step-cli v0.29.0 reference update

step-ci · step-ci · commit 349115eae6a6 · 2025-12-03T04:11:45.000Z
diff --git a/manifest.json b/manifest.json
diff --git a/step-cli/reference/README.mdx b/step-cli/reference/README.mdx
@@ -65,7 +65,7 @@ print the version
 
 ## Version
 
-Smallstep CLI/0.28.7 (linux/amd64)
+Smallstep CLI/0.29.0 (linux/amd64)
 
 ## Copyright
 
diff --git a/step-cli/reference/ca/policy/acme/x509/README.mdx b/step-cli/reference/ca/policy/acme/x509/README.mdx
@@ -17,12 +17,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 <subcommand> [arguments] [global-flags] [subcommand-flags]
+step ca policy <scope> x509 <subcommand> [arguments] [global-flags] [subcommand-flags]
 ```
 
 ## Description
 
-**step ca policy x509** command group provides facilities for managing X.509 certificate issuance policies.
+**step ca policy `scope` x509** command group provides facilities for managing X.509 certificate issuance policies.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/acme/x509/allow/README.mdx b/step-cli/reference/ca/policy/acme/x509/allow/README.mdx
@@ -19,12 +19,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 allow <subcommand> [arguments] [global-flags] [subcommand-flags]
+step ca policy <scope> x509 allow <subcommand> [arguments] [global-flags] [subcommand-flags]
 ```
 
 ## Description
 
-**step ca policy x509 allow** command group provides facilities for managing X.509 names to be allowed.
+**step ca policy `scope` x509 allow** command group provides facilities for managing X.509 names to be allowed.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/acme/x509/deny/README.mdx b/step-cli/reference/ca/policy/acme/x509/deny/README.mdx
@@ -19,12 +19,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 deny <subcommand> [arguments] [global-flags] [subcommand-flags]
+step ca policy <scope> x509 deny <subcommand> [arguments] [global-flags] [subcommand-flags]
 ```
 
 ## Description
 
-**step ca policy x509 deny** command group provides facilities for managing X.509 names to be denied.
+**step ca policy `scope` x509 deny** command group provides facilities for managing X.509 names to be denied.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/acme/x509/wildcards/README.mdx b/step-cli/reference/ca/policy/acme/x509/wildcards/README.mdx
@@ -16,12 +16,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 wildcards
+step ca policy <scope> x509 wildcards
 ```
 
 ## Description
 
-**step ca policy x509 wildcards** command group provides facilities for managing X.509 wildcard names.
+**step ca policy `scope` x509 wildcards** command group provides facilities for managing X.509 wildcard names.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/acme/x509/wildcards/allow/README.mdx b/step-cli/reference/ca/policy/acme/x509/wildcards/allow/README.mdx
@@ -13,7 +13,7 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 wildcards allow
+step ca policy <scope> x509 wildcards allow
 [--provisioner=<name>] [--eab-key-id=<eab-key-id>] [--eab-key-reference=<eab-key-reference>]
 [--admin-cert=<file>] [--admin-key=<file>] [--admin-subject=<subject>]
 [--admin-provisioner=<name>] [--admin-password-file=<file>]
@@ -22,7 +22,7 @@ step ca policy x509 wildcards allow
 
 ## Description
 
-**step ca policy x509 wildcards allow** allow wildcard names in X.509 policy
+**step ca policy `scope` x509 wildcards allow** allow wildcard names in X.509 policy
 
 ## Options
 
diff --git a/step-cli/reference/ca/policy/acme/x509/wildcards/deny/README.mdx b/step-cli/reference/ca/policy/acme/x509/wildcards/deny/README.mdx
@@ -13,7 +13,7 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 wildcards deny
+step ca policy <scope> x509 wildcards deny
 [--provisioner=<name>] [--eab-key-id=<eab-key-id>] [--eab-key-reference=<eab-key-reference>]
 [--admin-cert=<file>] [--admin-key=<file>] [--admin-subject=<subject>]
 [--admin-provisioner=<name>] [--admin-password-file=<file>]
@@ -22,7 +22,7 @@ step ca policy x509 wildcards deny
 
