lok8s

Appearance

CLI commands ​

Every command of the lo binary with its flags and examples, generated from the command tree (go run ./hack/gen-cli-docs, checked by go test ./internal/clidoc/). Do not edit this file: change the command's help text and regenerate. The hand-written CLI reference explains the commands; this page lists them. The global flags are listed once, under lo.

lo ​

lok8s - local dev orchestration

lo [flags]

Options ​

  -s, --cluster string       Cluster name to manage
      --config string        Kind config to use
      --debug                On a failure, print the external command line (docker, kind, kubectl, …) and its exit code
      --domain string        Domain to use
      --domain-sans string   Domain sans to use
  -f, --force                Force operation without prompts (also recreates immutable/terminating conflicts)
      --force-recreate       On apply, recreate objects blocked by an immutable field or a stuck Terminating finalizer
  -h, --help                 help for lo
      --kubernetes string    Kubernetes version to use
      --no-color             No ANSI colour on the terminal (env form: NO_COLOR)
      --no-eject             Never write embedded framework assets into the project (.lok8s/…); serve them from a temp dir instead
  -q, --quiet                Print errors and warnings only: no [assets] or DOMAIN_NAME notices
  -r, --remote               Provision on remote VM (uses spec.provider + spec.remote)
  -v, --verbose count        Enable verbose logging

SEE ALSO ​

  • lo addons - List driver addons for the active cluster
  • lo ai - Manage the AI integration (lo chat + agent skills)
  • lo assets - Manage the framework assets embedded in the binary
  • lo audit - Static security-posture audit (read-only, cluster-free; --json | --sarif)
  • lo bootstrap - Apply/reapply bootstrap addons
  • lo build - Build kustomize targets
  • lo chat - Chat with a local AI (transparent, streaming)
  • lo clean - Clean up local volumes
  • lo completion - Generate the autocompletion script for the specified shell
  • lo deploy - Deploy platform
  • lo destroy - Destroy a cluster
  • lo doctor - Diagnose the environment + toolchain
  • lo down - Stop cluster
  • lo drivers - Driver-specific commands
  • lo gitops - GitOps integration
  • lo image - Manage the local cache registry
  • lo init - Scaffold service config (lok8s.yaml/services.yaml/Tiltfile)
  • lo kubeconfig - Print a domain kubeconfig (--oidc for kubelogin exec-plugin)
  • lo kubehz - kubehz platform integration
  • lo kustomize - Manage kustomize plugins (Go)
  • lo lint - Validate structure and specs
  • lo mcp - Serve the lo commands as MCP tools (stdio or HTTP)
  • lo provision - Provision a cluster (full lifecycle)
  • lo recover - Rebuild a cluster from bare metal (disaster recovery)
  • lo registry - Manage Docker registries
  • lo secrets - Manage secrets (encrypt/decrypt/set)
  • lo status - Cluster health and status
  • lo tilt - Manage tilt cluster
  • lo toolchain - Install and verify the pinned project toolchain via b
  • lo trust - Trust the local dev CA (mkcert -install)
  • lo up - Start cluster
  • lo use - Set/show active domain
  • lo version - Print lok8s + toolchain versions

lo addons ​

List driver addons for the active cluster

lo addons [addon...] [flags]

Examples ​

  lo addons
  lo addons cilium
  lo addons --detail --origin

Options ​

      --detail count    Inventory the addons THIS cluster deploys (spec.bootstrap) + category + how to configure
  -h, --help            help for addons
      --origin          Add the ORIGIN column: builtin (served from the binary) · local · local (modified) · local-only (see: lo assets)
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo ai ​

Manage the AI integration (lo chat + agent skills)

lo ai [flags]

Examples ​

  lo ai check
  lo ai skills

Options ​

  -h, --help   help for ai

SEE ALSO ​

  • lo - lok8s - local dev orchestration
  • lo ai check - Check the AI setup: lo mcp bridge, local runtime, skill wiring
  • lo ai link - Symlink (or --copy) the skills into an assistant skill dir
  • lo ai skills - List the agent skills and how each assistant gets them
  • lo ai unlink - Remove skills previously linked into an assistant

lo ai check ​

Check the AI setup: lo mcp bridge, local runtime, skill wiring

lo ai check [flags]

Examples ​

  lo ai check

Options ​

  -h, --help   help for check

SEE ALSO ​

  • lo ai - Manage the AI integration (lo chat + agent skills)

Symlink (or --copy) the skills into an assistant skill dir

lo ai link [agent] [flags]

Examples ​

  lo ai link claude
  lo ai link cursor --copy

Options ​

  -c, --copy count   Copy the skills instead of symlinking
  -h, --help         help for link

SEE ALSO ​

  • lo ai - Manage the AI integration (lo chat + agent skills)

lo ai skills ​

List the agent skills and how each assistant gets them

lo ai skills [flags]

Examples ​

  lo ai skills

Options ​

  -h, --help   help for skills

SEE ALSO ​

  • lo ai - Manage the AI integration (lo chat + agent skills)

Remove skills previously linked into an assistant

lo ai unlink [agent] [flags]

Examples ​

  lo ai unlink claude

Options ​

  -h, --help   help for unlink

SEE ALSO ​

  • lo ai - Manage the AI integration (lo chat + agent skills)

lo assets ​

Manage the framework assets embedded in the binary

lo assets [flags]

Examples ​

  lo assets list
  lo assets diff --check

Options ​

  -h, --help   help for assets

SEE ALSO ​

lo assets diff ​

Diff an asset three ways: origin, local, embedded

Synopsis ​

Per file: unchanged · local modified · lo updated · both (conflict) · local-only · builtin-only. The headline per addon is the chart version (local vs embedded). --check exits 1 on any drift.

lo assets diff [rel...] [flags]

Examples ​

  lo assets diff
  lo assets diff addons/cilium
  lo assets diff --check

Options ​

      --check           Exit 1 on any drift
  -h, --help            help for diff
      --json            Machine-readable output (the same as -o json)
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

  • lo assets - Manage the framework assets embedded in the binary

lo assets eject ​

Write embedded assets into the project (.lok8s/<rel>/)

Synopsis ​

Materialize embedded framework assets into the project so what a cluster applies is pinned on disk. Without arguments the set is what this project's cluster specs reference (every builtin spec.bootstrap addon, the driver's cluster templates, the inventory CRD); --all ejects every data asset. An existing local copy is never touched. --check writes nothing and exits 1 when any of the set would be ejected — the CI gate for "this repo pins what it applies".

The rel "bash" is the frozen bash implementation (lo, libs/, utils/, the drivers' code, the provider plugins). Ejecting it writes the code half into .lok8s/ with a .lo-origin marker at the tree root and ejects every data asset the project lacks, so .lok8s/ is a complete tree: the provider plugins then run from it instead of the copy the binary extracts into its cache, and lok8s.yaml can route commands to it (spec.implementation; a routing never runs from the cache). It is never part of --all or of the referenced set.

lo assets eject [rel...] [flags]

Examples ​

  lo assets eject
  lo assets eject addons/cilium
  lo assets eject bash

Options ​

      --all     Eject every embedded asset, not only the referenced ones
      --check   Write nothing; exit 1 if any asset would be ejected
  -h, --help    help for eject

SEE ALSO ​

  • lo assets - Manage the framework assets embedded in the binary

lo assets list ​

List every embedded asset with its origin

lo assets list [flags]

Examples ​

  lo assets list
  lo assets list --json

Options ​

  -h, --help            help for list
      --json            Machine-readable output (the same as -o json)
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

  • lo assets - Manage the framework assets embedded in the binary

lo assets update ​

Apply the embedded copy over an untouched local one

lo assets update <rel> [flags]

