tritonadm command index

tritonadm is the Triton Cloud operator command-line interface. It has 52 top-level commands. Most of them are typed calls against a running control plane. Six of them (install, setup, update, versions, self-update, and channel) also act on the local host or on the signed release channel.

Only setup ignores the global --endpoint and --api-key options. install, update, versions, self-update, and channel read the cluster through tritond: install, self-update, and channel revisions read the channel the cluster follows when no channel flag is given, and update, versions, channel refresh, and channel import call tritond directly.

Global options

Every option below is declared global = true, so it is accepted on every subcommand.

Option	Default	Purpose
--endpoint <URL>	none	Override the cluster endpoint. Falls back to TRITONADM_ENDPOINT, then to the endpoint field in the on-disk config.
--api-key <KEY>	none	Authenticate with this API key instead of the stored login session. Falls back to TRITONADM_API_KEY.
--timeout <SECS>	60	Give up on a request after this many seconds. 0 waits forever.
-v, --verbose	off	On error, print the full cause chain.
-j, --json	off	Emit JSON instead of a table. Same as --format json.
--format <FORMAT>	table	Output format: table, json, or yaml.
-o, --output <COLS>	none	Table columns to show, comma separated. A dotted path reads a field of the raw record. Refused with --json, --format json, or --format yaml.
-l, --long	off	Show the resource's wider column set. Ignored with -o.
-s, --sort <COLS>	none	Sort by these columns, comma separated. A leading - reverses a column. Applies to tables and JSON.
-H, --no-headers	off	Omit the header row. Refused with --json, --format json, or --format yaml.
--limit <N>	none	Stop after this many rows.
--version		Print the binary version.
--help		Print usage. Available on the root command and every subcommand.

-j together with a --format other than json is refused with -j means --format json; pass one or the other.

Endpoint and credential resolution

When neither --endpoint nor TRITONADM_ENDPOINT is set, and no credential is given through --api-key, TRITONADM_API_KEY, or TRITONADM_ACCESS_TOKEN, tritonadm first tries the local tritond UNIX socket. It scans /zones/*/root/data/run/tritond.sock and uses the first path that exists. tritond authenticates that connection by the caller's uid, so no token is sent. The socket is readable by root only, so this applies to root in the head node global zone. workspace quota and the user policy and user scoped-key commands call the mantad admin API and do not work over the socket. They need --endpoint and a credential.

Otherwise the endpoint is resolved in this order, highest priority first:

1. --endpoint
2. TRITONADM_ENDPOINT
3. The endpoint field in the config file

When none of the three yields a value, the command fails with this message:

no endpoint configured: pass --endpoint, set TRITONADM_ENDPOINT, or run `tritonadm configure`

The bearer credential is resolved in this order, highest priority first:

1. --api-key
2. TRITONADM_API_KEY
3. TRITONADM_ACCESS_TOKEN (used verbatim; no automatic refresh)
4. The token pair stored in the config file

With no credential at all, the command fails with a NoSession error and the message not logged in, followed by run `tritonadm login`; for scripts and CI set TRITONADM_API_KEY (create one with `tritonadm api-key create`).

A stored access token with 60 seconds or less of life left is refreshed before the command runs, and the new pair is written back to the config file. A tritond token pair refreshes through /v1/auth/refresh. When its refresh token has expired, the command fails with a NoSession error and the message the refresh token has expired, followed by the same run tritonadm login line. A single sign-on token pair refreshes against the identityd issuer, under a lock on the config directory. When its refresh token has expired, the command fails with this message:

session has expired; run `tritonadm login --sso` to re-authenticate

Environment variables

Variable	Effect
TRITONADM_ENDPOINT	Cluster endpoint, below --endpoint in precedence.
TRITONADM_API_KEY	API key, below --api-key in precedence.
TRITONADM_ACCESS_TOKEN	Bearer token used as-is, with no refresh.
TRITONADM_CONFIG_DIR	Directory holding config.json, replacing the system default.
TRITON_DC_ANCHORS	PEM file of extra trust anchors for the tritond client. See Transport.
RUST_LOG	Log filter. With no value set, the filter is warn,host_resources=info.

