Hubctl command reference

Global

• hubctl --help
• hubctl validate --config <file>

Core lifecycle

• hubctl deploy --config <file> --state-dir <dir> --dry-run — print the desired plan without changing host state.
• hubctl deploy --config <file> --state-dir <dir> — reconcile current desired state.
• hubctl status --state-dir <dir> — print revision, state, pending action, and checks.
• hubctl rollback --state-dir <dir> — restore the prior revision now.
• hubctl confirm --state-dir <dir> — accept a revision protected by a confirmation window.

Device workflow

• hubctl device add <name> --egress <tunnel-id> --address 192.0.2.10/32 --output /tmp/laptop.conf
• hubctl device set-egress <name> <tunnel-id>
• hubctl device revoke <name>
• hubctl device unrevoke <name>

Tunnel workflow

• hubctl tunnel list
• Edit the tunnel YAML, then run hubctl validate before deployment.
• hubctl tunnel disable <id> / hubctl tunnel enable <id>
• hubctl tunnel routes <id> --add 198.51.100.0/24
• hubctl tunnel routes <id> --remove 198.51.100.0/24
• hubctl tunnel zones <id> --add corp.example / hubctl tunnel zones <id> --remove corp.example

Health and maintenance

• hubctl routes — read routing intent and policy paths.
• hubctl test tunnel <id> — run configured preflight probes in the tunnel namespace.
• hubctl subscription refresh <id>
• hubctl subscription restore <id>

Bot-oriented safety command

• hubctl deploy --confirm-within 5m — requires explicit operator confirmation window.

When uncertain, pair any high-impact change with --dry-run and read drift output first.