CLI reference: sparkwing operator

Every sparkwing operator command, flag, and argument, generated from the CLI's own command registry. All command groups are indexed in cli-reference.md.

`sparkwing operator`

Manage deployment operations

Subcommands

teams -- Create teams under operator authority
warm-capacity -- Manage warm Cloud capacity per hardware class
limits -- Manage deployment operational ceilings
object-store -- Operate the controller's object-store request budget
secrets -- Maintain the controller's sealed values
tokens -- Manage deployment service credentials

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.

`sparkwing operator limits`

Manage deployment operational ceilings

Subcommands

set -- Set a deployment operational ceiling
show -- Print every compute guard and visible runner usage

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.

`sparkwing operator limits set`

Set a deployment operational ceiling

Operational ceilings and signup settings only; values above ceilings are refused, never silently clamped.

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--setting GUARD`	Name of the operational guard to change, as operator limits show lists it. (required)
`--value N`	New value for the guard as a nonnegative integer; a value above the deployment's ceiling is refused, not clamped. (required)
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator limits show`

Print every compute guard and visible runner usage

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator object-store`

Operate the controller's object-store request budget

Subcommands

reset-breaker -- Clear a tripped object-store budget or ceiling freeze
status -- Show the controller's object-store request budget

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.

`sparkwing operator object-store reset-breaker`

Clear a tripped object-store budget or ceiling freeze

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator object-store status`

Show the controller's object-store request budget

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator secrets`

Maintain the controller's sealed values

Subcommands

rotate -- Reseal every stored secret and key under the current key

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.

`sparkwing operator secrets rotate`

Reseal every stored secret and key under the current key

Reseal every team's secrets, git credentials and submitted run environments, and the session signing key, under the controller's current key. Run it after the previous key is mounted beside the new one; remove the previous key only when nothing is reported unreadable.

Repeats safely. JSON retains the counts, previous_key_only and each unreadable row's purpose, team and name; values never appear.

--verify writes nothing and counts the rows that still open only under the previous key; retire the previous key when it reports zero and nothing unreadable.

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--verify`	Change nothing and count the rows that still open only under the previous key; retire that key once this reports zero and nothing unreadable.
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator teams`

Create teams under operator authority

Subcommands

show -- Show a team and its protected node label
create -- Create a team and issue its first administrator credential

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.

`sparkwing operator teams create`

Create a team and issue its first administrator credential

Create a new team and its first team-admin credential atomically under operator authority. Existing or retired team slugs are refused.

JSON includes the one-time capability and account metadata. Plain and pretty print the capability once. This operation is never retried automatically.

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--team SLUG`	Slug for the new team; a slug that exists or was retired is refused. (required)
`--display-name NAME`	Human-readable name for the new team, the slug by default.
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator teams show`

Show a team and its protected node label

Show the team's protected node label and value when binding shared Cloud capacity.

The value is derived from the deployment's Cloud Job namespace and the team, so two deployments on one cluster never share a team's nodes.

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--team SLUG`	Slug of the team to show. (required)
`--job-namespace NAMESPACE`	Kubernetes namespace this deployment runs Cloud Jobs in; the team's node label value is derived from it and the team. (required)
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator tokens`

Manage deployment service credentials

Subcommands

create -- Issue a deployment service credential
list -- List deployment service credentials
revoke -- Revoke a deployment service credential
rotate -- Rotate a deployment service credential

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.

`sparkwing operator tokens create`

Issue a deployment service credential

Only deployment service credentials; never console trust, grants, freezes or account deletion powers. Licensed self-hosters have no deployment-admin token path.

Use the deployment /operator/tokens routes. JSON includes the new bearer and metadata; plain emits the bearer once. TTL accepts nonnegative whole seconds, including zero for no expiry.

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--type KIND`	Kind of credential to issue, service by default; deployment is refused by this command. Values: service, deployment.
`--principal NAME`	Name of the service the credential is issued to; the controller requires it.
`--scope SCOPE`	Credential scope. Repeatable; comma-separated values are accepted.
`--ttl DURATION`	Lifetime of the new credential in whole seconds or a duration; omitted or zero issues a credential that never expires.
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator tokens list`

List deployment service credentials

Read deployment credential metadata. JSON emits one record per token, with exact scopes and no bearer. Plain emits prefixes. --token selects one prefix.

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--token PREFIX`	Token identifier or prefix.
`--type KIND`	List only credentials of this kind. Values: service, deployment.
`--include-revoked`	Also list credentials that have been revoked.
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator tokens revoke`

Revoke a deployment service credential

Revoke through the deployment token route. JSON retains the confirmed revocation; plain emits the prefix.

