most 10 default tags;
- keys: 1 to 64 bytes of letters (a-z, A-Z), digits and . _ : -, starting
and ending with a letter or digit — no '/' and no spaces;
- values: 0 to 255 bytes of letters, digits, spaces and + - . _ : / @ =;
- reserved keys, in any letter case: the frostmoln_ and frostmoln-
prefixes, the os_, instance_ and nova_ prefixes (reserved on instances),
request-id, customer-id, project-id, tenant-id, created-at, acl,
storage-class, quota-bytes and cors-config.
To remove every default tag, use 'fm tenant default-tags clear'.
Examples:
fm tenant default-tags set --tag env=prod --tag cost-center=eu-42
fm tenant default-tags set --tag owner=team-a --merge
fm tenant default-tags set --tag env=dev --tenant 0c4f...
Usage:
fm tenant default-tags set --tag key=value [--tag key=value ...] [flags]
Flags:
-h, --help help for set
--merge add to the current default tags instead of replacing them (read, merge, write: not safe against a concurrent change)
--tag strings default tag as key=value (repeatable, or comma-separated); the given set REPLACES the current one unless --merge
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm tenant list
text
List the tenants in an organization.
If you belong to a single organization it is used automatically; otherwise
pass --organization with the organization ID, or --all to list the tenants
across every organization you belong to (the same set 'fm tenant use' accepts).
Usage:
fm tenant list [flags]
Flags:
--all list tenants across all your organizations
-h, --help help for list
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm tenant quota
text
Show the active tenant's resource quotas: what is used against each limit.
The tenant is the active one ('fm tenant current'); pass --tenant <id> for
another. With --org, show the aggregate of the organization that owns the
tenant instead, with ALLOCATED: the sum of its tenants' limits. The
organization view needs a signed-in user; an API key sees only its tenant.
How to read the table:
- USED is "—" when the usage of that resource is not known yet. It does not
mean 0; the limit still applies, and you can still request an increase.
- Counts are plain numbers. Storage is in GB as the platform reports it.
Memory is counted in MB and shown in GB (1 GB = 1024 MB), with one
decimal when it is not a whole number.
- A limit of 0 means no allowance for that resource.
- A brand-new tenant's limits are the platform defaults.
To change a limit, use 'fm tenant quota request'.
Examples:
fm tenant quota
fm tenant quota --org
fm tenant quota -o json
Usage:
fm tenant quota [flags]
fm tenant quota [command]
Aliases:
quota, quotas
Available Commands:
request Request a new limit for one resource
Flags:
-h, --help help for quota
--org show the organization's aggregate instead of the tenant's
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm tenant quota [command] --help" for more information about a command.fm tenant quota request
text
Request a new limit for one resource of the active tenant, or with --org of
the organization that owns it.
<resource-type> is the resourceType 'fm tenant quota -o json' shows (for
example instance, vcpu, ram, volume). <new-limit> is a whole number in the
counter's OWN unit: MB for ram (1 GB = 1024 MB, so 16 GB is 16384), GB as
the platform reports it for the storage resources, a count for everything
else. It is the new limit, not an increment.
A tenant request is decided at once: approved, or denied with the reason. A
tenant request above what the tenant can be raised to without organization
review is refused before it is sent. A LOWER tenant limit takes effect at
once, so it needs --yes; one below what is in use (or being created) is
denied. An organization request
(--org, signed-in users only; not with an API key) waits for review by
Frostmoln staff. Only one request per resource can be pending.
With an API key, the key needs the quotas:write scope; compute:write is not
enough, because an approved raise lifts the tenant's spend ceiling. Reading
the current quotas first needs no scope.
Custom-image limits (image, image_storage) cannot be requested this way;
contact support.
Examples:
fm tenant quota request vcpu 32 --reason "Load test next week"
fm tenant quota request ram 65536 --reason "Bigger database" --org
fm tenant quota request vcpu 8 --reason "Cost cut" --yes
Usage:
fm tenant quota request <resource-type> <new-limit> --reason <text> [flags]
Flags:
-h, --help help for request
--org request the organization's limit instead of the tenant's (reviewed by staff)
--reason string why you need the new limit (required)
--yes confirm lowering a tenant limit, which takes effect at once (one below what is in use is denied)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm tenant rename
text
Change the display name of a tenant.
Only the label changes. The tenant's ID and its internal slug-form name are
immutable: the slug is carried into the isolation project name when the tenant
is provisioned, so it is deliberately frozen. Display names do not have to be
unique.
Requires an admin or owner role in the tenant's organization.
Examples:
fm tenant rename 0c4f... --name "Production"
Usage:
fm tenant rename <tenant-id> [flags]
Flags:
-h, --help help for rename
--name string new tenant display name (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm tenant use
text
Set the active tenant the CLI operates on.
The selection is persisted to the current context, so subsequent commands
(e.g. fm compute instance list) target this tenant until you switch again.
A one-off --tenant <id> flag (or FM_TENANT; ID only, no names) overrides it for a single command.
The tenant is validated against the tenants you are entitled to. A name
(display name or slug, case-insensitive) is accepted when it matches exactly
one tenant; names repeat across organizations, so an ambiguous name is refused
and the matching IDs are listed.
Example:
fm tenant use 0c4f1e2a-...
fm tenant use Staging
Usage:
fm tenant use <tenant-id|name> [flags]
Flags:
-h, --help help for use
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
--organization string organization ID (defaults to your only organization)
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)