> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Manage Datastores

> Use ZCLI commands to create, view, update, and delete datastores and the resources stored in ZEDEDA Store datastores from the command line.

Use the ZEDEDA CLI (ZCLI) to manage datastores from the command line. A datastore defines the connection details and credentials for an external storage service (such as a cloud storage bucket, an SFTP or HTTP file server, or a container registry) that EVE-OS (Edge Virtualization Engine) on a node uses to download application images and files. This article covers `zcli datastore` commands for datastores, project scope, and ZEDEDA Store resources, with syntax and examples for each operation.

## Before You Start

* ZCLI is installed and authenticated against your enterprise. See [Get Started](https://zededa.mintlify.site/zcli-reference/get-started.md).
* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* The nodes that will use the datastore have network connectivity to the storage service.
* For GUI-based datastore management, see [Datastores Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/datastores.md), [Create a Datastore](https://zededa.mintlify.site/new-ui/infrastructure-services/datastores/create-a-datastore.md), and [Manage a Datastore](https://zededa.mintlify.site/new-ui/infrastructure-services/datastores/manage-a-datastore.md).

## Datastore Types

Every `zcli datastore create` command requires `--dstype`. The following table lists the supported values. Type values are uppercase.

| Type | Description |
| - | - |
| `HTTP` | Unsecured HTTP file server. Store application images, scripts, configuration files, and other generic files. |
| `HTTPS` | Secured HTTPS file server. Same use as `HTTP`, with TLS. |
| `AWSS3` | Amazon S3 bucket. Requires `--region`. ZCLI sets the FQDN from the region. |
| `SFTP` | SFTP file server. Authenticates with a username and password. |
| `CONTAINERREGISTRY` | OCI or Docker container registry, such as Docker Hub, Google Container Registry, Azure Container Registry, GitHub Container Registry, or a private registry. |
| `AZUREBLOB` | Azure Blob Storage container. |
| `ARTIFACT-STORE:VAULT` | ZEDEDA Store artifact datastore backed by a vault. Holds licenses, certificates, and other files that application instances fetch at runtime. |
| `SECRET-STORE:VAULT` | ZEDEDA Store secret datastore backed by a vault. Holds tokens, passwords, and other sensitive values. |

For the ZEDEDA Store types, see [Manage Secrets and Artifacts](https://zededa.mintlify.site/new-ui/infrastructure-services/datastores/manage-secrets-and-artifacts.md) for how application instances consume the stored resources.

## Manage Datastores

### Create a datastore

Create a datastore record. The datastore name must be unique within your enterprise and cannot be changed after creation. If you omit `--title`, ZCLI uses the name as the title. If you omit `--project-scope`, the datastore is available to all projects.

```text theme={"dark"}
zcli datastore create <name> [--title=<title>] --dstype=<dstype> [--description=<description>] [--fqdn=<fqdn>] [--region=<region>] [--apikey=<apikey>] [--apipass=<password>] [--dpath=<dpath>] [--origin-type=<origin-type>] [--project-scope=<project-names>]
```

| Flag | Description |
| - | - |
| `--dstype=<dstype>` | Type of the datastore. See [Datastore Types](#datastore-types). Required. |
| `--fqdn=<fqdn>` | Domain name of the datastore server. For `AWSS3`, ZCLI sets this from `--region`. For `CONTAINERREGISTRY`, the default is `docker://index.docker.io`. |
| `--region=<region>` | Region of the datastore. Required for `AWSS3`. ZCLI accepts `us-east-1`, `us-east-2`, `us-west-1`, and `us-west-2`. |
| `--dpath=<dpath>` | Path or bucket within the datastore. For the ZEDEDA Store types, this is the vault mount path. |
| `--apikey=<apikey>` | Access Key ID for `AWSS3` and `AZUREBLOB`. Username for `SFTP` and `CONTAINERREGISTRY`. Token for the ZEDEDA Store types. |
| `--apipass=<password>` | Secret Access Key for `AWSS3` and `AZUREBLOB`. Password for `SFTP` and `CONTAINERREGISTRY`. |
| `--origin-type=<origin-type>` | Origin of the datastore. Supported values are `local`, `global`, and `imported`. |
| `--project-scope=<project-names>` | Comma-separated list of project names that can use the datastore. The default is all projects. |