 ## Description
 
-**step ca policy x509 wildcards deny** deny wildcard names in X.509 policy
+**step ca policy `scope` x509 wildcards deny** deny wildcard names in X.509 policy
 
 ## Options
 
diff --git a/step-cli/reference/ca/policy/authority/x509/README.mdx b/step-cli/reference/ca/policy/authority/x509/README.mdx
@@ -17,12 +17,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 <subcommand> [arguments] [global-flags] [subcommand-flags]
+step ca policy <scope> x509 <subcommand> [arguments] [global-flags] [subcommand-flags]
 ```
 
 ## Description
 
-**step ca policy x509** command group provides facilities for managing X.509 certificate issuance policies.
+**step ca policy `scope` x509** command group provides facilities for managing X.509 certificate issuance policies.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/authority/x509/allow/README.mdx b/step-cli/reference/ca/policy/authority/x509/allow/README.mdx
@@ -19,12 +19,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 allow <subcommand> [arguments] [global-flags] [subcommand-flags]
+step ca policy <scope> x509 allow <subcommand> [arguments] [global-flags] [subcommand-flags]
 ```
 
 ## Description
 
-**step ca policy x509 allow** command group provides facilities for managing X.509 names to be allowed.
+**step ca policy `scope` x509 allow** command group provides facilities for managing X.509 names to be allowed.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/authority/x509/deny/README.mdx b/step-cli/reference/ca/policy/authority/x509/deny/README.mdx
@@ -19,12 +19,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 deny <subcommand> [arguments] [global-flags] [subcommand-flags]
+step ca policy <scope> x509 deny <subcommand> [arguments] [global-flags] [subcommand-flags]
 ```
 
 ## Description
 
-**step ca policy x509 deny** command group provides facilities for managing X.509 names to be denied.
+**step ca policy `scope` x509 deny** command group provides facilities for managing X.509 names to be denied.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/authority/x509/wildcards/README.mdx b/step-cli/reference/ca/policy/authority/x509/wildcards/README.mdx
@@ -16,12 +16,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 wildcards
+step ca policy <scope> x509 wildcards
 ```
 
 ## Description
 
-**step ca policy x509 wildcards** command group provides facilities for managing X.509 wildcard names.
+**step ca policy `scope` x509 wildcards** command group provides facilities for managing X.509 wildcard names.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/authority/x509/wildcards/allow/README.mdx b/step-cli/reference/ca/policy/authority/x509/wildcards/allow/README.mdx
@@ -13,7 +13,7 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 wildcards allow
+step ca policy <scope> x509 wildcards allow
 [--provisioner=<name>] [--eab-key-id=<eab-key-id>] [--eab-key-reference=<eab-key-reference>]
 [--admin-cert=<file>] [--admin-key=<file>] [--admin-subject=<subject>]
 [--admin-provisioner=<name>] [--admin-password-file=<file>]
@@ -22,7 +22,7 @@ step ca policy x509 wildcards allow
 
 ## Description
 
-**step ca policy x509 wildcards allow** allow wildcard names in X.509 policy
+**step ca policy `scope` x509 wildcards allow** allow wildcard names in X.509 policy
 
 ## Options
 
diff --git a/step-cli/reference/ca/policy/authority/x509/wildcards/deny/README.mdx b/step-cli/reference/ca/policy/authority/x509/wildcards/deny/README.mdx
@@ -13,7 +13,7 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 wildcards deny
+step ca policy <scope> x509 wildcards deny
 [--provisioner=<name>] [--eab-key-id=<eab-key-id>] [--eab-key-reference=<eab-key-reference>]
 [--admin-cert=<file>] [--admin-key=<file>] [--admin-subject=<subject>]
 [--admin-provisioner=<name>] [--admin-password-file=<file>]
@@ -22,7 +22,7 @@ step ca policy x509 wildcards deny
 
 ## Description
 
-**step ca policy x509 wildcards deny** deny wildcard names in X.509 policy
+**step ca policy `scope` x509 wildcards deny** deny wildcard names in X.509 policy
 
