ip-profile
ip-profile create
Create an IP access profile.
writes--dry-run
Creates a profile from a list of networks. Each rule is a CIDR, optionally with a note saying what it is.
Creating changes nothing that is running. ip-profile assign is what applies it,
and that takes effect at once.
Usage
outplane ip-profile create <NAME> [flags]Arguments
| Argument | Type | Description |
|---|---|---|
NAME | string | What to call the profile. Required. |
Flags
| Flag | Type | Description |
|---|---|---|
--rule | strings | CIDR[=description], repeatable. Each one is an allow rule. Repeatable. |
--description | string | What the profile is for. |
The global flags apply as well.
Output
| Field | Type | Description |
|---|---|---|
id | string | |
name | string | |
description | string | null | |
rules | int | How many networks it allows. |
assignments | int | How many applications use it. |
ruleList | array | The networks themselves, {cidr, description}. Sorted, and JSON only. |
assignedApps | array | The applications using it, {id, app, appId}. id is the assignment's own id, which is what detaching needs. |
createdAt | string | null | RFC 3339, UTC. |
changed | bool | False for a dry run. |
Examples
Allow one office network
outplane ip-profile create office --rule 203.0.113.0/24=head officeSeveral networks at once
outplane ip-profile create office --rule 203.0.113.0/24 --rule 198.51.100.7/32=vpnCheck the rules would be accepted, without creating anything
outplane ip-profile create office --rule 203.0.113.0/24 --dry-run --json{
"changed": false,
"name": "office",
"rules": 1
}What to Know
- A profile with no rules is accepted and allows nothing. Assigned to an application, it makes that application reachable from nowhere. --rule "" on its own is how to ask for that, the same way an empty value clears a build filter.
- A bare address is refused with ipprofile.cidr_invalid rather than being read as a /32, because guessing a prefix length is guessing how much of a network to let in.
- Creating changes nothing that is running.
ip-profile assignis what applies it, and it applies immediately rather than at the next deployment. - The same name twice is refused by the server, so this is not idempotent.
Errors
Beyond 0 for success, this command exits with:
| Exit | Kind | Meaning |
|---|---|---|
2 | usage | Invalid arguments, unknown flag, or client-side validation failure. |
3 | auth | Not authenticated, token revoked or expired, or forbidden for this team. |
6 | conflict | The resource already exists, or a concurrent change won. |
8 | upstream | The Out Plane API returned a server error. |
The code on the error object is one of ipprofile.name_required, ipprofile.name_invalid, ipprofile.description_invalid, ipprofile.cidr_required, ipprofile.cidr_invalid, ipprofile.rule_duplicate, usage.missing_argument, context.no_team. Branch on that, or on the exit status. The message is prose and changes.