cf-cli-reference

# CF CLI Reference Complete reference for the Cloud Foundry CLI (`cf`) — session management, full command taxonomy, MultiApps plugin commands, JSON output patterns, and scope boundaries. Use this skill as a toolset when other skills need to issue CF CLI commands. ## CLI Version and Architecture ```bash cf --version # Example: cf version 8.x.x+xxxxxxx.yyyy-mm-dd cf plugins # List installed plugins — MultiApps plugin required for cf deploy ``` The CF CLI operates against the **CF API** — it manages apps, services, routes, spaces, and orgs within a Cloud Foundry organization. It does NOT manage the BTP account layer (subaccounts, entitlements, trust, global security) — those require the `btp` CLI or BTP REST APIs. Two distinct plugin ecosystems: - **Built-in CF CLI** — core app and service management - **MultiApps CLI plugin** — MTA deployment (`cf deploy`, `cf mta`, etc.) — REQUIRED for SAP BTP MTA deployments --- ## Session Management ### Login ```bash # Standard login — prompts for email/password cf login -a <API_ENDPOINT> -u <email> -p <password> -o <org> -s <space> # SSO login (opens browser for SAP ID Service) cf login -a <API_ENDPOINT> --sso # SSO with one-time passcode (copy from browser) cf login -a <API_ENDPOINT> --sso-passcode <PASSCODE> # Login with custom IdP origin cf login -a <API_ENDPOINT> -u <email> --origin <idp-origin> # Skip SSL validation (non-production environments only) cf login -a <API_ENDPOINT> --skip-ssl-validation ``` **SAP BTP CF API endpoints by region:** | Region | API Endpoint | |--------|-------------| | EU10 (Frankfurt) | `https://api.cf.eu10.hana.ondemand.com` | | EU11 (Frankfurt) | `https://api.cf.eu11.hana.ondemand.com` | | EU20 (Netherlands) | `https://api.cf.eu20.hana.ondemand.com` | | US10 (Virginia) | `https://api.cf.us10.hana.ondemand.com` | | US20 (WA) | `https://api.cf.us20.hana.ondemand.com` | | US21 (Virginia) | `https://api.cf.us21.hana.ondemand.com` | | AP10 (Sydney) | `https://api.cf.ap10.hana.ondemand.com` | | AP11 (Singapore) | `https://api.cf.ap11.hana.ondemand.com` | | AP12 (Seoul) | `https://api.cf.ap12.hana.ondemand.com` | | AP20 (Sydney) | `https://api.cf.ap20.hana.ondemand.com` | | AP21 (Singapore) | `https://api.cf.ap21.hana.ondemand.com` | | JP10 (Tokyo) | `https://api.cf.jp10.hana.ondemand.com` | | BR10 (São Paulo) | `https://api.cf.br10.hana.ondemand.com` | | CA10 (Canada) | `https://api.cf.ca10.hana.ondemand.com` | | CH20 (Switzerland) | `https://api.cf.ch20.hana.ondemand.com` | | IN30 (India) | `https://api.cf.in30.hana.ondemand.com` | ### Non-Interactive Auth (for scripts) ```bash # Auth with client credentials (service account) cf auth <CLIENT_ID> <CLIENT_SECRET> --client-credentials # Target org and space after auth cf target -o <ORG> -s <SPACE> ``` ### Targeting ```bash # Show current target cf target # Set org and space cf target -o <ORG> -s <SPACE> # Set API endpoint (without login) cf api https://api.cf.eu11.hana.ondemand.com # Show current API endpoint cf api # Logout cf logout ``` ### Session Health Check ```bash # Verify session is active and targeted correctly cf target # Shows: api endpoint, user, org, space — fails if session expired # Get OAuth token (useful for API calls) cf oauth-token ``` ### Environment Variables | Variable | Purpose | |----------|---------| | `CF_HOME` | Override config directory (default: `~/.cf/`) | | `CF_TRACE=true` | Enable diagnostic HTTP tracing | | `CF_COLOR=false` | Disable output colors | | `CF_DIAL_TIMEOUT` | Timeout for TCP connections | | `CF_STAGING_TIMEOUT` | Max time for staging (default: 15 min) | | `CF_STARTUP_TIMEOUT` | Max time for app start (default: 5 min) | | `CF_PLUGIN_HOME` | Override plugin directory | ### Gotchas - **Session expires** — `cf target` fails with "Not logged in." Run `cf login` again. - **`cf login` vs `cf auth`** — `cf login` is interactive (sets