oz0 change
For: Operators and developers looking up a command.
Widening what a tenant's sandboxes may reach is a reviewed change.
A new tenant egress list (oz0 tenant egress, oz0 egress learn --apply), a plugin install or update whose egress the tenant does not permit yet, or a credential binding that allows anything the tenant did not, waits as a change request with its delta: each entry that widens, and what kind of widening it is (a new host, a wildcard, an internal or metadata address, an IP address, raw TCP, a removed deny entry, a host with a credential bound to it).
A narrowing, or something the tenant permits already, applies at once. A tenant admin approves the delta they saw, or rejects it; under the tenant's review-widening second_admin, an admin other than the requester approves. Every step is in the audit log (egress.change_requested, egress.change_approved, egress.change_rejected, egress.change_applied).
Usage
oz0 change [command]
Subcommands
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.