Examples ​

  lo assets update addons/cilium
  lo assets update addons/cilium --force

Options ​

  -h, --help   help for update

SEE ALSO ​

  • lo assets - Manage the framework assets embedded in the binary

lo audit ​

Static security-posture audit (read-only, cluster-free; --json | --sarif)

lo audit [domain] [flags]

Examples ​

  lo audit
  lo audit kubehz.cloud --json
  lo audit --sarif > audit.sarif

Options ​

  -h, --help            help for audit
      --json            Emit machine-readable JSON (stable schema for tooling; the same as -o json)
  -o, --output string   Output format: text, json or yaml (default "text")
      --sarif           Emit SARIF 2.1.0 (GitHub code-scanning upload)

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo bootstrap ​

Apply/reapply bootstrap addons

lo bootstrap [flags]

Examples ​

  lo bootstrap
  lo bootstrap --dry-run --render-dir /tmp/bootstrap
  lo bootstrap --only cert-manager,envoy-gateway

Options ​

      --allow-generators          Run the addon's own executable code in a dry run (exec plugins, KRM functions, bash: generators, remote bases) as trusted, with a real run's side effects (default: refused)
      --dry-run                   Render every entry and apply nothing: diff each one against the cluster (exit 0 unchanged, 1 changes, 2 error)
  -h, --help                      help for bootstrap
      --ignore-nondeterministic   Dry run: judge each entry without the objects its chart regenerates on every apply (they are still listed)
      --no-diff                   Dry run without the kubectl diff: render only, no cluster access
      --only strings              Apply (or dry-run) only these spec.bootstrap entries, comma-separated. A value selects every entry whose name (name:, else the last path element), key as written in spec.bootstrap (./targets/flux) or directory name (of an addon or a target) is equal to it: --only rook-ceph also selects ./targets/rook-ceph named rook-ceph-cluster. dependsOn is not expanded
      --render-dir string         Write the dry run's manifests (NN-<entry>.yaml) and diffs (NN-<entry>.diff) into this directory
      --with-restore              With --only, also apply restore.d first (default: --only skips it and warns when it is non-empty)

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo build ​

Build kustomize targets

lo build [flags]

Examples ​

  lo build
  lo build --domain kubehz.cloud

Options ​

      --cluster-override string   Override cluster domain for kubeconfig resolution
  -h, --help                      help for build
      --no-secrets                Split ONLY non-Secret resources; never render, re-encrypt, prune, or even read committed Secret.*.sops.yaml (CI render path — no store/key needed)
      --single                    Skip the split emit even when the spec declares it (debug override)
      --split                     Also emit per-resource files under artifacts/ (debug override; declare it in spec.build.artifacts instead)

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo chat ​

Chat with a local AI (transparent, streaming)

lo chat [flags]

Examples ​

  lo chat

Options ​

  -h, --help   help for chat

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo clean ​

Clean up local volumes

lo clean [flags]

Examples ​

  lo clean
  lo clean --all

Options ​

  -a, --all    Clean up all volumes
  -h, --help   help for clean
  -y, --yes    Answer the confirmation on a terminal (off a terminal there is none)

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo completion ​

Generate the autocompletion script for the specified shell

Synopsis ​

Generate the autocompletion script for lo for the specified shell. See each sub-command's help for details on how to use the generated script.

Examples ​

  source <(lo completion bash)
  lo completion zsh > "${fpath[1]}/_lo"

Options ​

  -h, --help   help for completion

SEE ALSO ​

lo completion bash ​

Generate the autocompletion script for bash

Synopsis ​

Generate the autocompletion script for the bash shell.

This script depends on the 'bash-completion' package. If it is not installed already, you can install it via your OS's package manager.

To load completions in your current shell session:

source <(lo completion bash)

To load completions for every new session, execute once:

Linux: ​

lo completion bash > /etc/bash_completion.d/lo

macOS: ​

lo completion bash > $(brew --prefix)/etc/bash_completion.d/lo

You will need to start a new shell for this setup to take effect.

lo completion bash

Examples ​

  source <(lo completion bash)
  lo completion bash > /etc/bash_completion.d/lo

Options ​

  -h, --help              help for bash
      --no-descriptions   disable completion descriptions

SEE ALSO ​

  • lo completion - Generate the autocompletion script for the specified shell

lo completion fish ​

Generate the autocompletion script for fish

Synopsis ​

Generate the autocompletion script for the fish shell.

To load completions in your current shell session:

lo completion fish | source

To load completions for every new session, execute once:

lo completion fish > ~/.config/fish/completions/lo.fish

You will need to start a new shell for this setup to take effect.

lo completion fish [flags]

Examples ​

  lo completion fish > ~/.config/fish/completions/lo.fish

Options ​

  -h, --help              help for fish
      --no-descriptions   disable completion descriptions

SEE ALSO ​

  • lo completion - Generate the autocompletion script for the specified shell

lo completion powershell ​

Generate the autocompletion script for powershell

Synopsis ​

Generate the autocompletion script for powershell.

To load completions in your current shell session:

lo completion powershell | Out-String | Invoke-Expression

To load completions for every new session, add the output of the above command to your powershell profile.

lo completion powershell [flags]

Examples ​

  lo completion powershell | Out-String | Invoke-Expression

Options ​

  -h, --help              help for powershell
      --no-descriptions   disable completion descriptions

SEE ALSO ​

  • lo completion - Generate the autocompletion script for the specified shell

lo completion zsh ​

Generate the autocompletion script for zsh

Synopsis ​

Generate the autocompletion script for the zsh shell.

If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once:

echo "autoload -U compinit; compinit" >> ~/.zshrc

To load completions in your current shell session:

source <(lo completion zsh)

To load completions for every new session, execute once:

Linux: ​

lo completion zsh > "${fpath[1]}/_lo"

macOS: ​

lo completion zsh > $(brew --prefix)/share/zsh/site-functions/_lo

You will need to start a new shell for this setup to take effect.

lo completion zsh [flags]

Examples ​

  lo completion zsh > "${fpath[1]}/_lo"

Options ​

  -h, --help              help for zsh
      --no-descriptions   disable completion descriptions

SEE ALSO ​

  • lo completion - Generate the autocompletion script for the specified shell

lo deploy ​

Deploy platform

lo deploy [flags]

Examples ​

  lo deploy
  lo deploy -l lok8s.dev/name=zitadel
  lo deploy --domain kubehz.cloud --cluster-override kubehz.in.net

Options ​

      --cluster-override string   Override cluster domain for kubeconfig resolution
  -h, --help                      help for deploy
  -l, --label string              Only deploy resources with this label (key=value; key may be lok8s.dev/<x> or any label key)

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo destroy ​

Destroy a cluster

lo destroy [flags]

Examples ​

  lo destroy
  lo destroy --domain kubehz.in.net

Options ​

      --confirm-cluster string   The provider's cluster_name, to confirm the destroy off a terminal (--force does not replace it)
  -h, --help                     help for destroy
  -y, --yes                      Answer the confirmation on a terminal (off a terminal there is none)

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo doctor ​

Diagnose the environment + toolchain

lo doctor [flags]

Examples ​

  lo doctor
  lo doctor --toolchain

Options ​

  -h, --help            help for doctor
  -o, --output string   Output format: text, json or yaml (default "text")
      --toolchain       Verify the b-managed toolchain against the pins (default: only when .bin/b.yaml was written by lo toolchain install)

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo down ​

Stop cluster

lo down [flags]

Examples ​

  lo down
  lo down --domain kubehz.dev

Options ​

  -h, --help   help for down
  -y, --yes    Answer the confirmation on a terminal (off a terminal there is none)

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo drivers ​

Driver-specific commands

lo drivers [name] [args...] [flags]

Examples ​

  lo drivers --list
  lo drivers lo status kubehz.dev

Options ​

  -h, --help         help for drivers
  -l, --list count   List available drivers
      --origin       With --list: add the origin of each driver's cluster templates (builtin · local · local (modified) · local-only)

