oz0 server ca export-key
Write the cluster CA's private key, unsealed, as PEM to a new file readable only by you, so that it can be imported into an HSM or a KMS.
For: Operators and developers looking up a command.
Write the cluster CA's private key, unsealed, as PEM to a new file readable only by you, so that it can be imported into an HSM or a KMS. The file is the CA: whoever reads it can issue node and operator certificates, so delete it once it is imported. The export is in the audit log.
Usage
oz0 server ca export-key --out FILE [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--data-dir | string | ~/.local/share/orchestrator-zero | server data directory |
--db-file | file | a file (- for stdin) holding the PostgreSQL URL of the management database, such as postgres://oz0:PASSWORD@db:5432/oz0 (or set OZ0_DB); the URL can carry a password, so it never goes on the command line | |
--dev | bool | a dev server's data directory (--data-dir) instead of a cluster's database | |
--master-key-command | command | a command that unwraps the master key from --master-key-file when the file holds it wrapped, such as with an HSM or a KMS: "COMMAND unwrap" prints the key from the wrapped document on stdin, "COMMAND wrap" wraps one, "COMMAND describe" says what holds the wrapping key (see the docs on key commands) (or set OZ0_MASTER_KEY_COMMAND) | |
--master-key-file | string | <data-dir>/master.key | master key file |
--out (-o) | string | the file to write; it must not exist |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.