org/space); `cf auth --client-credentials` is for scripts (still requires `cf target` separately). - **Two spaces to manage** — CF org/space context is separate from BTP subaccount context. `cf target` does not know about your BTP subaccount. - **`--format json` does NOT exist in CF CLI** — CF CLI has no global JSON output flag. Use `cf curl` for raw API JSON, or parse text output with `grep`/`awk`. - **MultiApps plugin required** — `cf deploy` is NOT a built-in command; it requires the MultiApps CLI plugin installed separately. - **`cf push` vs `cf deploy`** — `cf push` deploys a single app from a manifest.yml; `cf deploy` deploys an MTA (Multi-Target Application) from mtad.yaml using the MultiApps plugin. - **Stuck MTA operations** — check with `cf mta-ops`, abort with `cf deploy -i <operation-id> -a abort`. - **`cf restage` vs `cf restart`** — `cf restart` stops and starts without re-staging; `cf restage` re-runs the buildpack (needed after changing env vars that affect staging). - **WAR filename = Tomcat context path** — The SAP Java buildpack serves `ROOT.war` at `/`, `myapp.war` at `/myapp`. This skill's pom templates name the WAR after the project's `<artifactId>`, so a project with `<artifactId>connectivity</artifactId>` serves at `/connectivity`. `mtad.yaml`'s `path:` must match the actual filename Maven writes (see `mta-descriptor` → "WAR filename rule"). - **`cf logs --recent`** — only shows the last ~1000 lines from the Loggregator buffer; for full logs use `cf logs <app> --recent` or stream with `cf logs <app>`. --- ## Apps Group ### Core App Lifecycle ```bash # List all apps in targeted space cf apps # Aliases: cf a # Show details for one app cf app <APP_NAME> cf app <APP_NAME> --guid # Print only the GUID (suppresses other output) # Push app (single app from manifest.yml or flags) cf push <APP_NAME> [flags] -b <BUILDPACK> # Buildpack name or Git URL -c <COMMAND> # Startup command -f <MANIFEST_PATH> # Path to manifest file (default: manifest.yml) -i <INSTANCES> # Number of instances -k <DISK> # Disk quota (256M, 1G, etc.) -m <MEMORY> # Memory limit -o <DOCKER_IMAGE> # Docker image -p <PATH> # App directory or zip file -s <STACK> # Stack name -t <TIMEOUT> # Seconds to wait for start (default: 60) -u <HEALTH_CHECK_TYPE> # http | port | process --endpoint <PATH> # HTTP health check endpoint --no-manifest # Ignore manifest.yml --no-route # Do not map route --no-start # Do not stage and start --no-wait # Return after first instance healthy --random-route # Create a random route --strategy rolling # Rolling deployment strategy --task # Push as task-only app --var <KEY=VALUE> # Variable substitution --vars-file <FILE> # Variable substitution from file # Scale app cf scale <APP_NAME> -i <INSTANCES> # Number of instances -k <DISK> # Disk limit -m <MEMORY> # Memory limit --process <PROCESS> # Process type (default: web) -f # Force restart without prompt # Start / Stop / Restart / Restage cf start <APP_NAME> cf stop <APP_NAME> cf restart <APP_NAME> --strategy rolling # Rolling restart cf restage <APP_NAME> # Re-run buildpack (needed after staging env var changes) # Delete app cf delete <APP_NAME> -f # Force without prompt -r # Delete mapped routes too # Rename cf rename <APP_NAME> <NEW_NAME> # Restart a single instance cf restart-app-instance <APP_NAME> <INSTANCE_INDEX> --process <PROCESS> # Cancel a rolling deployment cf cancel-deployment <APP_NAME> ``` ### Logs and Diagnostics ```bash # Tail logs (stream) cf logs <APP_NAME> # Recent logs (last ~1000 lines) cf logs <APP_NAME> --recent # Show recent events (crashes, scaling, etc.) cf events <APP_NAME> # Environment variables (running + staging) cf env <APP_NAME> # Set environment variable (triggers restage if staging var) cf set-env <APP_NAME> <VAR_NAME> <VALUE> # Unset environment variable cf unset-env <APP_NAME> <VAR_NAME> ``` ### Manifest and Health Checks ```bash # Generate a manifest.yml from a running app cf create-app-manifest <APP_NAME> -p <PATH> # Output path (default: ./<app_name>_manifest.yml) # Get health check type cf get-health-check <APP_NAME> --process <PROCESS> # Set health check type cf set-health-check <APP_NAME> <TYPE> # http | port | process --endpoint <PATH> # HTTP health check path (requires http type) --invocation-timeout <N> # Seconds for health check --process <PROCESS> ``` ### SSH ```bash # SSH into app instance cf ssh <APP_NAME> -i <INDEX> # Instance index (default: 0) -c <COMMAND> # Command to run -L <LOCAL:REMOTE> # Local port forwarding --process <PROCESS> # Process type (default: web) -t # Request pseudo-tty -T # Disable pseudo-tty --force-pseudo-tty -k # Skip host key validation -N # Do not execute remote command (for port forwarding only) # Get one-time SSH passcode cf ssh-code # Enable/disable SSH for an app cf enable-ssh <APP_NAME> cf disable-ssh <APP_NAME> # Check if SSH is enabled cf ssh-enabled <APP_NAME> ``` ### Tasks and Packages ```bash # Run a one-off task cf run-task <APP_NAME> --command "<CMD>" --name <TASK_NAME> -m <MEMORY> -k <DISK> --process <PROCESS> # List tasks cf tasks <APP_NAME> # Terminate a task cf terminate-task <APP_NAME> <TASK_ID> # List packages cf packages <APP_NAME> # Create package from app source cf create-package <APP_NAME> -p <PATH> # Path to app zip or directory # List droplets (staged app artifacts) cf droplets <APP_NAME> # Set the active droplet for an app cf set-droplet <APP_NAME> <DROPLET_GUID> # Download a droplet cf download-droplet <APP_NAME> --path <PATH> # List available stacks cf stacks cf stack <STACK_NAME> ``` ### Revisions (Experimental) ```bash cf revisions <APP_NAME> cf revision <APP_NAME> <REVISION_NUMBER> cf rollback <APP_NAME> --version <REVISION_NUMBER> ``` --- ## Services Group ### Service Instances ```bash # List available services in marketplace cf marketplace cf marketplace -e <SERVICE_OFFERING> # Filter by offering cf marketplace -s <SPACE> # (v6/v7 only) filter by space # List service instances in current space cf services # Alias: cf s # Show details for one service instance cf service <SERVICE_INSTANCE_NAME> # Create service instance cf create-service <OFFERING> <PLAN> <INSTANCE_NAME> -b <BROKER> # Specific broker (when ambiguous) -c '{"key":"val"}' # JSON configuration parameters -t "tag1,tag2" # User-supplied tags -w # Wait for async operation to complete # Update service instance cf update-service <INSTANCE_NAME> -c '{"key":"val"}' # New configuration -p <NEW_PLAN> # Change plan -t "tag1,tag2" # New tags -w # Wait for async operation # Upgrade service instance to latest plan version cf upgrade-service <INSTANCE_NAME> -f # Force without confirmation # Delete service instance cf delete-service <INSTANCE_NAME> -f # Force without prompt -w # Wait for async deletion # Rename service instance cf rename-service <INSTANCE_NAME> <NEW_NAME> ``` ### Service Keys (Credentials) ```bash # List service keys cf service-keys <INSTANCE_NAME> # Show service key credentials cf service-key <INSTANCE_NAME> <KEY_NAME> --guid # Print only GUID # Create service key cf create-service-key <INSTANCE_NAME> <KEY_NAME> -c '{"key":"val"}' # Configuration parameters # Delete service key cf delete-service-key <INSTANCE_NAME> <KEY_NAME> -f # Force without prompt -w # Wait ``` ### Service Binding ```bash # Bind service to app cf bind-service <APP_NAME> <INSTANCE_NAME> -c '{"key":"val"}' # Binding parameters --binding-name <NAME> # Custom binding name # Unbind service from app cf unbind-service <APP_NAME> <INSTANCE_NAME> # Bind route to service cf bind-route-service <DOMAIN> <INSTANCE_NAME> -f # Force without prompt -n <HOSTNAME> # Hostname --path <PATH> # Unbind route from service cf unbind-route-service <DOMAIN> <INSTANCE_NAME> -f -n <HOSTNAME> --path <PATH> # Share service instance to another space