Skip to main content

astroctl access-policy apply

Create or revise an authentication policy

Synopsis​

Apply a YAML or JSON policy. Omit revision to create; preserve the revision returned by get when updating. An API-key policy names either a Secret you keep in the application's namespace (apiKeys.secretRef) or apiKeys.managed: true, whose keys AstroPulse keeps and 'astroctl access-policy key' creates and revokes.

A JWT policy is saved only after its identity provider answers: its discovery document must name the same issuer and its key set must hold a signing key. Give the issuer alone and the key set URL is filled from discovery. When the provider cannot be reached yet, --allow-unverified saves it unchecked.

--dry-run runs every check an apply runs, saves nothing, and prints the policy as it would be saved.

Terminal
astroctl access-policy apply -f <file> [flags]

Options​

Terminal
      --allow-unverified   Save a JWT policy even when its identity provider cannot be reached
      --dry-run            Check the policy with AstroPulse without saving it
  -f, --file string        Policy YAML/JSON file; - reads stdin
  -h, --help               help for apply

Options inherited from parent commands​

Terminal
  -o, --output string   Output format (table|json|yaml) (default "table")

SEE ALSO​