SEE ALSO ​

lo drivers capi ​

CAPI driver

lo drivers capi [flags]

Examples ​

  lo drivers capi status kubehz.dev
  lo drivers capi provision kubehz.dev

Options ​

  -h, --help   help for capi

SEE ALSO ​

lo drivers capi destroy ​

Destroy a CAPI cluster

lo drivers capi destroy <domain> [flags]

Examples ​

  lo drivers capi destroy kubehz.dev

Options ​

  -h, --help   help for destroy

SEE ALSO ​

lo drivers capi kubeconfig ​

Extract kubeconfig path

lo drivers capi kubeconfig <domain> [flags]

Examples ​

  lo drivers capi kubeconfig kubehz.dev

Options ​

  -h, --help   help for kubeconfig

SEE ALSO ​

lo drivers capi provision ​

Provision a CAPI cluster

lo drivers capi provision <domain> [flags]

Examples ​

  lo drivers capi provision kubehz.dev

Options ​

  -h, --help   help for provision

SEE ALSO ​

lo drivers capi status ​

Check cluster status

lo drivers capi status <domain> [flags]

Examples ​

  lo drivers capi status kubehz.dev

Options ​

  -h, --help   help for status

SEE ALSO ​

lo drivers kkp ​

KKP driver

lo drivers kkp [flags]

Examples ​

  lo drivers kkp status kubehz.dev
  lo drivers kkp provision kubehz.dev

Options ​

  -h, --help   help for kkp

SEE ALSO ​

lo drivers kkp destroy ​

Destroy a KKP cluster

lo drivers kkp destroy <domain> [flags]

Examples ​

  lo drivers kkp destroy kubehz.dev

Options ​

  -h, --help   help for destroy

SEE ALSO ​

lo drivers kkp kubeconfig ​

Extract kubeconfig path

lo drivers kkp kubeconfig <domain> [flags]

Examples ​

  lo drivers kkp kubeconfig kubehz.dev

Options ​

  -h, --help   help for kubeconfig

SEE ALSO ​

lo drivers kkp provision ​

Provision a KKP cluster

lo drivers kkp provision <domain> [flags]

Examples ​

  lo drivers kkp provision kubehz.dev

Options ​

  -h, --help   help for provision

SEE ALSO ​

lo drivers kkp status ​

Check cluster status

lo drivers kkp status <domain> [flags]

Examples ​

  lo drivers kkp status kubehz.dev

Options ​

  -h, --help   help for status

SEE ALSO ​

lo drivers kubehz ​

kubehz space driver

lo drivers kubehz [flags]

Examples ​

  lo drivers kubehz status kubehz.dev
  lo drivers kubehz provision kubehz.dev

Options ​

  -h, --help   help for kubehz

SEE ALSO ​

lo drivers kubehz destroy ​

Remove the space from kubehz

lo drivers kubehz destroy <domain> [flags]

Examples ​

  lo drivers kubehz destroy kubehz.dev

Options ​

  -h, --help   help for destroy

SEE ALSO ​

lo drivers kubehz kubeconfig ​

Print the space kubeconfig path written by provision

lo drivers kubehz kubeconfig <domain> [flags]

Examples ​

  lo drivers kubehz kubeconfig kubehz.dev

Options ​

  -h, --help   help for kubeconfig

SEE ALSO ​

lo drivers kubehz provision ​

Create/adopt the space + mint node join tickets

lo drivers kubehz provision <domain> [flags]

Examples ​

  lo drivers kubehz provision kubehz.dev

Options ​

  -h, --help   help for provision

SEE ALSO ​

lo drivers kubehz status ​

Show space + node status

lo drivers kubehz status <domain> [flags]

Examples ​

  lo drivers kubehz status kubehz.dev

Options ​

  -h, --help   help for status

SEE ALSO ​

lo drivers kubeone ​

KubeOne driver

lo drivers kubeone [flags]

Examples ​

  lo drivers kubeone status kubehz.dev
  lo drivers kubeone provision kubehz.dev

Options ​

  -h, --help   help for kubeone

SEE ALSO ​

lo drivers kubeone destroy ​

Destroy a KubeOne cluster

lo drivers kubeone destroy <domain> [flags]

Examples ​

  lo drivers kubeone destroy kubehz.dev

Options ​

  -h, --help   help for destroy

SEE ALSO ​

lo drivers kubeone kubeconfig ​

Extract kubeconfig path

lo drivers kubeone kubeconfig <domain> [flags]

Examples ​

  lo drivers kubeone kubeconfig kubehz.dev

Options ​

  -h, --help   help for kubeconfig

SEE ALSO ​

lo drivers kubeone provision ​

Provision a KubeOne cluster

lo drivers kubeone provision <domain> [flags]

Examples ​

  lo drivers kubeone provision kubehz.dev

Options ​

  -h, --help   help for provision

SEE ALSO ​

lo drivers kubeone status ​

Check cluster status

lo drivers kubeone status <domain> [flags]

Examples ​

  lo drivers kubeone status kubehz.dev

Options ​

  -h, --help   help for status

SEE ALSO ​

lo drivers lo ​

Lo driver

lo drivers lo [flags]

Examples ​

  lo drivers lo status kubehz.dev
  lo drivers lo provision kubehz.dev

Options ​

  -h, --help   help for lo

SEE ALSO ​

lo drivers lo destroy ​

Destroy a cluster

lo drivers lo destroy <domain> [flags]

Examples ​

  lo drivers lo destroy kubehz.dev

Options ​

  -h, --help   help for destroy

SEE ALSO ​

lo drivers lo kubeconfig ​

Extract kubeconfig (writes .kubeconfig/, may open an SSH tunnel)

lo drivers lo kubeconfig <domain> [flags]

Examples ​

  lo drivers lo kubeconfig kubehz.dev

Options ​

  -h, --help   help for kubeconfig

SEE ALSO ​

lo drivers lo provision ​

Provision a cluster

lo drivers lo provision <domain> [flags]

Examples ​

  lo drivers lo provision kubehz.dev

Options ​

  -h, --help   help for provision

SEE ALSO ​

lo drivers lo status ​

Check cluster status

lo drivers lo status <domain> [flags]

Examples ​

  lo drivers lo status kubehz.dev

Options ​

  -h, --help   help for status

SEE ALSO ​

lo gitops ​

GitOps integration

lo gitops [flags]

Examples ​

  lo gitops flux
  lo gitops argo --domain kubehz.cloud

Options ​

  -h, --help   help for gitops

SEE ALSO ​

  • lo - lok8s - local dev orchestration
  • lo gitops argo - Annotate artifacts with Argo sync-wave (deferred)
  • lo gitops flux - Generate Flux manifests (deferred)

lo gitops argo ​

Annotate artifacts with Argo sync-wave (deferred)

lo gitops argo [flags]

Examples ​

  lo gitops argo
  lo gitops argo --domain kubehz.cloud

Options ​

  -h, --help   help for argo

SEE ALSO ​

lo gitops flux ​

Generate Flux manifests (deferred)

lo gitops flux [flags]

Examples ​

  lo gitops flux
  lo gitops flux --domain kubehz.cloud

Options ​

  -h, --help   help for flux

SEE ALSO ​

lo image ​

Manage the local cache registry

lo image [flags]

Examples ​

  lo image cache api
  lo image list

Options ​

  -h, --help   help for image

SEE ALSO ​

  • lo - lok8s - local dev orchestration
  • lo image cache - Pre-pull image(s) into the local cache registry
  • lo image clean - Drop all images from the cache registry
  • lo image list - List images currently in the cache registry

lo image cache ​

Pre-pull image(s) into the local cache registry

lo image cache [service] [flags]

Examples ​

  lo image cache api
  lo image cache --all --force

Options ​

  -a, --all     Process every service in the active cache queue
  -f, --force   Force re-pull even if image exists in cache
  -h, --help    help for cache