Logs are written to stderr with timestamps suppressed.

Configuration file

The config file is config.json inside TRITONADM_CONFIG_DIR when that variable is set, and inside <user config dir>/triton/tritonadm/ otherwise, which is $XDG_CONFIG_HOME/triton/tritonadm/config.json on Linux and ~/Library/Application Support/triton/tritonadm/config.json on macOS. Writes go to a config.json.tmp sibling that is created with mode 0600, and are then renamed over the target.

Field	Contents
endpoint	The cluster endpoint.
tokens	The access and refresh token pair, their expiry times, and the provider that issued them (tritond or identityd).
identityd_issuer	The issuer login --sso used. Written on the first successful SSO login. Omitted when unset.
imgapi_sources	Upstream IMGAPI servers for image avail and image import. Defaults to a single entry, https://images.smartos.org.
scope	Default silo, tenant, and project UUIDs for commands whose --silo, --tenant, or --project flag is absent. Set by configure. Omitted when empty.

Command index

Commands are listed in declaration order. Visible aliases are in parentheses. The subcommands column lists the first level below each command only.

Command	Subcommands	Purpose
configure		Log in and write the on-disk config.
login		Re-authenticate against the stored endpoint. --sso uses the identityd device flow.
logout		Delete the on-disk config, forgetting the endpoint and tokens.
whoami		Show the principal, endpoint, credential, capabilities, and scope defaults.
completion <SHELL>		Print a shell completion script.
llms.txt		Print a guide for coding agents and an index of every command.
llms-full.txt		Print the agent guide and every flag of every command.
env		Print shell export lines for the current session.
api-key	create, list (ls), delete (rm)	Manage long-lived API keys.
cn	list (ls), show, approve, disable, root-password, label, traits, reservoir, sandbox, mantablock, auto-approve, boot, setup, exec	Manage compute-node registration and approvals. See tritonadm cn.
instance (inst)	list (ls), show, create, delete (rm), start, stop, restart, migrate, move-to-mantablock	Manage instances fleet-wide. For move-to-mantablock, see tritonadm MantaBlock commands.
disk	list (ls), show, resize	Manage instance disks.
nic	list (ls), show	Manage instance NICs.
vpc	list (ls), show, create, delete (rm)	Manage VPCs.
subnet	list (ls), show, create, delete (rm)	Manage subnets.
floating-ip (ip)	list (ls), show, create, delete (rm), attach, detach	Manage floating IPs.
firewall-rule (fwrule)	list (ls), show, create, delete (rm)	Manage firewall rules.
nat-gateway	list (ls), show, create, delete (rm)	Manage NAT gateways.
route-table	list (ls), show, create, delete (rm)	Manage route tables.
route	list (ls), show, create, delete (rm)	Manage routes.
system	nics, utilization, dhcp-lease-show, user-grant, user-revoke, tenant	Fleet-wide operator reads and user capabilities. Capability-gated; a caller without the capability sees 404 NotFound.
ls		Shortcut for tritonadm instance list.
cns		Shortcut for tritonadm cn list.
find		Find what a UUID or IP address names, fleet-wide.
legacy	cns, vms, show	Inspect zones on registered compute nodes that tritond does not manage.
audit	list (ls), show, verify	Inspect and verify the audit log.
mantablock	format	MantaBlock settings of the fleet. See tritonadm MantaBlock commands.
operation (op)	list (ls), show, abandon	Inspect long-running operations (sagas).
job	show, fail	Inspect the agent work queue and fail a job by hand.
metering	billing, coverage, gaps, file, trace, usage, review, storage	Inspect compute-metering evidence and observed usage.
migration (mig)	list (ls), show, watch, abort, recover	Inspect and control instance migrations.
silo	list (ls), create, show, rename, identityd-issuer, image, package, provisioning-policy, signup-policy	Manage silos and their IdP, SSH keys, images, and packages.
tenant	list (ls), show, create, delete (rm), init-storage, drop-storage, create-user, project, idp, image, ssh-key	Manage tenants and their projects, quotas, IdP, images, and keys.
image (img)	list (ls), show, add, delete (rm), upload, set-owner, avail, import, fetch-nocloud, nocloud-versions, nocloud-vendors	Manage images. See tritonadm image upload.
ssh-key (key)	list (ls), show, delete (rm)	Manage public SSH keys.
auth	image, ssh-key	The calling user's own user-scoped images and SSH keys.
meta	list (ls), get, set, unset, realized	Manage layered instance metadata at silo, tenant, project, or instance scope.
storage	deploy, cluster, filesystem, gateway	Manage registered storage clusters and deployments.
identity	issuer, silo-trust	Operator identity directory (identityd, SSO).
fdb	status, policy, grow, approvals, tls, decommission, configure, coordinators	FoundationDB cluster health and topology.
infra	zone, portal, notifyd, mantafs	The zones the control plane itself runs on.
intent	show, export, revisions, proposals, propose, edit, approve	The committed cluster configuration and its proposed successors.
workspace	quota	Manage storage workspaces and their quotas.
user	policy, scoped-key	Manage storage IAM users and their inline policies.
config	list (ls), get, set, features, reset	View and change cluster-wide tritond settings. See tritonadm config.
install		Install a zone image or global-zone agent from the release channel onto this host. See tritonadm install.
setup	apply, bootstrap, converge, destroy	Bring up the control plane on this head node. See tritonadm setup.
update		Update running components from the release channel. See Updates and channels.
versions		Show what runs where against the channel, with drift marked.
self-update		Update this tritonadm binary from the release channel. See tritonadm self-update and channel.
channel	revisions, refresh, import	Work with the signed release channel and the in-cluster mirror.
pi	stage, list (ls)	Stage platform images onto the booter.