 ## Options
 
diff --git a/step-cli/reference/ca/policy/provisioner/x509/README.mdx b/step-cli/reference/ca/policy/provisioner/x509/README.mdx
@@ -17,12 +17,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 <subcommand> [arguments] [global-flags] [subcommand-flags]
+step ca policy <scope> x509 <subcommand> [arguments] [global-flags] [subcommand-flags]
 ```
 
 ## Description
 
-**step ca policy x509** command group provides facilities for managing X.509 certificate issuance policies.
+**step ca policy `scope` x509** command group provides facilities for managing X.509 certificate issuance policies.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/provisioner/x509/allow/README.mdx b/step-cli/reference/ca/policy/provisioner/x509/allow/README.mdx
@@ -19,12 +19,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 allow <subcommand> [arguments] [global-flags] [subcommand-flags]
+step ca policy <scope> x509 allow <subcommand> [arguments] [global-flags] [subcommand-flags]
 ```
 
 ## Description
 
-**step ca policy x509 allow** command group provides facilities for managing X.509 names to be allowed.
+**step ca policy `scope` x509 allow** command group provides facilities for managing X.509 names to be allowed.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/provisioner/x509/deny/README.mdx b/step-cli/reference/ca/policy/provisioner/x509/deny/README.mdx
@@ -19,12 +19,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 deny <subcommand> [arguments] [global-flags] [subcommand-flags]
+step ca policy <scope> x509 deny <subcommand> [arguments] [global-flags] [subcommand-flags]
 ```
 
 ## Description
 
-**step ca policy x509 deny** command group provides facilities for managing X.509 names to be denied.
+**step ca policy `scope` x509 deny** command group provides facilities for managing X.509 names to be denied.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/provisioner/x509/wildcards/README.mdx b/step-cli/reference/ca/policy/provisioner/x509/wildcards/README.mdx
@@ -16,12 +16,12 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 wildcards
+step ca policy <scope> x509 wildcards
 ```
 
 ## Description
 
-**step ca policy x509 wildcards** command group provides facilities for managing X.509 wildcard names.
+**step ca policy `scope` x509 wildcards** command group provides facilities for managing X.509 wildcard names.
 
 ## Commands
 
diff --git a/step-cli/reference/ca/policy/provisioner/x509/wildcards/allow/README.mdx b/step-cli/reference/ca/policy/provisioner/x509/wildcards/allow/README.mdx
@@ -13,7 +13,7 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 wildcards allow
+step ca policy <scope> x509 wildcards allow
 [--provisioner=<name>] [--eab-key-id=<eab-key-id>] [--eab-key-reference=<eab-key-reference>]
 [--admin-cert=<file>] [--admin-key=<file>] [--admin-subject=<subject>]
 [--admin-provisioner=<name>] [--admin-password-file=<file>]
@@ -22,7 +22,7 @@ step ca policy x509 wildcards allow
 
 ## Description
 
-**step ca policy x509 wildcards allow** allow wildcard names in X.509 policy
+**step ca policy `scope` x509 wildcards allow** allow wildcard names in X.509 policy
 