For the ZEDEDA Store types (`ARTIFACT-STORE:VAULT` and `SECRET-STORE:VAULT`), `--fqdn`, `--dpath`, and `--apikey` are all required. ZCLI returns an error if any of the three is missing.

> [!WARNING]
>
> The `--apikey` and `--apipass` values are stored in Edge Infrastructure Services and are passed to nodes, which use them to authenticate to the datastore. A datastore created with empty credentials causes nodes to fetch from it without authentication.

Example (Amazon S3):

```text theme={"dark"}
zcli datastore create MY_S3_DATASTORE --dstype=AWSS3 --region=us-east-1 --dpath=MY_BUCKET --apikey=AKIAIOSFODNN7EXAMPLE --apipass=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
```

Example (Docker Hub):

```text theme={"dark"}
zcli datastore create MY_DOCKER_DATASTORE --dstype=CONTAINERREGISTRY --fqdn=docker://docker.io --apikey=MY_USERNAME --apipass=MY_PASSWORD
```

Example (local HTTP file server):

```text theme={"dark"}
zcli datastore create MY_HTTP_DATASTORE --dstype=HTTP --fqdn=http://192.168.254.42 --dpath=images
```

Example (Azure Blob):

```text theme={"dark"}
zcli datastore create MY_AZURE_DATASTORE --dstype=AZUREBLOB --fqdn=https://MY_ACCOUNT.blob.core.windows.net --dpath=qcow2images --apikey=MY_ACCESS_KEY_ID --apipass=MY_SECRET_ACCESS_KEY
```

Example (ZEDEDA Store secret datastore, scoped to one project):

```text theme={"dark"}
zcli datastore create MY_SECRET_STORE --dstype=SECRET-STORE:VAULT --fqdn=https://MY_VAULT_SERVER --dpath=secret --apikey=MY_VAULT_TOKEN --project-scope=MY_PROJECT
```

### View a datastore

List all datastores, or show the configuration of one datastore by name or UUID. Run the command with no arguments to list every datastore in your enterprise with a summary by type and category. Use `--dstype=ARTIFACT-STORE:VAULT` or `--dstype=SECRET-STORE:VAULT` to list the ZEDEDA Store datastores, which do not appear in the default list. To show a single ZEDEDA Store datastore by name or UUID, you must also pass its `--dstype`. Without it, ZCLI searches only the standard datastores and does not find the record.

```text theme={"dark"}
zcli datastore show [--dstype=<dstype>] [[[<name> | --uuid=<uuid>] [--detail]] | [[--summary] | [[--name-pattern=<name-pattern>] [--page-size=<page-size>]]]]
```

| Flag | Description |
| - | - |
| `--detail` | Show the full configuration of the datastore. |
| `--uuid=<uuid>` | Select the datastore by UUID instead of name. |
| `--summary` | Print only the object summary. |
| `--name-pattern=<name-pattern>` | Match all datastores containing this substring in their name. |
| `--page-size=<page-size>` | Number of records returned per API call. ZCLI still retrieves the full list. Reduce this value if large lists time out. |