Host-side commands

install, setup, self-update, and channel revisions run on tokio::task::spawn_blocking, because they use a blocking HTTP client. update is async. Its host-local component walk runs on a blocking task, and its whole-fleet path runs on the async runtime.

install, setup, and the host-local update walk change the host through the host-resources crate, which runs imgadm and the SMF commands svccfg, svcadm, and svcs, so they run in the global zone. Zone create, delete, and reprovision go through the native tritond-vmadm library rather than the vmadm command. setup still runs vmadm list and vmadm get to find addresses already in use on the control network. setup and update act on the head node.

fdb status --break-glass, fdb configure, and fdb coordinators also run in the global zone. They reach the FoundationDB zone over zlogin rather than through tritond.

Transport

tritonadm installs aws-lc-rs as the process-default rustls crypto provider at startup. It builds HTTPS clients with two different trust stores.

Client	Used by	Trust store
triton-tls	Every tritond call, every self-update download, and the boot-mirror polling of the whole-fleet update	Native system certificates, which honor SSL_CERT_FILE and SSL_CERT_DIR. When none load, /opt/local/etc/openssl/certs/ca-certificates.crt, /etc/ssl/certs/ca-certificates.crt, and the two matching directories. When those are empty too, the bundled Mozilla roots. The PEM file named by TRITON_DC_ANCHORS is added on top.
host-resources	The channel manifest fetch of install, setup, update, versions, and channel revisions	The bundled Mozilla roots only.

When the triton-tls client falls back to the bundled roots, it logs a no native root certificates found; using bundled Mozilla roots warning once per process.

See also

• tritonadm setup
• tritonadm install
• tritonadm cn
• tritonadm config
• tritonadm self-update
• Install the tritonadm CLI
• Updates and channels
• Architecture