Fix top-level cerbosctl help

Signed-off-by: Andrew Haines <haines@cerbos.dev>

cmd/cerbosctl/main.go

@@ -11,11 +11,34 @@ import (
 	"github.com/cerbos/cerbos/internal/util"
 )
 
+const description = `A CLI for managing Cerbos
+
+The Cerbos Admin API must be enabled in order for these commands to work.
+The Admin API requires credentials. They can be provided using a netrc file,
+environment variables or command-line arguments.
+
+Environment variables
+
+	- CERBOS_SERVER: gRPC address of the Cerbos server
+	- CERBOS_USERNAME: Admin username
+	- CERBOS_PASSWORD: Admin password
+
+When more than one method is used to provide credentials, the precedence from lowest to
+highest is: netrc < environment < command line.
+
+Examples
+
+	# Connect to a TLS enabled server while skipping certificate verification and launch the decisions viewer
+	cerbosctl --server=localhost:3593 --username=user --password=password --insecure decisions
+
+	# Connect to a non-TLS server and launch the decisions viewer
+	cerbosctl --server=localhost:3593 --username=user --password=password --plaintext decisions`
+
 func main() {
 	cli := &root.Cli{}
 	ctx := kong.Parse(cli,
 		kong.Name("cerbosctl"),
-		kong.Description("A CLI for managing Cerbos"),
+		kong.Description(description),
 		kong.UsageOnError(),
 		kong.Vars{"version": util.AppVersion()},
 	)

cmd/cerbosctl/root/root.go

@@ -16,26 +16,6 @@ import (
 	"github.com/cerbos/cerbos/cmd/cerbosctl/version"
 )
 
-var help = `Cerbos instance administration commands
-The Cerbos Admin API must be enabled in order for these commands to work.
-The Admin API requires credentials. They can be provided using a netrc file,
-environment variables or command-line arguments.
-
-Environment variables
-
-CERBOS_SERVER: gRPC address of the Cerbos server
-CERBOS_USERNAME: Admin username
-CERBOS_PASSWORD: Admin password
-
-When more than one method is used to provide credentials, the precedence from lowest to
-highest is: netrc < environment < command line.
-
-# Connect to a TLS enabled server while skipping certificate verification and launch the decisions viewer
-cerbosctl --server=localhost:3593 --username=user --password=password --insecure decisions
-
-# Connect to a non-TLS server and launch the decisions viewer
-cerbosctl --server=localhost:3593 --username=user --password=password --plaintext decisions`
-
 type Cli struct {
 	Get get.Cmd `cmd:"" help:"List or view policies and schemas"`
 	flagset.Globals
@@ -48,7 +28,3 @@ type Cli struct {
 	Audit     audit.Cmd     `cmd:"" help:"View audit logs"`
 	Version   version.Cmd   `cmd:"" help:"Show cerbosctl and PDP version"`
 }
-
-func (c *Cli) Help() string {
-	return help
-}

docs/modules/cli/pages/cerbosctl.adoc

@@ -39,6 +39,27 @@ Usage: cerbosctl <command>
 
 A CLI for managing Cerbos
 
+The Cerbos Admin API must be enabled in order for these commands to work.
+The Admin API requires credentials. They can be provided using a netrc file,
+environment variables or command-line arguments.
+
+Environment variables
+
+  - CERBOS_SERVER: gRPC address of the Cerbos server
+  - CERBOS_USERNAME: Admin username
+  - CERBOS_PASSWORD: Admin password
+
+When more than one method is used to provide credentials, the precedence from
+lowest to highest is: netrc < environment < command line.
+
+Examples
+
+    # Connect to a TLS enabled server while skipping certificate verification and launch the decisions viewer
+    cerbosctl --server=localhost:3593 --username=user --password=password --insecure decisions
+
+    # Connect to a non-TLS server and launch the decisions viewer
+    cerbosctl --server=localhost:3593 --username=user --password=password --plaintext decisions
+
 Flags:
   -h, --help                       Show context-sensitive help.
       --server="localhost:3593"    Address of the Cerbos server ($CERBOS_SERVER)