Agent commands

All take --project, or the project from the active profile.

Command	Does
`instances ssh <instance-id>`	Signs a short-lived certificate and opens SSH; through the agent with `--tunnel` or when there is no floating IP.
`instances run-command`	Runs a command on up to 100 instances and collects output and exit codes.
`instances port-forward <instance-id>`	Forwards a local TCP port to a port on the instance.
`instances sessions list <instance-id>`	Lists sessions opened into an instance.
`instances sessions describe <instance-id> <session-id>`	Shows one session.
`instances refresh-agent`	Re-installs the served agent build over the live channel.
`instances console-serial <instance-id>`	A single-use serial console URL, for when the agent is down.
`ssh-ca sign`	Signs your own public key into a short-lived certificate.
`ssh-ca trust-bundle`	Prints, or adds to `known_hosts`, the project’s host CA.
`ssh-ca describe`	The project’s CA keys and certificate limits.
`ssh-ca rotate-key`	Rotates the project’s CA keys.

Examples

# A shell, through the agent
stratumctl instances ssh i-abc123 --tunnel --project p-web

# A shell with a port forward, passing options straight to ssh
stratumctl instances ssh i-abc123 --project p-web -- -L 8080:localhost:80

# Print the ssh command instead of running it
stratumctl instances ssh i-abc123 --print --project p-web

# The same command on three instances, with a 2-minute timeout
stratumctl instances run-command --instances i-a,i-b,i-c \
  --command "sudo dnf -y upgrade --security" --timeout 2m --project p-web

# A local port to the instance's web server; 0 picks a free local port
stratumctl instances port-forward i-abc123 --local 0 --remote 80 --project p-web

# Sessions opened into an instance, as JSON
stratumctl instances sessions list i-abc123 -o json --project p-web

# Refresh the agent on two instances
stratumctl instances refresh-agent --instances i-abc123,i-def456 --project p-web

# A 15-minute certificate for your own key
stratumctl ssh-ca sign --public-key-file ~/.ssh/id_ed25519.pub --instance i-abc123 \
  --valid-for 15m --out ~/.ssh/id_ed25519-cert.pub --project p-web

# Trust the project's host CA in known_hosts
stratumctl ssh-ca trust-bundle --known-hosts --project p-web

# Rotate after a key compromise: the old key stops being trusted at once
stratumctl ssh-ca rotate-key --immediate --project p-web

IAM actions

Action	Allows
`compute:StartInstanceSession`	Opening a shell or a tunnel.
`compute:RunCommand`	Run command. Held by `project-editor` and above.
`compute:PortForward`	Port forwarding.
`compute:DescribeInstance`	Listing and describing sessions.