oz0 server ca forget-key
Check that the signing command holds the cluster CA's key and signs with it, then delete the sealed copy from the database.
For: Operators and developers looking up a command.
Check that the signing command holds the cluster CA's key and signs with it, then delete the sealed copy from the database. From then on every server, and server operator issue, needs --ca-signer-command; a server started without it refuses to start. Backups taken afterwards hold no CA key.
Usage
oz0 server ca forget-key --ca-signer-command COMMAND [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--ca-signer-command | command | a command that signs with the cluster CA's key outside the server, such as in an HSM or a KMS: "COMMAND public-key" prints the key as PEM, "COMMAND sign sha256" signs the digest on stdin | |
--data-dir | string | ~/.local/share/orchestrator-zero | server data directory |
--db-file | file | a file (- for stdin) holding the PostgreSQL URL of the management database, such as postgres://oz0:PASSWORD@db:5432/oz0 (or set OZ0_DB); the URL can carry a password, so it never goes on the command line | |
--dev | bool | a dev server's data directory (--data-dir) instead of a cluster's database | |
--master-key-command | command | a command that unwraps the master key from --master-key-file when the file holds it wrapped, such as with an HSM or a KMS: "COMMAND unwrap" prints the key from the wrapped document on stdin, "COMMAND wrap" wraps one, "COMMAND describe" says what holds the wrapping key (see the docs on key commands) (or set OZ0_MASTER_KEY_COMMAND) | |
--master-key-file | string | <data-dir>/master.key | master key file |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.