oz0 egress learn
For: Operators and developers looking up a command.
Reads the requests the egress proxy refused a job and its child jobs (each target once, at most 20 per job) and proposes the narrowest entry that would allow each: for the agent's or its plugin's egress list, or for the tenant's, with the oz0 tenant egress command that sets it. It applies nothing: a person decides.
An internal address (the node, its network, a metadata service) is proposed only for the tenant's list, by address, and left out of its command; a private network (RFC 1918, carrier-grade NAT, unique local IPv6) is proposed for the tenant's list and its command, since only the tenant's entries reach one.
Refusals that no entry should change are listed for review: a TLS server name other than the tunnel's host (domain fronting), a Host header other than the URL's, a deny entry. A proposed entry that reaches a host serving files anyone can publish (a code host's raw files, a package registry, an object store) says so, as a reason to look before adding it.
--apply asks for the tenant's list with the proposed entries (never an internal address): a widening, so it is a change request a tenant admin approves (--approve approves it at once after printing its delta, when the tenant's review-widening lets you).
Usage
oz0 egress learn <job> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--apply | bool | ask for the tenant's list with the proposed entries: a change request | |
--approve | bool | with --apply, approve the change request at once after printing its delta | |
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--json | bool | print JSON instead of a table | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it | |
--tenant | string | default | the job's tenant |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.