 ## Options
 
diff --git a/step-cli/reference/ca/policy/provisioner/x509/wildcards/deny/README.mdx b/step-cli/reference/ca/policy/provisioner/x509/wildcards/deny/README.mdx
@@ -13,7 +13,7 @@ menu:
 ## Usage
 
 ```raw
-step ca policy x509 wildcards deny
+step ca policy <scope> x509 wildcards deny
 [--provisioner=<name>] [--eab-key-id=<eab-key-id>] [--eab-key-reference=<eab-key-reference>]
 [--admin-cert=<file>] [--admin-key=<file>] [--admin-subject=<subject>]
 [--admin-provisioner=<name>] [--admin-password-file=<file>]
@@ -22,7 +22,7 @@ step ca policy x509 wildcards deny
 
 ## Description
 
-**step ca policy x509 wildcards deny** deny wildcard names in X.509 policy
+**step ca policy `scope` x509 wildcards deny** deny wildcard names in X.509 policy
 
 ## Options
 
diff --git a/step-cli/reference/ca/provisioner/add/README.mdx b/step-cli/reference/ca/provisioner/add/README.mdx
@@ -77,7 +77,8 @@ step ca provisioner add <name> --type=K8SSA [--public-key=<file>]
 IID (AWS/GCP/Azure)
 
 step ca provisioner add <name> --type=[AWS|Azure|GCP]
-[--aws-account=<id>] [--gcp-service-account=<name>] [--gcp-project=<name>]
+[--aws-account=<id>]
+[--gcp-service-account=<name>] [--gcp-project=<name>] [--gcp-organization=<id>]
 [--azure-tenant=<id>] [--azure-resource-group=<name>]
 [--azure-audience=<name>] [--azure-subscription-id=<id>]
 [--azure-object-id=<id>] [--instance-age=<duration>] [--iid-roots=<file>]
@@ -325,6 +326,9 @@ Use the flag multiple times to configure multiple service accounts.
 The Google project `id` used to validate the identity tokens.
 Use the flag multiple times to configure multiple projects
 
+**--gcp-organization**=`id`
+The Google organization `id` used to validate the project in the identity tokens.
+
 **--instance-age**=`duration`
 The maximum `duration` to grant a certificate in AWS and GCP provisioners.
 A `duration` is sequence of decimal numbers, each with optional fraction and a
@@ -532,12 +536,17 @@ $ step ca provisioner add Azure --type Azure \
   --azure-object-id f50926c7-abbf-4c28-87dc-9adc7eaf3ba7
 ```
 
-Create an GCP provisioner that will only accept the SANs provided in the identity token:
+Create a GCP provisioner that will only accept the SANs provided in the identity token:
 ```shell
 $ step ca provisioner add Google --type GCP \
   --disable-custom-sans --gcp-project internal
 ```
 
+Create a GCP provisioner that can be used across all projects within an organization:
+```shell
+$ step ca provisioner add Google --type GCP --gcp-organization 123456789
+```
+
 Create an AWS provisioner that will only accept the SANs provided in the identity
 document and will allow multiple certificates from the same instance:
 ```shell
diff --git a/step-cli/reference/ca/provisioner/update/README.mdx b/step-cli/reference/ca/provisioner/update/README.mdx
@@ -70,6 +70,7 @@ step ca provisioner update <name>
 [--aws-account=<id>]... [--remove-aws-account=<id>]...
 [--gcp-service-account=<name>]... [--remove-gcp-service-account=<name>]...
 [--gcp-project=<name>]... [--remove-gcp-project=<name>]...
+[--gcp-organization=<id>]
 [--azure-tenant=<id>] [--azure-resource-group=<name>]
 [--azure-audience=<name>] [--azure-subscription-id=<id>]
 [--azure-object-id=<id>] [--instance-age=<duration>]
@@ -334,6 +335,9 @@ Use the flag multiple times to configure multiple projects
 Remove a Google project `id` used to validate the identity tokens.
 Use the flag multiple times to remove multiple projects
 
+**--gcp-organization**=`id`
+The Google organization `id` used to validate the project in the identity tokens.
+
 **--instance-age**=`duration`
 The maximum `duration` to grant a certificate in AWS and GCP provisioners.
 A `duration` is sequence of decimal numbers, each with optional fraction and a
@@ -537,6 +541,18 @@ $ step ca provisioner update Google \
   --disable-custom-sans --gcp-project internal --remove-gcp-project public
 ```
 
+Remove the GCP project and use an organization id:
+```shell
+$ step ca provisioner update Google \
+  --gpc-organization 123456789 --remove-gcp-project internal
+```
+
+Remove the GCP organization and use a project:
+```shell
+$ step ca provisioner update Google \
+  --gpc-organization="" --gcp-project internal
+```
+
 Update an AWS provisioner:
 ```shell
 $ step ca provisioner update Amazon --disable-custom-sans --disable-trust-on-first-use
diff --git a/step-cli/reference/crypto/key/fingerprint/README.mdx b/step-cli/reference/crypto/key/fingerprint/README.mdx