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--token PREFIX`	Token identifier or prefix. (required)
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator tokens rotate`

Rotate a deployment service credential

Rotate through the deployment token route. JSON includes the new bearer, metadata and old revocation time; plain emits the new bearer. Grace defaults to 24h. Zero TTL preserves the old remaining lifetime. Durations use nonnegative whole seconds.

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--token PREFIX`	Token identifier or prefix. (required)
`--grace DURATION`	How long the old credential keeps working after rotation, in whole seconds or a duration, 24h by default; zero revokes it at once.
`--ttl DURATION`	Lifetime of the replacement credential in whole seconds or a duration; omitted or zero keeps the old credential's remaining lifetime.
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator warm-capacity`

Manage warm Cloud capacity per hardware class

Subcommands

show -- Show warm capacity policies and start-time metrics
set -- Set Off, Manual or Auto warm capacity for one class

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.

`sparkwing operator warm-capacity set`

Set Off, Manual or Auto warm capacity for one class

Replace one class policy. Off is the default. Counts default to zero and the start-time target to 10s.

Auto uses the higher of cold-start waits / 2 rounded up and current warm + 1 when the hourly median exceeds the target, clamped to min/max.

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--class CLASS`	Cloud hardware class, such as sparkwing-2cpu. (required)
`--mode MODE`	off, manual or auto. (required)
`--count N`	Warm nodes to hold in manual mode, zero by default.
`--min N`	Minimum warm nodes in auto mode, zero by default.
`--max N`	Maximum warm nodes in auto mode, zero by default.
`--start-time-target DURATION`	Positive job start-time target as a duration, 10s by default.
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

`sparkwing operator warm-capacity show`

Show warm capacity policies and start-time metrics

Flags

Flag	Description
`-o, --output FORMAT`	Pretty on a terminal; JSON when piped; explicit format wins. Values: pretty, json, plain.
`-C, --checkout PATH`	Resolve the project from this local checkout path.
`-h, --help`	Show command help without executing.
`--help-all`	Include uncommon flags in command help.
`--profile NAME`	Controller connection profile from your config. Optional profiles use the saved default, then local; --profile= selects local.

CLI reference: sparkwing operator

CLI reference: sparkwing operator

sparkwing operatorSection anchor link

SubcommandsSection anchor link

FlagsSection anchor link

sparkwing operator limitsSection anchor link

SubcommandsSection anchor link

FlagsSection anchor link

sparkwing operator limits setSection anchor link

FlagsSection anchor link

sparkwing operator limits showSection anchor link

FlagsSection anchor link

sparkwing operator object-storeSection anchor link

SubcommandsSection anchor link

FlagsSection anchor link

sparkwing operator object-store reset-breakerSection anchor link

FlagsSection anchor link

sparkwing operator object-store statusSection anchor link

FlagsSection anchor link

sparkwing operator secretsSection anchor link

SubcommandsSection anchor link

FlagsSection anchor link

sparkwing operator secrets rotateSection anchor link

FlagsSection anchor link

sparkwing operator teamsSection anchor link

SubcommandsSection anchor link

FlagsSection anchor link

sparkwing operator teams createSection anchor link

FlagsSection anchor link

sparkwing operator teams showSection anchor link

FlagsSection anchor link

sparkwing operator tokensSection anchor link

SubcommandsSection anchor link

FlagsSection anchor link

sparkwing operator tokens createSection anchor link

FlagsSection anchor link

sparkwing operator tokens listSection anchor link

FlagsSection anchor link

sparkwing operator tokens revokeSection anchor link

FlagsSection anchor link

sparkwing operator tokens rotateSection anchor link

FlagsSection anchor link

sparkwing operator warm-capacitySection anchor link

SubcommandsSection anchor link

FlagsSection anchor link

sparkwing operator warm-capacity setSection anchor link

FlagsSection anchor link

sparkwing operator warm-capacity showSection anchor link

FlagsSection anchor link

`sparkwing operator`

Subcommands

Flags

`sparkwing operator limits`

Subcommands

Flags

`sparkwing operator limits set`

Flags

`sparkwing operator limits show`

Flags

`sparkwing operator object-store`

Subcommands

Flags

`sparkwing operator object-store reset-breaker`

Flags

`sparkwing operator object-store status`

Flags

`sparkwing operator secrets`

Subcommands

Flags

`sparkwing operator secrets rotate`

Flags

`sparkwing operator teams`

Subcommands

Flags

`sparkwing operator teams create`

Flags

`sparkwing operator teams show`

Flags

`sparkwing operator tokens`

Subcommands

Flags

`sparkwing operator tokens create`

Flags

`sparkwing operator tokens list`

Flags

`sparkwing operator tokens revoke`

Flags

`sparkwing operator tokens rotate`

Flags

`sparkwing operator warm-capacity`

Subcommands

Flags

`sparkwing operator warm-capacity set`

Flags

`sparkwing operator warm-capacity show`

Flags