Commands / kosa8 approve request
kosa8 approve request
Ask for signed approvals of an action the org policy covers
Usage
kosa8 request KIND [ARG...]
Opens a request, signed with your identity, for an action the org policy
says needs signed approvals. Describe the action exactly as with
kosa8 approve check. Hand the request file it prints to approvers; each
runs kosa8 approve sign on it.
When the daemon refuses a call for want of an approval, it prints this
command with the action filled in exactly. Once the request is recorded
(kosa8 approve status ID --record), repeat the call with --approval ID;
the approval covers that one call, once.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--egress | string | network egress the action would set, e.g. deny or allow:api.example.com | — |
--identity | string | your identity directory (default ~/.kosa8/identity) | — |
--mount | stringArray | host directory the action would expose into the sandbox | [] |
--policy-edit | bool | the action rewrites governance or approval policy | — |
--privilege | stringArray | a power beyond an ordinary container's, e.g. privileged or cap-add=SYS_ADMIN | [] |
--publish | stringArray | a container port the action would publish on the host, e.g. 8080:80/tcp | [] |
--reason | string | why you need this, shown to approvers | — |
--sandbox | string | the existing sandbox the action runs inside | — |
--target | string | what it operates on (default: the first argument) | — |
--ttl | duration | how long approvals may be collected before the request expires | 1h0m0s |
Example
kosa8 approve request --reason "ticket OPS-112" --egress allow:api.example.com run dev