SEE ALSO ​

  • lo image - Manage the local cache registry

lo image clean ​

Drop all images from the cache registry

lo image clean [flags]

Examples ​

  lo image clean

Options ​

  -h, --help   help for clean
  -y, --yes    Answer the confirmation on a terminal (off a terminal there is none)

SEE ALSO ​

  • lo image - Manage the local cache registry

lo image list ​

List images currently in the cache registry

lo image list [flags]

Examples ​

  lo image list

Options ​

  -h, --help   help for list

SEE ALSO ​

  • lo image - Manage the local cache registry

lo init ​

Scaffold service config (lok8s.yaml/services.yaml/Tiltfile)

lo init [flags]

Examples ​

  lo init
  lo init --plan
  lo init service api

Options ​

  -n, --dry-run   The same as --plan
  -h, --help      help for init
      --plan      Print what lo init sees here and offers, as text; write nothing (works off a terminal)
  -y, --yes       Never ask: print the help instead of the screens (scripts, CI)

SEE ALSO ​

  • lo - lok8s - local dev orchestration
  • lo init cluster - Scaffold a cluster spec, clusters/<domain>/cluster.lok8s.yaml, and make it the active domain
  • lo init project - Scaffold a project (clusters/, lok8s.yaml, .gitignore entries, one env file, optionally the first cluster spec) — files only, no network
  • lo init service - Scaffold a bare service (lok8s.yaml + services.yaml + Tiltfile)
  • lo init test - Scaffold a Playwright integration suite (tests/)

lo init cluster ​

Scaffold a cluster spec, clusters/<domain>/cluster.lok8s.yaml, and make it the active domain

lo init cluster [domain] [flags]

Examples ​

  lo init cluster demo.dev
  lo init cluster prod.example.com --driver kubeone

Options ​

      --driver string   Driver of the spec: lo, kubeone, capi, kkp, kubehz-hosted (default "lo")
  -n, --dry-run         The same as --plan
  -h, --help            help for cluster
      --no-active       Write the spec only; keep the active domain as it is
      --plan            Print the screen as text and write nothing (works off a terminal)
  -y, --yes             Never ask: run with the values given (scripts, CI)

SEE ALSO ​

  • lo init - Scaffold service config (lok8s.yaml/services.yaml/Tiltfile)

lo init project ​

Scaffold a project (clusters/, lok8s.yaml, .gitignore entries, one env file, optionally the first cluster spec) — files only, no network

lo init project [name] [flags]

Examples ​

  lo init project
  lo init project acme --env direnv
  lo init project --cluster demo.dev --driver lo

Options ​

      --cluster string          Also write the first cluster spec, clusters/<domain>/cluster.lok8s.yaml, for this domain
      --driver string           Driver of the --cluster spec: lo, kubeone, capi, kkp, kubehz-hosted (default "lo")
      --env string              Shell environment file to scaffold: mise (mise.toml), direnv (.envrc) or none — PATH only, no PATH_* pins (default "mise")
  -h, --help                    help for project
      --implementation string   Set spec.implementation.default in lok8s.yaml: go or bash (the file is created when missing; comments and other keys are kept)
  -p, --path string             Directory for the project (default: the working directory)

SEE ALSO ​

  • lo init - Scaffold service config (lok8s.yaml/services.yaml/Tiltfile)

lo init service ​

Scaffold a bare service (lok8s.yaml + services.yaml + Tiltfile)

lo init service [name] [flags]

Examples ​

  lo init service api
  lo init service worker --path services/worker

Options ​

  -n, --dry-run       The same as --plan
  -h, --help          help for service
  -p, --path string   Directory for the service (default: ./<name>)
      --plan          Print the screen as text and write nothing (works off a terminal)
  -y, --yes           Never ask: run with the values given (scripts, CI)

SEE ALSO ​

  • lo init - Scaffold service config (lok8s.yaml/services.yaml/Tiltfile)

lo init test ​

Scaffold a Playwright integration suite (tests/)

lo init test [flags]

Examples ​

  lo init test
  lo init test --path e2e --force

Options ​

  -n, --dry-run       The same as --plan
  -h, --help          help for test
  -p, --path string   Directory for the suite (default: ./tests)
      --plan          Print the screen as text and write nothing (works off a terminal)
  -y, --yes           Never ask: run with the values given (scripts, CI)

SEE ALSO ​

  • lo init - Scaffold service config (lok8s.yaml/services.yaml/Tiltfile)

lo kubeconfig ​

Print a domain kubeconfig (--oidc for kubelogin exec-plugin)

lo kubeconfig [flags]

Examples ​

  lo kubeconfig > .kubeconfig/kubehz-dev.yaml
  lo kubeconfig --oidc --domain kubehz.cloud
  lo kc --cluster-override kubehz.in.net

Options ​

      --cluster-override string   Override cluster domain for kubeconfig resolution
  -h, --help                      help for kubeconfig
  -o, --oidc count                Emit an OIDC (kubelogin exec-plugin) kubeconfig instead of the admin one

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo kubehz ​

kubehz platform integration

lo kubehz [flags]

Examples ​

  lo kubehz register
  lo kubehz status
  lo kubehz deploy --dry-run

Options ​

  -h, --help   help for kubehz

SEE ALSO ​

lo kubehz assess ​

Show the platform assessment + handover feasibility

lo kubehz assess [flags]

Examples ​

  lo kubehz assess

Options ​

  -h, --help   help for assess

SEE ALSO ​

lo kubehz claim ​

Place a dashboard-minted claim nonce for the agent to echo (mode 3)

lo kubehz claim --nonce <khzn_…> [flags]

Examples ​

  lo kubehz claim --nonce khzn_2f9c1e
  lo kubehz claim --nonce - < nonce.txt

Options ​

  -h, --help           help for claim
  -n, --nonce string   Claim-challenge nonce minted in the dashboard (khzn_…); '-' reads it from stdin, or set KUBEHZ_CLAIM_NONCE

SEE ALSO ​

lo kubehz claim-code ​

Print the one-time claim code to paste into the dashboard

lo kubehz claim-code [flags]

Examples ​

  lo kubehz claim-code

Options ​

  -h, --help   help for claim-code

SEE ALSO ​

lo kubehz cluster ​

Clusters through the kubehz api (agent tools)

lo kubehz cluster [flags]

Examples ​

  lo kubehz cluster list
  lo kubehz cluster lease cl-1a2b3c4d --hours 4

Options ​

  -h, --help   help for cluster

SEE ALSO ​

lo kubehz cluster get ​

Show one cluster

lo kubehz cluster get <id> [flags]

Examples ​

  lo kubehz cluster get cl-1a2b3c4d -o json

Options ​

  -h, --help            help for get
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

lo kubehz cluster kubeconfig ​

Write the agent kubeconfig of a hosted cluster to a file

lo kubehz cluster kubeconfig <id> --file <path> [flags]

Examples ​

  lo kubehz cluster kubeconfig cl-1a2b3c4d --file agent.yaml

Options ​

      --file string     Write the kubeconfig to this file (mode 0600) and print the path; a file that exists needs --force
  -h, --help            help for kubeconfig
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

lo kubehz cluster lease ​

Set the hours until the platform deletes a hosted cluster

lo kubehz cluster lease <id> --hours <n> [flags]

Examples ​

  lo kubehz cluster lease cl-1a2b3c4d --hours 4

Options ​

  -h, --help            help for lease
      --hours string    Hours from now until the platform deletes it (1 to 720)
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

lo kubehz cluster list ​

List the clusters the credential reaches

lo kubehz cluster list [flags]

Examples ​

  lo kubehz cluster list
  lo kubehz cluster list -o yaml

Options ​

  -h, --help            help for list
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

lo kubehz deploy ​

Deploy the in-cluster agent (spec.kubehz.agent)

lo kubehz deploy [flags]

