ITL Control Plane CLI (itlc)

Alpha — This project is under active development. APIs, data models, and behaviour may change without notice.

Unified management CLI for the ITL Control Plane platform.

Installation

# Core only (auth, clusters, tenants, subscriptions, resource groups, …)
pip install itlc

# With ARM template support
pip install "itlc[arm]"

# With Policy Builder support
pip install "itlc[policy]"

# With database seeding support
pip install "itlc[seed]"

# Everything
pip install "itlc[all]"

Quick Start

# Login interactively (browser)
itlc login

# Who am I?
itlc whoami

# Inspect a JWT
itlc inspect

# List tenants
itlc tenant list

# List subscriptions
itlc subscription list

# List resource groups
itlc resourcegroup list

# ARM deploy
itlc arm deploy create -n my-deployment -f template.json

# Convert ARM → Pulumi DSL
itlc arm convert template.json -o __main__.py

# Policy generation
itlc policy generate --template talos-security

# Seed database
itlc seed all

Command Reference

Group	Commands	Requires
login	interactive browser login	core
get-token	service account token	core
whoami	show current auth	core
inspect	decode/inspect JWT	core
introspect	Keycloak token introspection	core
realm	list / switch Keycloak realms	core
cluster	add / list / remove / validate clusters	core
configure	configure OIDC + kubeconfig	core
tenant	create / list / get / update / delete	core
subscription	create / list / get / update / delete	core
resourcegroup	create / list / get / update / delete	core
location	list locations	core
managementgroup	create / list / get / update / delete	core
arm deploy	create / delete ARM deployments	itlc[arm]
arm convert	convert ARM template to Pulumi DSL	itlc[arm]
policy	generate / deploy / validate / compliance	itlc[policy]
seed	all / tenants / locations / subscriptions / …	itlc[seed]

Environment Variables

Variable	Description
KEYCLOAK_URL	Keycloak server URL
KEYCLOAK_REALM	Keycloak realm
KEYCLOAK_CLIENT_ID	Service account client ID
KEYCLOAK_CLIENT_SECRET	Service account client secret
CONTROLPLANE_API_URL	ITL Control Plane API Gateway URL
CONTROLPLANE_TOKEN	Auth token (overrides cached token)
DATABASE_URL	PostgreSQL connection string (seed)

Architecture

This repo is the single home for the itlc entry point. Plugin command groups are thin wrappers that forward to the upstream packages:

itlc                              (this repo)
├── auth / cluster / resources    ← itlc-auth  (ITLAuth)
├── arm                           ← itl-controlplane-sdk  [optional]
├── policy                        ← itl-policy-builder    [optional]
└── seed                          ← itl-controlplane-sdk  [optional]

If a plugin package is not installed, itlc degrades gracefully and shows an install hint when that command group is invoked.

Docker

FROM ghcr.io/itlusions/itlc:latest

Or build locally:

docker build -t itlc .
docker run --rm itlc whoami

Development

# Install with all extras in editable mode
pip install -e ".[all,dev]"

# Run tests
pytest

# Lint / format
ruff check src/
black src/

Related Repos

Repo	Description
ITLAuth	Keycloak/OIDC core + itlc-auth pkg
ITL.ControlPanel.SDK	SDK, ARM tooling, seed CLI
ITL.ControlPanel.PolicyBuilder	Policy builder
ITL.ControlPlane.Api	API Gateway