---
title: "oz0 server operator issue"
description: "Issue a key, a certificate and a CLI context for an operator (default admin), and add the operator if the cluster has none of that name."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/server/operator/issue"
---
# oz0 server operator issue

> Issue a key, a certificate and a CLI context for an operator (default admin), and add the operator if the cluster has none of that name.

For: Operators and developers looking up a command.

Issue a key, a certificate and a CLI context for an operator (default admin), and add the operator if the cluster has none of that name. It runs on a server's machine: it reads the database and the master key, so whoever can run it is trusted like a server. A context already in --operator-dir keeps its addresses. An operator whose certificate still works renews it with `oz0 operator renew`.

## Usage

```bash
oz0 server operator issue [NAME] [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --advertise
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        127.0.0.1
      </code>
    </td>
    
    <td>
      server address for a new CLI context
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --ca-signer-command
      </code>
    </td>
    
    <td>
      command
    </td>
    
    <td>
      
    </td>
    
    <td>
      a command that signs with the cluster CA's key outside the server, such as in an HSM or a KMS: "COMMAND public-key" prints the key as PEM, "COMMAND sign sha256" signs the digest on stdin
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --data-dir
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        ~/.local/share/orchestrator-zero
      </code>
    </td>
    
    <td>
      server data directory
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --db-file
      </code>
    </td>
    
    <td>
      file
    </td>
    
    <td>
      
    </td>
    
    <td>
      a file (- for stdin) holding the PostgreSQL URL of the management database, such as postgres://oz0:PASSWORD@db:5432/oz0 (or set OZ0_DB); the URL can carry a password, so it never goes on the command line
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --dev
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      a dev server's data directory (--data-dir): its database and master key, and its operator directory
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --master-key-command
      </code>
    </td>
    
    <td>
      command
    </td>
    
    <td>
      
    </td>
    
    <td>
      a command that unwraps the master key from --master-key-file when the file holds it wrapped, such as with an HSM or a KMS: "COMMAND unwrap" prints the key from the wrapped document on stdin, "COMMAND wrap" wraps one, "COMMAND describe" says what holds the wrapping key (see the docs on key commands) (or set OZ0_MASTER_KEY_COMMAND)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --master-key-file
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        &lt;data-dir>/master.key
      </code>
    </td>
    
    <td>
      master key file
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --namespace
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        default
      </code>
    </td>
    
    <td>
      namespace for a new CLI context
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --operator-dir
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        &lt;config dir>/orchestrator-zero/&lt;name>
      </code>
    </td>
    
    <td>
      where to write the credentials
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.