Context Management

Managing Contexts with tcloud CLI

Contexts in tcloud CLI allow you to manage multiple authentication configurations and switch between different Thalassa Cloud environments easily. This is particularly useful when working with multiple organisations, regions, or environments (production, staging, development).

What are Contexts?

A context is a named configuration that stores:

API endpoint URL
Authentication method (browser OIDC session, token, or OIDC client credentials)
Organisation identifier
Project scope (if applicable)

Contexts are stored locally and can be easily switched between using the --context flag or by setting a default context. With browser OIDC, access and refresh tokens live in your OS keychain; the config file holds context metadata only.

Basic Context Operations

Creating a Context

By default, tcloud context create starts a browser-based OIDC login when no other credentials are provided:

tcloud context create --name <context-name>

Example:

tcloud context create --name production --organisation=my-company

tcloud opens your default browser, completes the OIDC sign-in flow, and binds the session to the context.

Re-authenticating (login)

To refresh or re-authenticate an existing context:

tcloud context login

To switch a PAT-based context to browser OIDC:

tcloud context login --browser

Creating Contexts with a Personal Access Token

For automation or non-interactive environments:

tcloud context create --name <context-name> \
  --api=<api-endpoint> \
  --token=<personal-access-token> \
  --organisation=<org-slug>

Example:

tcloud context create --name production \
  --api=https://api.thalassa.cloud \
  --token=pat_1234567890abcdef \
  --organisation=my-company

Creating Contexts with OIDC client credentials

tcloud context create --name <context-name> \
  --api=<api-endpoint> \
  --client-id=<oidc-client-id> \
  --client-secret=<oidc-client-secret> \
  --organisation=<org-slug>

Example:

tcloud context create --name enterprise \
  --api=https://api.thalassa.cloud \
  --client-id=my-oidc-client \
  --client-secret=my-oidc-secret \
  --organisation=myorg

Listing Contexts

View all available contexts:

tcloud context list

Output example:

NAME        API ENDPOINT                    ORGANISATION
production  https://api.thalassa.cloud     my-company

Using a Context

Method 1: Using the –context flag

tcloud --context=production me
tcloud --context=staging kubernetes list

Method 2: Setting a default context

# Set default context
tcloud context use production

# Now use commands without --context flag
tcloud me
tcloud kubernetes list

Advanced Context Management

Working with Multiple Organisations

If you have access to multiple organisations, create separate contexts for each, or switch organisation with tcloud context organisation:

# Production organisation (browser login)
tcloud context create --name prod-org --organisation=production-org

# Development organisation (browser login)
tcloud context create --name dev-org --organisation=development-org

Custom API Endpoints

For self-hosted or custom Thalassa Cloud installations:

tcloud context create --name on-premise \
  --api=https://my-company.thalassa.cloud \
  --organisation=on-premise-org

Without --token or client credentials, this still uses browser OIDC against the specified API endpoint.

Context Configuration File

Context metadata is stored in a configuration file. The location varies by operating system:

Linux/macOS: ~/.tcloud
Windows: %APPDATA%\tcloud

With browser OIDC, tokens are stored in the OS keychain rather than this file. If you upgraded from an older CLI that stored credentials in plaintext, migrate them:

tcloud context fix --migrate-credentials

Best Practices

Security Considerations

Prefer browser OIDC for interactive workstation use; reserve PATs for automation
Never share context files or keychain entries
Use different credentials for different environments when possible
Rotate tokens used for automation regularly

Authentication