rune admin

rune admin * covers everything that's not day-to-day workload management. Most of it is gated to localhost on the server side unless auth.allow_remote_admin is enabled.

Subcommand groups

rune admin bootstrap
rune admin user      [create | list]
rune admin service   [create]
rune admin policy    [create | get | list | attach | detach | delete]
rune admin token     [create | list | revoke]
rune admin registry [add | list | remove]

rune admin bootstrap

Mints the root token. Only works on a fresh server.

rune admin bootstrap --out-file ~/.rune/token

rune admin user

# Create or update
rune admin user create alice --email [email protected]
 
# List
rune admin user list

User fields: name, email, policies (attached). Use policy attach / policy detach to manage policies.

rune admin service

Mint service accounts — non-human identities for CI pipelines, deploy bots, and other automation. They authenticate exactly like users (bearer token), but their tokens carry subject-type=service so they're easy to audit and revoke separately from human users.

# Scoped CI token for one namespace (recommended).
rune admin service create ci-stg \
  --namespace stg \
  --permissions cast \
  --ttl 90d \
  --description "GitHub Actions deploys to stg" \
  --out-file ci-stg.token
 
# Cluster-wide read-only token (no --namespace).
rune admin service create dashboard \
  --permissions read \
  --ttl 720h \
  --out-file dashboard.token

Permission shorthands:

When --namespace is given, the granted policy is derived — a copy of the built-in is written as <service>-<perm> (e.g. ci-stg-cast) with every rule pinned to that namespace, so the service account cannot reach into other namespaces. Rules touching the cluster-scoped namespaces resource stay unpinned so rune cast --create-namespace still works.

The plaintext token is printed (or written to --out-file) once. Treat it like a password.

rune admin policy

# Create from a file
rune admin policy create -f policy.yaml
 
# Inspect
rune admin policy get readwrite
rune admin policy list
 
# Attach / detach
rune admin policy attach readwrite --to-user alice
rune admin policy detach readwrite --from-user alice
 
# Delete
rune admin policy delete obsolete-policy

Policy YAML:

name: editor-prod
description: Edit services in 'prod' only
rules:
  - resource: service
    verbs: [get, list, watch, create, update, delete, scale, exec]
    namespace: prod

Built-in policies (root, admin, readwrite, readonly, cast) are seeded automatically and cannot be modified or deleted.

rune admin token

# Create
rune admin token create alice-laptop \
  --subject-name alice \
  --policies readwrite \
  --ttl 720h \
  --out-file ./alice.token
 
# List
rune admin token list
 
# Revoke
rune admin token revoke <token-id>

The plaintext secret is printed once. Store it like a password.

rune admin registry

Manage Docker registry credentials so runed can pull private images:

rune admin registry add \
  --name ghcr-private \
  --server ghcr.io \
  --username my-bot \
  --password-file ./ghcr.token
 
rune admin registry list
 
rune admin registry remove ghcr-private

ECR is supported via AWS credentials inferred from the host environment (or the runefile).

See also

• Identity & RBAC
• Bootstrap & first user
• Security hardening