Examples ​

  lo kubehz deploy
  lo kubehz deploy --dry-run

Options ​

      --dry-run   Print the rendered manifests and apply nothing
  -h, --help      help for deploy

SEE ALSO ​

lo kubehz deregister ​

Remove cluster from kubehz

lo kubehz deregister [flags]

Examples ​

  lo kubehz deregister

Options ​

  -h, --help   help for deregister

SEE ALSO ​

lo kubehz handover ​

Control-plane handover (receive/preseed on the eject target)

lo kubehz handover [flags]

Examples ​

  lo kubehz handover receive --bundle handover.tar.gz
  lo kubehz handover preseed --bundle handover.tar.gz --node 10.0.0.12

Options ​

  -h, --help   help for handover

SEE ALSO ​

lo kubehz handover preseed ​

Pre-seed exported PKI onto a kubeone node before kubeone apply

lo kubehz handover preseed --bundle <path> --node <ip> [flags]

Examples ​

  lo kubehz handover preseed --bundle handover.tar.gz --node 10.0.0.12

Options ​

  -b, --bundle string        Export bundle: a directory or .tar.gz with the contract keys
  -h, --help                 help for preseed
      --known-hosts string   known_hosts file for the node's host key (default: ssh's own); a new host is recorded, a changed key fails
  -n, --node string          Target node address (kubeone node0) to place the PKI on
  -p, --port int             SSH port (default 22)
  -i, --ssh-key string       SSH private key file
  -u, --user string          SSH user (default "root")

SEE ALSO ​

lo kubehz handover receive ​

Restore an exported control plane onto THIS node (kubeadm path)

lo kubehz handover receive --bundle <path> [--snapshot <file>] [--single-node] [--force] [flags]

Examples ​

  lo kubehz handover receive --bundle handover.tar.gz
  lo kubehz handover receive --bundle handover.tar.gz --single-node

Options ​

  -b, --bundle string     Exported control-plane bundle (tar or directory)
      --cluster string    Cluster name to manage
  -h, --help              help for receive
      --single-node       Restore as a single control-plane node
  -s, --snapshot string   etcd snapshot file to restore (default: the bundle's snapshot-location)

SEE ALSO ​

lo kubehz join ​

Mint a node join ticket (hosting: shared)

lo kubehz join <node> [flags]

Examples ​

  lo kubehz join worker-1
  lo kubehz join worker-1 --print-token

Options ​

  -h, --help          help for join
      --print-token   Also print the plaintext ticket when a join script was written

SEE ALSO ​

lo kubehz node ​

Nodes you bring to a hosted control plane (join/remove/status)

lo kubehz node [flags]

Examples ​

  lo kubehz node join
  lo kubehz node status

Options ​

  -h, --help   help for node

SEE ALSO ​

lo kubehz node join ​

Join THIS machine to a hosted cluster (runs kubeadm join)

lo kubehz node join [flags]

Examples ​

  sudo lo kubehz node join
  lo kubehz node join --print-only

Options ​

  -c, --cluster-id string        Cluster id (cl-xxxxxxxx); default: the cluster of the active domain
  -h, --help                     help for join
      --kubelet-version string   Kubelet version to declare; default: read from this machine
  -n, --name string              Node name; default: the short hostname of this machine
      --node-ip string           Address other nodes reach this machine on (needed behind NAT)
  -p, --pool string              Static pool to join; default: the one pool every node of the cluster is in
      --print-only               Print the join command and run nothing

SEE ALSO ​

  • lo kubehz node - Nodes you bring to a hosted control plane (join/remove/status)

lo kubehz node remove ​

Remove one node from a hosted cluster and free its slot

lo kubehz node remove --name <node> [flags]

Examples ​

  lo kubehz node remove --name worker-1

Options ​

  -c, --cluster-id string   Cluster id (cl-xxxxxxxx); default: the cluster of the active domain
  -h, --help                help for remove
  -n, --name string         Node name to remove

SEE ALSO ​

  • lo kubehz node - Nodes you bring to a hosted control plane (join/remove/status)

lo kubehz node status ​

List the nodes you brought to a hosted cluster

lo kubehz node status [flags]

Examples ​

  lo kubehz node status

Options ​

  -c, --cluster-id string   Cluster id (cl-xxxxxxxx); default: the cluster of the active domain
  -h, --help                help for status

SEE ALSO ​

  • lo kubehz node - Nodes you bring to a hosted control plane (join/remove/status)

lo kubehz re-enroll ​

Re-enroll a regenerated in-cluster agent token with the platform

lo kubehz re-enroll [flags]

Examples ​

  lo kubehz re-enroll

Options ​

  -h, --help   help for re-enroll

SEE ALSO ​

lo kubehz register ​

Register cluster with kubehz

lo kubehz register [flags]

Examples ​

  lo kubehz register

Options ​

  -h, --help   help for register

SEE ALSO ​

lo kubehz space ​

Spaces through the kubehz api (agent tools)

lo kubehz space [flags]

Examples ​

  lo kubehz space list
  lo kubehz space create --name "CI run" --slug ci-1234 --lease-hours 3

Options ​

  -h, --help   help for space

SEE ALSO ​

lo kubehz space create ​

Create a space (an agent key sets a lease)

lo kubehz space create --name <name> --slug <slug> [flags]

Examples ​

  lo kubehz space create --name "CI run" --slug ci-1234
  lo kubehz space create --name Demo --slug demo --nodes 2 --lease-hours 24 -o json

Options ​

  -h, --help                    help for create
      --lease-hours string      Hours until the platform deletes the space (1 to 720); an agent key gets 2 without it
      --name string             Display name of the space
      --namespaces string       Namespace limit; default: the platform's
      --nodes string            Node limit; default: the platform's
      --object-cap-kib string   Size cap of one Secret or ConfigMap in KiB; default: the platform's
  -o, --output string           Output format: text, json or yaml (default "text")
      --region string           Region to place the space in; default: the platform's choice
      --slug string             DNS label of the space, unique on the platform (the namespace name)

SEE ALSO ​

lo kubehz space delete ​

Delete a space

lo kubehz space delete <id> [flags]

Examples ​

  lo kubehz space delete sp-1a2b3c4d

Options ​

  -h, --help            help for delete
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

lo kubehz space get ​

Show one space

lo kubehz space get <id> [flags]

Examples ​

  lo kubehz space get sp-1a2b3c4d
  lo kubehz space get sp-1a2b3c4d -o yaml

Options ​

  -h, --help            help for get
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

lo kubehz space kubeconfig ​

Write the agent kubeconfig of a space to a file

lo kubehz space kubeconfig <id> --file <path> [flags]

Examples ​

  lo kubehz space kubeconfig sp-1a2b3c4d --file agent.yaml

Options ​

      --file string     Write the kubeconfig to this file (mode 0600) and print the path; a file that exists needs --force
  -h, --help            help for kubeconfig
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

lo kubehz space lease ​

Set the hours until the platform deletes a space

lo kubehz space lease <id> --hours <n> [flags]

Examples ​

  lo kubehz space lease sp-1a2b3c4d --hours 6

Options ​

  -h, --help            help for lease
      --hours string    Hours from now until the platform deletes it (1 to 720)
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

lo kubehz space list ​

List the spaces the credential reaches

lo kubehz space list [flags]

Examples ​

  lo kubehz space list
  lo kubehz space list -o json

Options ​

  -h, --help            help for list
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

lo kubehz status ​

Check kubehz registration status

lo kubehz status [flags]

Examples ​

  lo kubehz status

Options ​

  -h, --help   help for status

SEE ALSO ​

lo kustomize ​

Manage kustomize plugins (Go)

lo kustomize [flags]

