Usage: tbot [<flags>] <command> [<args> ...]

Teleport Machine & Workload Identity issues and renews short-lived certificates so your machines can
access Teleport protected resources in the same way your engineers do.

Flags:
  -d, --[no-]debug       Enables verbose logging to stdout. ($TBOT_DEBUG)
  -c, --config=CONFIG    Path to a configuration file. ($TBOT_CONFIG_PATH)
      --[no-]fips        Enables FIPS compliance mode. This requires the FIPS binary is in use.
      --[no-]insecure    Insecure configures the bot to trust the certificates from the Auth Server
                         or Proxy on first connect without verification. Do not use in production.
      --log-format=text  Controls the format of output logs. Can be `json` or `text`. Defaults to
                         `text`. (one of: json, text)

Commands:
  help                                           Show help.
  version                                        Prints the version of this tbot binary.
  start legacy                                   (Default) Starts tbot with either a config file or a legacy output.
  start noop                                     Starts tbot with no configured services to test onboarding config.
  start identity                                 Starts tbot with an identity output for SSH and Teleport API access.
  start database                                 Starts tbot with a database output.
  start kubernetes                               Starts tbot with a Kubernetes output.
  start kubernetes/v2                            Starts tbot with a Kubernetes V2 output.
  start application                              Starts tbot with an application output.
  start application-tunnel                       Starts tbot with an application tunnel.
  start database-tunnel                          Starts tbot with a database tunnel listener.
  start workload-identity-x509                   Starts tbot with a SPIFFE-compatible SVID output.
  start workload-identity-api                    Starts tbot with a workload identity API listener. Compatible with the SPIFFE Workload API and Envoy SDS.
  start workload-identity-jwt                    Starts tbot with a SPIFFE-compatible JWT SVID output.
  start workload-identity-aws-roles-anywhere     Starts tbot with an output containing AWS credentials generated via AWS Roles Anywhere.
  start application-proxy                        Starts tbot with a HTTP application proxy.
  start ssh-multiplexer                          Starts tbot with an SSH Multiplexer service.
  configure legacy                               (Default) Configures tbot with either a config file or a legacy output.
  configure noop                                 Configures tbot with no configured services to test onboarding config.
  configure identity                             Configures tbot with an identity output for SSH and Teleport API access.
  configure database                             Configures tbot with a database output.
  configure kubernetes                           Configures tbot with a Kubernetes output.
  configure kubernetes/v2                        Configures tbot with a Kubernetes V2 output.
  configure application                          Configures tbot with an application output.
  configure application-tunnel                   Configures tbot with an application tunnel.
  configure database-tunnel                      Configures tbot with a database tunnel listener.
  configure workload-identity-x509               Configures tbot with a SPIFFE-compatible SVID output.
  configure workload-identity-api                Configures tbot with a workload identity API listener. Compatible with the SPIFFE Workload API and Envoy SDS.
  configure workload-identity-jwt                Configures tbot with a SPIFFE-compatible JWT SVID output.
  configure workload-identity-aws-roles-anywhere Configures tbot with an output containing AWS credentials generated via AWS Roles Anywhere.
  configure application-proxy                    Configures tbot with a HTTP application proxy.
  configure ssh-multiplexer                      Configures tbot with an SSH Multiplexer service.
  keypair create                                 Creates a keypair to preregister for bound-keypair joining.
  init                                           Initializes a destination directory for writes from a separate bot user.
  migrate                                        Migrates a configuration file from an older version to the newest version. Outputs to stdout by default.
  proxy                                          Starts a local TLS proxy via tsh to connect to Teleport in single-port mode.
  db                                             Executes database commands through tsh.
  copy-binaries                                  Copies this tbot binary to a given destination.
  wait                                           Waits for a running tbot to become ready.
  spiffe-inspect                                 Inspects a SPIFFE Workload API endpoint to ensure it is working correctly.
  tpm identify                                   Outputs identifying information related to the TPM detected on the system.
  install systemd                                Generates and installs a systemd unit file for a specified tbot configuration file.

Try 'tbot help [command]' to get help for a given command.