GWEB Cloud CLI (gwebc) 1.22.30

Audience: GWTS/GWEB tenant and platform users
Applies to: Track A0 frozen tenant application runtime
CLI version: 1.22.30

Overview

gwebc is the supported tenant-facing command line interface for GWEB Cloud.

The CLI covers tenant identity, application lifecycle, runtime configuration and secrets, deployment, service exposure, domains/DNS/TLS, release management, audit, service identities, credentials, and bounded operational diagnostics.

Tenant users should use gwebc rather than direct Kubernetes access for normal application operations.

Profiles and authentication

Select a profile:

gwebc profile list
gwebc profile use gweb-dev

Authenticate:

gwebc auth login
gwebc auth status

A healthy session reports:

authenticated=true
expired=False
session_state=VALID

auth status output should be inspected semantically; do not rely only on the process exit code.

Main command families

environment
app
audit
member
delegation
service-identity
credential
config
secret
ci
artifact
release
promotion
domain
service
deploy

Other platform commands include:

version
profile
doctor
context
auth
capabilities
vpn
service-access

Application lifecycle

Application commands:

gwebc app list
gwebc app show <application> --environment <environment>
gwebc app create ...
gwebc app update ...
gwebc app delete ...

Runtime operations live under app:

gwebc app configure <application> --environment <environment>
gwebc app unconfigure <application> --environment <environment>
gwebc app rollback <application> --environment <environment>
gwebc app diagnostics <application> --environment <environment>
gwebc app logs <application> --environment <environment>

diagnostics and logs are not top-level commands.

Runtime configuration

Non-sensitive runtime configuration uses config:

gwebc config list <application> --environment <environment>
gwebc config show <application> --environment <environment>
gwebc config set <application> --environment <environment> ...
gwebc config unset <application> --environment <environment> ...

Configuration is revisioned. Setting or unsetting values stages a new runtime configuration revision.

Staging a revision does not by itself mean the workload is consuming it. Use gwebc app configure to bind the current staged runtime state.

Runtime secrets

Sensitive runtime values use secret:

gwebc secret list <application> --environment <environment>
gwebc secret show <application> --environment <environment>
gwebc secret set <application> --environment <environment> ...
gwebc secret rotate <application> --environment <environment> ...
gwebc secret revoke <application> --environment <environment> ...

Secret model

GWEB runtime secrets are:

• revisioned;
• materialized into Kubernetes Secrets by the platform;
• never returned in plaintext by normal read operations;
• represented in broker state as metadata/fingerprints, not plaintext;
• bound to workloads through the managed runtime binding model.

secret set and secret rotate submit the complete desired secret set.

After rotation

A new Secret revision can exist without being the currently bound revision.

Example:

secret r1 = BOUND
secret r2 = RETIRED
runtime state = bound to r1

This is valid after rollback.

gwebc secret show currently reports the latest Secret revision metadata and therefore may show a newer retired revision even when the workload is bound to an earlier revision. Use application runtime/binding state as the authoritative source for the bound revision.

Binding configuration and secrets

After staging config and/or secret changes:

gwebc app configure <application> --environment <environment>

app configure automatically uses the current staged config and secret revisions. Explicit --config-revision and --secret-revision flags are not part of the current command contract.

To remove managed bindings:

gwebc app unconfigure <application> --environment <environment>

To return to an earlier runtime state:

gwebc app rollback <application> --environment <environment>

Service exposure

Managed application exposure:

gwebc service show <application> --environment <environment>
gwebc service expose <application> --environment <environment>
gwebc service unexpose <application> --environment <environment>

Public exposure is managed through the GWEB platform. Tenant users should not create Services or HTTPRoutes directly.

Domains, DNS and TLS

Domain lifecycle:

claim
bind
attach
detach
verification-dns
verify
rotate-verification
revoke
tls
dns

Typical managed-domain flow:

claim
  -> verification DNS
  -> verify
  -> bind to application
  -> attach to managed exposure
  -> reconcile DNS/TLS

Use:

gwebc domain --help

for the exact current argument surface.

IAM and tenant administration

Tenant IAM commands include:

member
delegation
service-identity
credential
audit

These manage tenant membership, delegated authority, service identities, machine credentials and IAM audit history.

Top-level audit is the tenant IAM audit surface.

Artifacts, releases and promotion

Tenant release management uses:

artifact
release
promotion
deploy
ci

Artifact and release records are immutable metadata describing what is deployed and promoted.

Production mutation remains subject to platform promotion/environment policy.

Diagnostics and logs

Application diagnostics:

gwebc app diagnostics <application> --environment <environment>

Bounded application logs:

gwebc app logs <application> --environment <environment>

These surfaces are intended to give tenant operators useful operational visibility without requiring direct Kubernetes access.

Recommended application runtime workflow

1. authenticate with the correct tenant profile
2. create or inspect the application
3. stage non-sensitive config
4. stage runtime secrets
5. configure/bind the application
6. verify diagnostics and health
7. expose the service if required
8. attach managed domain/DNS/TLS if required
9. rotate secrets when needed
10. rollback through the managed runtime path if required
11. inspect audit/history
12. decommission through supported application lifecycle commands

Security boundaries

Do not:

• store application secrets in Git;
• place sensitive values in normal configuration;
• bypass the runtime secret API with ad-hoc Kubernetes Secrets;
• give tenant users broad Kubernetes credentials for normal operations;
• directly mutate production outside the accepted promotion policy;
• delete retained runtime revision objects manually as a substitute for a supported lifecycle operation.

Track A0 frozen runtime

The Track A0 baseline established and accepted:

application ownership
-> config
-> secret
-> configure/bind
-> deployment binding
-> rotation
-> rollback
-> RBAC
-> audit
-> diagnostics/logs
-> real GEDU acceptance
-> fresh-tenant WSPM acceptance

This is the runtime model documented by k3s.docs.