Examples ​

  lo kustomize build
  lo kustomize list

Options ​

  -h, --help   help for kustomize

SEE ALSO ​

lo kustomize build ​

Compile all kustomize plugin binaries into .kustomize/

lo kustomize build [flags]

Examples ​

  lo kustomize build

Options ​

  -h, --help   help for build

SEE ALSO ​

lo kustomize clean ​

Remove built plugin binaries

lo kustomize clean [flags]

Examples ​

  lo kustomize clean

Options ​

  -h, --help   help for clean

SEE ALSO ​

lo kustomize list ​

List discoverable plugins under .kustomize/

lo kustomize list [flags]

Examples ​

  lo kustomize list

Options ​

  -h, --help   help for list

SEE ALSO ​

lo kustomize test ​

Run plugin unit + integration tests

lo kustomize test [flags]

Examples ​

  lo kustomize test

Options ​

  -h, --help   help for test

SEE ALSO ​

lo lint ​

Validate structure and specs

lo lint [flags]

Examples ​

  lo lint
  lo lint --domain kubehz.dev --notes

Options ​

      --format string   Finding format: text (default), editor (file:line: [level] message) or github (workflow commands, the default under GITHUB_ACTIONS off a terminal)
  -h, --help            help for lint
      --notes           Also print a [note] per spec key that equals its documented default (advisory; the exit code is unchanged)

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo mcp ​

Serve the lo commands as MCP tools (stdio or HTTP)

Synopsis ​

Serve the lo commands to AI agents and editors as MCP tools.

Every leaf command becomes one tool named lo_<path with underscores>: lo_status, lo_secrets_encrypt, lo_kubehz_join, lo_registry_up, ... Dispatchers (secrets, tilt, kubehz, ...) are traversed, not exposed. A tool call runs the same lo binary as a subprocess and returns its stdout, stderr and exit code.

Exposure policy — what an agent can call:

default readonly commands only (status, lint, audit, secrets list, tilt status, ...) --allow-mutating + mutating, non-destructive commands (build, use, init, secrets encrypt, ...) --allow-destructive + destructive commands (up, down, deploy, destroy, tilt down, kubehz deregister, ...) and the --force flags; implies --allow-mutating

A command without a marker counts as mutating. A command whose output is a credential (kubeconfig, secrets print, secrets env, kubehz token, kubehz claim-code, kubehz space|cluster kubeconfig) is never exposed: a tool result lands in the model's transcript. Neither is chat: it passes its arguments on unread. A call whose positional argument starts with "-" is refused, and nothing runs. Flags that carry a credential (token, secret, password, key, nonce, ...) are never exposed either. A command that is not exposed is not registered, so it cannot be called. LO_MCP_ALLOW=mutating|destructive is the environment form of the opt-in, for editor configs (flags win).

Transports: 'start' serves stdio (what editors launch); 'serve' serves streamable HTTP on loopback — it has no authentication, keep it there. 'tools' prints the tool list a server would advertise.

Editor setup writes the launch command, the toolchain PATH and PATH_BASE into the editor's MCP config:

lo mcp claude enable # Claude Desktop lo mcp vscode enable # VS Code (Copilot agent mode) lo mcp cursor enable lo mcp claude enable --env LO_MCP_ALLOW=destructive

Examples ​

  lo mcp start
  lo mcp tools --allow-mutating
  lo mcp claude enable

Options ​

  -h, --help   help for mcp

SEE ALSO ​

lo mcp claude ​

Manage Claude Desktop MCP servers

Synopsis ​

Manage MCP server configuration for Claude Desktop

Examples ​

  lo mcp claude enable
  lo mcp claude list

Options ​

  -h, --help   help for claude

SEE ALSO ​

lo mcp claude disable ​

Remove server from Claude config

Synopsis ​

Remove this application from Claude Desktop MCP servers

lo mcp claude disable [flags]

Examples ​

  lo mcp claude disable

Options ​

      --config-path string   Path to Claude config file
  -h, --help                 help for disable
      --server-name string   Name of the MCP server to remove (default: derived from executable name)

SEE ALSO ​

lo mcp claude enable ​

Add server to Claude config

Synopsis ​

Add this application as an MCP server in Claude Desktop

lo mcp claude enable [flags]

Examples ​

  lo mcp claude enable
  lo mcp claude enable --env LO_MCP_ALLOW=destructive

Options ​

      --config-path string   Path to Claude config file
  -e, --env stringToString   Environment variables (e.g., --env KEY1=value1 --env KEY2=value2) (default [])
  -h, --help                 help for enable
      --log-level string     Log level (debug, info, warn, error)
      --server-name string   Name for the MCP server (default: derived from executable name)

SEE ALSO ​

lo mcp claude list ​

Show Claude MCP servers

Synopsis ​

Show all MCP servers configured in Claude Desktop

lo mcp claude list [flags]

Examples ​

  lo mcp claude list

Options ​

      --config-path string   Path to Claude config file
  -h, --help                 help for list

SEE ALSO ​

lo mcp cursor ​

Manage Cursor MCP servers

Synopsis ​

Manage MCP server configuration for Cursor

Examples ​

  lo mcp cursor enable
  lo mcp cursor list

Options ​

  -h, --help   help for cursor

SEE ALSO ​

lo mcp cursor disable ​

Remove server from Cursor config

Synopsis ​

Remove this application from Cursor MCP servers

lo mcp cursor disable [flags]

Examples ​

  lo mcp cursor disable

Options ​

      --config-path string   Path to Cursor config file
  -h, --help                 help for disable
      --server-name string   Name of the MCP server to remove (default: derived from executable name)
      --workspace            Remove from workspace settings (.cursor/mcp.json) instead of user settings

SEE ALSO ​

lo mcp cursor enable ​

Add server to Cursor config

Synopsis ​

Add this application as an MCP server in Cursor

lo mcp cursor enable [flags]

Examples ​

  lo mcp cursor enable
  lo mcp cursor enable --env LO_MCP_ALLOW=destructive

Options ​

      --config-path string   Path to Cursor config file
  -e, --env stringToString   Environment variables (e.g., --env KEY1=value1 --env KEY2=value2) (default [])
  -h, --help                 help for enable
      --log-level string     Log level (debug, info, warn, error)
      --server-name string   Name for the MCP server (default: derived from executable name)
      --workspace            Add to workspace settings (.cursor/mcp.json) instead of user settings

SEE ALSO ​

lo mcp cursor list ​

Show Cursor MCP servers

Synopsis ​

Show all MCP servers configured in Cursor

lo mcp cursor list [flags]

Examples ​

  lo mcp cursor list

Options ​

      --config-path string   Path to Cursor config file
  -h, --help                 help for list
      --workspace            List from workspace settings (.cursor/mcp.json) instead of user settings

SEE ALSO ​

lo mcp serve ​

Serve over streamable HTTP (loopback; no authentication)

lo mcp serve [flags]

Examples ​

  lo mcp serve
  lo mcp serve --port 8090 --allow-mutating

Options ​

      --allow-destructive   Also expose destructive commands (up, down, deploy, destroy, …) and --force/--force-recreate; implies --allow-mutating
      --allow-mutating      Also expose mutating, non-destructive commands (build, use, secrets encrypt, …)
  -h, --help                help for serve
      --host string         Address to listen on (default "127.0.0.1")
      --log-level string    Server log level on stderr (debug, info, warn, error) (default "info")
      --port int            Port to listen on (default 8080)

SEE ALSO ​

  • lo mcp - Serve the lo commands as MCP tools (stdio or HTTP)

lo mcp start ​

Serve over stdio (what editors and agents launch)

lo mcp start [flags]

Examples ​

  lo mcp start
  lo mcp start --allow-destructive

Options ​

      --allow-destructive   Also expose destructive commands (up, down, deploy, destroy, …) and --force/--force-recreate; implies --allow-mutating
      --allow-mutating      Also expose mutating, non-destructive commands (build, use, secrets encrypt, …)
  -h, --help                help for start
      --log-level string    Server log level on stderr (debug, info, warn, error) (default "info")

