oz0 server secrets-key move-flavour
For: Operators and developers looking up a command.
Move a cluster between the default and the FIPS flavour (FIPS builds in the docs). Tenant secrets, subjects' keys and payload keys are sealed to the secrets key with an HPKE suite each flavour picks: ML-KEM-768 with X25519 in the default flavour, with P-256 in the FIPS flavour.
Run this with the binary of the flavour you move to, once every server is stopped: it publishes this flavour's public key of the same secrets key file in place of the other flavour's. The file does not change. When the servers of this flavour start, the edges re-seal every value to it, as they re-seal values sealed with the master key.
It refuses unless the cluster seals to the other flavour's key of this very file, and the move is in the audit log.
Usage
oz0 server secrets-key move-flavour [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--data-dir | string | ~/.local/share/orchestrator-zero | server data directory |
--db-file | file | a file (- for stdin) holding the PostgreSQL URL of the management database, such as postgres://oz0:PASSWORD@db:5432/oz0 (or set OZ0_DB); the URL can carry a password, so it never goes on the command line | |
--dev | bool | a dev server's data directory (--data-dir) instead of a cluster's database | |
--secrets-key-command | command | a command that unwraps the secrets key from --secrets-key-file when the file holds it wrapped: "COMMAND unwrap" prints the key from the wrapped document on stdin, "COMMAND wrap" wraps one, "COMMAND describe" says what holds the wrapping key (see the docs on key commands) (or set OZ0_SECRETS_KEY_COMMAND) | |
--secrets-key-file | string | the secrets key file the edges use (--secrets-key-file of server start) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.