Example (list all datastores):

```text theme={"dark"}
zcli datastore show
```

Example response:

```text theme={"dark"}
Datastore              Datastore URL                      Datastore region Path / Bucket
---------------------- ---------------------------------- ---------------- ----------------------------------
http-42                http://192.168.254.42                               images
MY_S3_DATASTORE        https://s3-us-west-2.amazonaws.com us-west-2        MY_BUCKET
MY_S3_TEST_DATASTORE   https://s3-us-west-2.amazonaws.com us-west-2        MY_TEST_BUCKET
MY_DOCKER_DATASTORE    docker://docker.io

Total: 5 Type Distribution Summary: DATASTORE_TYPE_AWSS3 : 1  DATASTORE_TYPE_AZUREBLOB : 0  DATASTORE_TYPE_CONTAINERREGISTRY : 1  DATASTORE_TYPE_FILE_STORAGE : 0  DATASTORE_TYPE_HTTP : 2  DATASTORE_TYPE_HTTPS : 0  DATASTORE_TYPE_SFTP : 0  DATASTORE_TYPE_UNSPECIFIED : 0  DATASTORE_TYPE_ZEDEDABLOB : 0  DATASTORE_TYPE_ZEDEDAS3 : 1
Total: 5 Category Distribution Summary: DATASTORE_TYPE_CONTAINERREGISTRY : 1  DATASTORE_TYPE_FILE_STORAGE : 4
```

Example (show one datastore in detail):

```text theme={"dark"}
zcli datastore show MY_S3_DATASTORE --detail
```

Example (filter by name substring):

```text theme={"dark"}
zcli datastore show --name-pattern=aws
```

Example (list ZEDEDA Store secret datastores):

```text theme={"dark"}
zcli datastore show --dstype=SECRET-STORE:VAULT
```

Example (show one ZEDEDA Store secret datastore):

```text theme={"dark"}
zcli datastore show MY_SECRET_STORE --dstype=SECRET-STORE:VAULT
```

### View the project scope of a datastore

List the projects that can use a datastore.

```text theme={"dark"}
zcli datastore show-project-scope <name>
```

Example:

```text theme={"dark"}
zcli datastore show-project-scope MY_S3_DATASTORE
```

### Update a datastore

Update a datastore. ZCLI retrieves the current record and applies the values you pass. The datastore name and type cannot be changed. The flags that take effect depend on the datastore type:

* For standard datastores (every type except the ZEDEDA Store types), you can change the title, description, clear-text setting, project scope, and origin type. ZCLI ignores `--fqdn`, `--dpath`, and `--apikey` for these types, and `update` has no `--apipass` option. To change the connection details or credentials of a standard datastore, use the console. See [Manage a Datastore](https://zededa.mintlify.site/new-ui/infrastructure-services/datastores/manage-a-datastore.md).
* For the ZEDEDA Store types, pass `--dstype`. You can change the title, description, vault FQDN and mount path, and token. If you change `--fqdn` or `--dpath`, pass both values together. ZCLI ignores `--clear-text`, `--project-scope`, and `--origin-type` for these types.

```text theme={"dark"}
zcli datastore update <name> [--dstype=<dstype>] [--title=title] [--description=<description>] [--clear-text=<true|false>] [--project-scope=<project-names>] [--origin-type=<origin-type>] [--fqdn=<fqdn>] [--apikey=<apikey>] [--dpath=<dpath>]
```

| Flag | Description |
| - | - |
| `--clear-text=<true\|false>` | Send the datastore credential to the node in clear text. |
| `--project-scope=<project-names>` | Comma-separated list of project names that replace the current project scope. |
| `--apikey=<apikey>` | New token for a ZEDEDA Store datastore. |

Example:

```text theme={"dark"}
zcli datastore update MY_S3_DATASTORE --title=MY_NEW_TITLE
```

Example (change the project scope):

```text theme={"dark"}
zcli datastore update MY_S3_DATASTORE --project-scope=MY_PROJECT,MY_OTHER_PROJECT
```

### Delete a datastore

Delete a datastore record. Without `-f`, ZCLI prompts you to confirm. A datastore cannot be deleted while app images or edge apps reference it; remove those dependencies first. For the ZEDEDA Store types, pass `--dstype`, and add `--delete-resources` to delete all resources in the store along with it.

```text theme={"dark"}
zcli datastore delete <name> [--dstype=<dstype>] [-f] [--delete-resources]
```

Example:

```text theme={"dark"}
zcli datastore delete MY_S3_DATASTORE -f
```

Example (delete a ZEDEDA Store datastore and its resources):

```text theme={"dark"}
zcli datastore delete MY_SECRET_STORE --dstype=SECRET-STORE:VAULT --delete-resources
```

If an image still references the datastore, ZCLI returns an error.

