oz0 server secrets-key create
Write a new secrets key: the private key that tenant secrets are sealed to with HPKE.
For: Operators and developers looking up a command.
Write a new secrets key: the private key that tenant secrets are sealed to with HPKE. Give the file to every server that runs the edge role with --secrets-key-file, and to no server that runs only management. The first edge that starts with it publishes its public half; management then seals every new secret to it, and the edges seal the existing ones to it, so that management can store tenant secrets but not open them.
Keep a copy with the master key: losing it loses every secret sealed to it. With --command the new key is wrapped by that key command before it is written, so it is never on disk in the clear.
Usage
oz0 server secrets-key create [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--command | command | a key command that wraps the new key before it is written | |
--out | string | the file to write; it must not exist |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.