SEE ALSO ​

  • lo mcp - Serve the lo commands as MCP tools (stdio or HTTP)

lo mcp tools ​

Print the tools a server would expose

lo mcp tools [flags]

Examples ​

  lo mcp tools
  lo mcp tools --allow-destructive

Options ​

      --allow-destructive   Also expose destructive commands (up, down, deploy, destroy, …) and --force/--force-recreate; implies --allow-mutating
      --allow-mutating      Also expose mutating, non-destructive commands (build, use, secrets encrypt, …)
  -h, --help                help for tools
      --json                Print the full tool definitions (schemas, annotations) as JSON

SEE ALSO ​

  • lo mcp - Serve the lo commands as MCP tools (stdio or HTTP)

lo mcp vscode ​

Manage VSCode MCP servers

Synopsis ​

Manage MCP server configuration for Visual Studio Code

Examples ​

  lo mcp vscode enable
  lo mcp vscode list

Options ​

  -h, --help   help for vscode

SEE ALSO ​

lo mcp vscode disable ​

Remove server from VSCode config

Synopsis ​

Remove this application from VSCode MCP servers

lo mcp vscode disable [flags]

Examples ​

  lo mcp vscode disable

Options ​

      --config-path string   Path to VSCode config file
  -h, --help                 help for disable
      --server-name string   Name of the MCP server to remove (default: derived from executable name)
      --workspace            Remove from workspace settings (.vscode/mcp.json) instead of user settings

SEE ALSO ​

lo mcp vscode enable ​

Add server to VSCode config

Synopsis ​

Add this application as an MCP server in VSCode

lo mcp vscode enable [flags]

Examples ​

  lo mcp vscode enable
  lo mcp vscode enable --env LO_MCP_ALLOW=destructive

Options ​

      --config-path string   Path to VSCode config file
  -e, --env stringToString   Environment variables (e.g., --env KEY1=value1 --env KEY2=value2) (default [])
  -h, --help                 help for enable
      --log-level string     Log level (debug, info, warn, error)
      --server-name string   Name for the MCP server (default: derived from executable name)
      --workspace            Add to workspace settings (.vscode/mcp.json) instead of user settings

SEE ALSO ​

lo mcp vscode list ​

Show VSCode MCP servers

Synopsis ​

Show all MCP servers configured in VSCode

lo mcp vscode list [flags]

Examples ​

  lo mcp vscode list

Options ​

      --config-path string   Path to VSCode config file
  -h, --help                 help for list
      --workspace            List from workspace settings (.vscode/mcp.json) instead of user settings

SEE ALSO ​

lo provision ​

Provision a cluster (full lifecycle)

lo provision [flags]

Examples ​

  lo provision
  lo provision --domain kubehz.in.net --force
  lo provision --bootstrap --dry-run --render-dir /tmp/bootstrap

Options ​

      --allow-generators          Run the addon's own executable code in a dry run (exec plugins, KRM functions, bash: generators, remote bases) as trusted, with a real run's side effects (default: refused)
  -b, --bootstrap                 Re-apply spec.bootstrap only on an existing cluster (skip the infra reconcile)
      --dry-run                   Render every entry and apply nothing: diff each one against the cluster (exit 0 unchanged, 1 changes, 2 error)
  -h, --help                      help for provision
      --ignore-nondeterministic   Dry run: judge each entry without the objects its chart regenerates on every apply (they are still listed)
      --no-diff                   Dry run without the kubectl diff: render only, no cluster access
      --only strings              Apply (or dry-run) only these spec.bootstrap entries, comma-separated. A value selects every entry whose name (name:, else the last path element), key as written in spec.bootstrap (./targets/flux) or directory name (of an addon or a target) is equal to it: --only rook-ceph also selects ./targets/rook-ceph named rook-ceph-cluster. dependsOn is not expanded
      --render-dir string         Write the dry run's manifests (NN-<entry>.yaml) and diffs (NN-<entry>.diff) into this directory
      --with-restore              With --only, also apply restore.d first (default: --only skips it and warns when it is non-empty)

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo recover ​

Rebuild a cluster from bare metal (disaster recovery)

lo recover [recover-domain] [flags]

Examples ​

  lo recover kubehz.in.net --dry-run
  lo recover kubehz.in.net
  lo recover kubehz.in.net --skip-rebuild

Options ​

      --dry-run        Preview the rebuild plan (reimages nothing) and stop before provision
  -h, --help           help for recover
      --skip-rebuild   Skip the bare-metal node rebuild — re-run provision + verify only

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo registry ​

Manage Docker registries

lo registry [flags]

Examples ​

  lo registry up
  lo registry status --shared

Options ​

  -h, --help     help for registry
  -S, --shared   Include shared mirrors (for clean/status)

SEE ALSO ​

lo registry clean ​

Clean up registries

lo registry clean [flags]

Examples ​

  lo registry clean
  lo registry clean --shared

Options ​

  -h, --help   help for clean
  -y, --yes    Answer the confirmation on a terminal (off a terminal there is none)

SEE ALSO ​

lo registry down ​

Spin down registries

lo registry down [flags]

Examples ​

  lo registry down

Options ​

  -h, --help   help for down

SEE ALSO ​

lo registry status ​

Check registry status

lo registry status [flags]

Examples ​

  lo registry status
  lo registry status --shared

Options ​

  -h, --help            help for status
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

lo registry tls ​

The registry set's TLS certificate (docker volume)

lo registry tls [flags]

Examples ​

  lo registry tls status
  lo registry tls renew

Options ​

  -h, --help   help for tls

SEE ALSO ​

lo registry tls renew ​

Mint a new certificate into the volume and restart the registries

lo registry tls renew [flags]

Examples ​

  lo registry tls renew

Options ​

  -h, --help   help for renew

SEE ALSO ​

lo registry tls status ​

Show the certificate and what each registry mounts

lo registry tls status [flags]

Examples ​

  lo registry tls status

Options ​

  -h, --help   help for status

SEE ALSO ​

lo registry up ​

Spin up registries

lo registry up [flags]

Examples ​

  lo registry up

Options ​

  -h, --help   help for up

SEE ALSO ​

lo secrets ​

Manage secrets (encrypt/decrypt/set)

lo secrets [flags]

Examples ​

  lo secrets init
  lo secrets set --name db --namespace app dbUser <value>
  lo secrets encrypt

Options ​

  -h, --help   help for secrets

SEE ALSO ​

lo secrets add-key ​

Add an age recipient and re-key the store

lo secrets add-key <key> [flags]

Examples ​

  lo secrets add-key ~/.ssh/id_ed25519.pub
  lo secrets add-key age1<recipient> --all

Options ​

  -a, --all            Re-key every domain store, not just the current one
  -h, --help           help for add-key
      --skip-orphans   Proceed even if some .enc files have no decrypted twin

SEE ALSO ​

lo secrets allow ​

Approve bash: generators (re-compute .sha + .bash-allow)

lo secrets allow [flags]

Examples ​

  lo secrets allow

Options ​

  -h, --help   help for allow

SEE ALSO ​

lo secrets decrypt ​

Decrypt .enc files into plaintext cache

lo secrets decrypt [flags]

Examples ​

  lo secrets decrypt

Options ​

  -h, --help             help for decrypt
  -k, --ssh-key string   Path to SSH private key

SEE ALSO ​

lo secrets encrypt ​

Encrypt plaintext cache files for commit

lo secrets encrypt [flags]

Examples ​

  lo secrets encrypt

Options ​

  -h, --help          help for encrypt
  -n, --name string   Encrypt only this Secret's cache files (metadata.name); default is the whole store