Example response:

```text theme={"dark"}
Delete datastore MY_S3_DATASTORE? [Y/N]: Y
Datastore delete MY_S3_DATASTORE failed: Conflict
[Error DependencyConflict: Dependent Entry exists]
[Error DependencyConflict: image is associated with datastore, can't delete]
```

## Manage ZEDEDA Store Resources

Resources are the individual secrets or artifacts held in a datastore of type `ARTIFACT-STORE:VAULT` or `SECRET-STORE:VAULT`. The `<name>` argument in each of the following commands is the datastore name. For how application instances consume these resources, see [Manage Secrets and Artifacts](https://zededa.mintlify.site/new-ui/infrastructure-services/datastores/manage-secrets-and-artifacts.md).

### Create a resource

Create a resource in a ZEDEDA Store datastore. If you omit `--title`, ZCLI uses the resource name as the title. For an artifact store, pass the file contents base64-encoded in `--value`. The `--expires-on` value is a timestamp, or `never` (the default).

```text theme={"dark"}
zcli datastore create-resource <name> --resource-name=<resource-name> --value=<value> [--title=<title>] [--description=<description>] [--expires-on=<expires-on>]
```

Example:

```text theme={"dark"}
zcli datastore create-resource MY_SECRET_STORE --resource-name=CLIENT_SECRET --value=MY_SECRET_VALUE
```

### View a resource

Show one resource by name, all resources in one datastore, or all resources in every ZEDEDA Store datastore. ZCLI masks the value of resources in secret stores.

```text theme={"dark"}
zcli datastore show-resource [<name>] [--resource-name=<resource-name>] [--detail]
```

Example (all resources in one datastore):

```text theme={"dark"}
zcli datastore show-resource MY_SECRET_STORE
```

Example (one resource in detail):

```text theme={"dark"}
zcli datastore show-resource MY_SECRET_STORE --resource-name=CLIENT_SECRET --detail
```

### Update a resource

Update the value, title, description, or expiry of a resource.

```text theme={"dark"}
zcli datastore update-resource <name> --resource-name=<resource-name> [--value=<value>] [--title=<title>] [--description=<description>] [--expires-on=<expires-on>]
```

Example:

```text theme={"dark"}
zcli datastore update-resource MY_SECRET_STORE --resource-name=CLIENT_SECRET --value=MY_NEW_SECRET_VALUE
```

### Delete a resource

Delete a resource from a ZEDEDA Store datastore. Without `-f`, ZCLI prompts you to confirm.

```text theme={"dark"}
zcli datastore delete-resource <name> --resource-name=<resource-name> [-f]
```

Example:

```text theme={"dark"}
zcli datastore delete-resource MY_SECRET_STORE --resource-name=CLIENT_SECRET
```

## Next Steps

> [card] [Create a Datastore](https://zededa.mintlify.site/new-ui/infrastructure-services/datastores/create-a-datastore.md)
>
> Set up a datastore using the Edge Infrastructure Services console.

> [card] [Manage a Datastore](https://zededa.mintlify.site/new-ui/infrastructure-services/datastores/manage-a-datastore.md)
>
> GUI-based datastore viewing, updating, and deletion.

> [card] [Manage Secrets and Artifacts](https://zededa.mintlify.site/new-ui/infrastructure-services/datastores/manage-secrets-and-artifacts.md)
>
> Deliver secrets and artifacts from ZEDEDA Store datastores to application instances.

> [card] [Overview](https://zededa.mintlify.site/zcli-reference/overview.md)
>
> All ZCLI command procedures, organized by resource type.