Usage: tbot [<flags>] <command> [<args> ...]

Teleport Machine & Workload Identity issues and renews short-lived certificates so your machines can
access Teleport protected resources in the same way your engineers do.

Flags:
  -d, --[no-]debug       Enables verbose logging to stdout. ($TBOT_DEBUG)
  -c, --config=CONFIG    Path to a configuration file. ($TBOT_CONFIG_PATH)
      --[no-]fips        Enables FIPS compliance mode. This requires the FIPS binary is in use.
      --[no-]insecure    Insecure configures the bot to trust the certificates from the Auth Server
                         or Proxy on first connect without verification. Do not use in production.
      --log-format=text  Controls the format of output logs. Can be `json` or `text`. Defaults to
                         `text`.

Commands:
  help                                           Show help.
  version                                        Prints the version of this tbot binary.
  start legacy                                   (Default) Starts tbot with either a config file or a legacy output.
  start identity                                 Starts tbot with an identity output for SSH and Teleport API access.
  start database                                 Starts tbot with a database output.
  start kubernetes                               Starts tbot with a Kubernetes output.
  start kubernetes/v2                            Starts tbot with a Kubernetes V2 output.
  start application                              Starts tbot with an application output.
  start application-tunnel                       Starts tbot with an application tunnel.
  start database-tunnel                          Starts tbot with a database tunnel listener.
  start workload-identity-x509                   Starts tbot with a SPIFFE-compatible SVID output.
  start workload-identity-api                    Starts tbot with a workload identity API listener. Compatible with the SPIFFE Workload API and Envoy SDS.
  start workload-identity-jwt                    Starts tbot with a SPIFFE-compatible JWT SVID output.
  start workload-identity-aws-roles-anywhere     Starts tbot with an output containing AWS credentials generated via AWS Roles Anywhere.
  start application-proxy                        Starts tbot with a HTTP application proxy.
  start ssh-multiplexer                          Starts tbot with an SSH Multiplexer service.
  configure legacy                               (Default) Configures tbot with either a config file or a legacy output.
  configure identity                             Configures tbot with an identity output for SSH and Teleport API access.
  configure database                             Configures tbot with a database output.
  configure kubernetes                           Configures tbot with a Kubernetes output.
  configure kubernetes/v2                        Configures tbot with a Kubernetes V2 output.
  configure application                          Configures tbot with an application output.
  configure application-tunnel                   Configures tbot with an application tunnel.
  configure database-tunnel                      Configures tbot with a database tunnel listener.
  configure workload-identity-x509               Configures tbot with a SPIFFE-compatible SVID output.
  configure workload-identity-api                Configures tbot with a workload identity API listener. Compatible with the SPIFFE Workload API and Envoy SDS.
  configure workload-identity-jwt                Configures tbot with a SPIFFE-compatible JWT SVID output.
  configure workload-identity-aws-roles-anywhere Configures tbot with an output containing AWS credentials generated via AWS Roles Anywhere.
  configure application-proxy                    Configures tbot with a HTTP application proxy.
  configure ssh-multiplexer                      Configures tbot with an SSH Multiplexer service.
  keypair create                                 Creates a keypair to preregister for bound-keypair joining.
  init                                           Initializes a destination directory for writes from a separate bot user.
  migrate                                        Migrates a configuration file from an older version to the newest version. Outputs to stdout by default.
  proxy                                          Starts a local TLS proxy via tsh to connect to Teleport in single-port mode.
  db                                             Executes database commands through tsh.
  copy-binaries                                  Copies this tbot binary to a given destination.
  wait                                           Waits for a running tbot to become ready.
  spiffe-inspect                                 Inspects a SPIFFE Workload API endpoint to ensure it is working correctly.
  tpm identify                                   Outputs identifying information related to the TPM detected on the system.
  install systemd                                Generates and installs a systemd unit file for a specified tbot configuration file.

Try 'tbot help [command]' to get help for a given command.