Usage: tbot [<flags>] <command> [<args> ...]

Teleport Machine & Workload Identity

Machine & Workload Identity issues and renews short-lived certificates so your machines can access
Teleport protected resources in the same way your engineers do!

Find out more at https://goteleport.com/docs/machine-workload-identity/

Flags:
  -d, --[no-]debug     Verbose logging to stdout.
  -c, --config         Path to a configuration file.
      --[no-]fips      Runs tbot in FIPS compliance mode. This requires the FIPS binary is in use.
      --[no-]insecure  Insecure configures the bot to trust the certificates from the Auth Server or
                       Proxy on first connect without verification. Do not use in production.
      --log-format     Controls the format of output logs. Can be `json` or `text`. Defaults to
                       `text`.

Commands:
  help                                           Show help.
  version                                        Print the version of your tbot binary.
  start legacy                                   (Default) Starts tbot with either a config file or a legacy output.
  start identity                                 Starts tbot with an identity output for SSH and Teleport API access.
  start database                                 Starts tbot with a database output.
  start kubernetes                               Starts tbot with a Kubernetes output.
  start kubernetes/v2                            Starts tbot with a Kubernetes V2 output.
  start application                              Starts tbot with an application output.
  start application-tunnel                       Starts tbot with an application tunnel.
  start database-tunnel                          Starts tbot with a database tunnel listener.
  start spiffe-svid                              Starts tbot with a SPIFFE-compatible SVID output.
  start workload-identity-x509                   Starts tbot with a SPIFFE-compatible SVID output.
  start workload-identity-api                    Starts tbot with a workload identity API listener. Compatible with the SPIFFE Workload API and Envoy SDS.
  start workload-identity-jwt                    Starts tbot with a SPIFFE-compatible JWT SVID output.
  start workload-identity-aws-roles-anywhere     Starts tbot with an output containing AWS credentials generated via AWS Roles Anywhere.
  start application-proxy                        Starts tbot with an application proxy.
  configure legacy                               (Default) Configures tbot with either a config file or a legacy output.
  configure identity                             Configures tbot with an identity output for SSH and Teleport API access.
  configure database                             Configures tbot with a database output.
  configure kubernetes                           Configures tbot with a Kubernetes output.
  configure kubernetes/v2                        Configures tbot with a Kubernetes V2 output.
  configure application                          Configures tbot with an application output.
  configure application-tunnel                   Configures tbot with an application tunnel.
  configure database-tunnel                      Configures tbot with a database tunnel listener.
  configure spiffe-svid                          Configures tbot with a SPIFFE-compatible SVID output.
  configure workload-identity-x509               Configures tbot with a SPIFFE-compatible SVID output.
  configure workload-identity-api                Configures tbot with a workload identity API listener. Compatible with the SPIFFE Workload API and Envoy SDS.
  configure workload-identity-jwt                Configures tbot with a SPIFFE-compatible JWT SVID output.
  configure workload-identity-aws-roles-anywhere Configures tbot with an output containing AWS credentials generated via AWS Roles Anywhere.
  configure application-proxy                    Configures tbot with an application proxy.
  init                                           Initialize a certificate destination directory for writes from a separate bot user.
  migrate                                        Migrates a config file from an older version to the newest version. Outputs to stdout by default.
  proxy                                          Start a local TLS proxy via tsh to connect to Teleport in single-port mode.
  db                                             Execute database commands through tsh.
  spiffe-inspect                                 Inspects a SPIFFE Workload API endpoint to ensure it is working correctly.
  tpm identify                                   Output identifying information related to the TPM detected on the system.
  install systemd                                Generates and installs a systemd unit file for a specified tbot configuration file.

Try 'tbot help [command]' to get help for a given command.