SEE ALSO ​

lo secrets env ​

Emit export KEY=value lines for a cached secret

lo secrets env --name N [--namespace NS] [flags]

Examples ​

  eval "$(lo secrets env --name db --namespace app)"

Options ​

      --cluster string     Cluster name to manage
  -h, --help               help for env
  -n, --name string        Secret name
  -s, --namespace string   Namespace (default "default")

SEE ALSO ​

lo secrets init ​

Initialize SOPS/age encryption from SSH key

lo secrets init [flags]

Examples ​

  lo secrets init

Options ​

  -h, --help             help for init
  -k, --ssh-key string   Path to SSH public key

SEE ALSO ​

lo secrets list ​

List secrets

lo secrets list [flags]

Examples ​

  lo secrets list

Options ​

  -h, --help   help for list

SEE ALSO ​

lo secrets path ​

Resolve the secrets path for the current context

lo secrets path [flags]

Examples ​

  lo secrets path

Options ​

  -h, --help   help for path

SEE ALSO ​

lo secrets print ​

Print secret(s)

lo secrets print [pattern...] [flags]

Examples ​

  lo secrets print
  lo secrets print 'Secret.db.*'

Options ​

  -c, --copy       Copy secret(s) to clipboard (--only-one is implied)
  -h, --help       help for print
  -o, --only-one   Only print one secret (error if multiple matches)

SEE ALSO ​

lo secrets set ​

Write a literal value into the secret cache

lo secrets set [--name N] [--namespace NS] [--encrypt] <key> [value] [flags]

Examples ​

  lo secrets set --name db --namespace app dbUser <value>
  lo secrets set --name db dbUser - < value.txt
  lo secrets set --name db dbUser <value> --encrypt

Options ​

      --cluster string     Cluster name to manage
  -e, --encrypt            SOPS-encrypt this one file after writing (needs .sops.yaml)
  -h, --help               help for set
  -n, --name string        Secret name
  -s, --namespace string   Namespace (default "default")

SEE ALSO ​

lo status ​

Cluster health and status

lo status [flags]

Examples ​

  lo status
  lo status --domain kubehz.in.net

Options ​

  -h, --help            help for status
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo tilt ​

Manage tilt cluster

lo tilt [flags]

Examples ​

  lo tilt up
  lo tilt ci --timeout 300s
  lo tilt down

Options ​

  -h, --help   help for tilt

SEE ALSO ​

lo tilt ci ​

Headless build+deploy+wait-ready (tilt ci), exits with real status

lo tilt ci [flags]

Examples ​

  lo tilt ci
  lo tilt ci --timeout 10m

Options ​

  -h, --help              help for ci
  -t, --timeout tilt ci   Max time to wait for readiness (e.g. 300s, 10m); passed to tilt ci

SEE ALSO ​

lo tilt down ​

Spin down tilt

lo tilt down [flags]

Examples ​

  lo tilt down

Options ​

  -h, --help   help for down

SEE ALSO ​

lo tilt preflight ​

Force-clear stuck-Terminating objects in the manifest on stdin

lo tilt preflight [flags]

Examples ​

  lo build && lo tilt preflight < clusters/kubehz.dev/artifacts.yaml
  lo tilt preflight --crds skip < artifacts.yaml

Options ​

  -a, --age string         Only clear objects terminating longer than this many seconds (default 30)
      --crd-allow string   Comma-separated CRD names the force policy may strip (empty = all)
  -c, --crds string        Stuck-CRD policy: drain (clear instance finalizers), skip, or force
  -h, --help               help for preflight

SEE ALSO ​

lo tilt restart ​

Restart tilt

lo tilt restart [flags]

Examples ​

  lo tilt restart

Options ​

  -h, --help   help for restart

SEE ALSO ​

lo tilt status ​

Check tilt status

lo tilt status [flags]

Examples ​

  lo tilt status

Options ​

  -h, --help   help for status

SEE ALSO ​

lo tilt up ​

Spin up tilt (interactive, backgrounded)

lo tilt up [flags]

Examples ​

  lo tilt up

Options ​

  -h, --help   help for up

SEE ALSO ​

lo toolchain ​

Install and verify the pinned project toolchain via b

lo toolchain [flags]

Examples ​

  lo toolchain install
  lo toolchain doctor

Options ​

  -h, --help   help for toolchain

SEE ALSO ​

lo toolchain doctor ​

Verify the b-managed toolchain against the pins

Synopsis ​

Print the toolchain section of lo doctor on its own: .bin/b, kustomize, the khelm ChartRenderer and the secrets.lok8s.dev Secret plugin, each against its pin. No marker and no flag gate it. Exit 1 when a tool this build execs is missing (lo core); lo-full only warns about the render tools.

It uses the project of the current shell (an exported PATH_BASE wins, else the nearest project above the working directory), like lo doctor. lo toolchain install resolves from the working directory only.

lo toolchain doctor [flags]

Examples ​

  lo toolchain doctor

Options ​

  -h, --help   help for doctor

SEE ALSO ​

  • lo toolchain - Install and verify the pinned project toolchain via b

lo toolchain install ​

Install the pinned toolchain via b

Synopsis ​

Provision a project's toolchain with b (github.com/fentas/b):

  1. .bin/b.yaml from the template pinned to this lo (kustomize v5.8.1, khelm v2.8.0, the secrets.lok8s.dev Secret plugin at this lo's version, plus kubectl; kind/tilt/mkcert for --groups local; kubeone/hcloud for cloud; argsh/yq/jq/envsubst/sops/ssh-to-age for bash, the runtime of the frozen bash implementation and the provider plugins, carried commented out). The bash tree itself is embedded in the binary. An existing b.yaml is never overwritten — a diff is printed instead.
  2. .gitignore entries for .bin/ (b.yaml + b.lock stay committed).
  3. b itself into .bin/b: the pinned release v4.18.7 tarball, downloaded over https to a temp file and verified against its published SHA-256 before anything is extracted (no curl | sh). GITHUB_TOKEN is passed through if set.
  4. .bin/b install — every binary in b.yaml lands in .bin/ (plugins under .kustomize/).

--dry-run prints each step without touching the tree or the network.

lo toolchain install [flags]

Examples ​

  lo toolchain install
  lo toolchain install --groups core,local,cloud
  lo toolchain install --dry-run

Options ​

  -n, --dry-run         Print what would be written, downloaded and run; touch nothing
      --groups string   Groups to activate (core,local,cloud,bash; core is implied) (default "core,local")
  -h, --help            help for install
  -p, --path string     Project directory (default: the nearest project root above the working directory, else the working directory)

SEE ALSO ​

  • lo toolchain - Install and verify the pinned project toolchain via b

lo trust ​

Trust the local dev CA (mkcert -install)

lo trust [flags]

Examples ​

  lo trust

Options ​

  -h, --help   help for trust

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo up ​

Start cluster

lo up [flags]

Examples ​

  lo up
  lo up --open-tilt
  lo up --ci --timeout 300s

Options ​

      --ci tilt ci        Headless: build+deploy+wait-ready via tilt ci, exit with real status (no TTY/browser)
  -h, --help              help for up
  -o, --open-tilt         Open Tilt in a browser (interactive mode only)
  -t, --timeout tilt ci   Readiness timeout for --ci (e.g. 300s, 10m); passed to tilt ci

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo use ​

Set/show active domain

lo use [domain] [flags]

Examples ​

  lo use
  lo use kubehz.dev

Options ​

  -h, --help            help for use
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

  • lo - lok8s - local dev orchestration

lo version ​

Print lok8s + toolchain versions

lo version [flags]

Examples ​

  lo version
  lo --version

Options ​

  -h, --help            help for version
  -o, --output string   Output format: text, json or yaml (default "text")

SEE ALSO ​

  • lo - lok8s - local dev orchestration

Released under the MIT License.

Copyright © 2025-present kernpilot