oz0 server secrets-key wrap
For: Operators and developers looking up a command.
Move the secrets key under a key command, which keeps the key that wraps it in an HSM, a KMS or anything else. It wraps the key with COMMAND wrap, checks that COMMAND unwrap gives the same key back, keeps the plain file as <file>.plain and writes the wrapped document in its place. Start every server with --secrets-key-command COMMAND from then on.
Once they run, shred the plain copy with --forget-plain --confirm-backup (after you have an offline copy of the key, as server init asks for).
--rewrap rotates the wrapping key of a file that is wrapped already: it unwraps with --from-command (default --command) and wraps the same key with --command, keeping the old document as <file>.prev. Use it for a new KMS key, alias, endpoint or credentials. The key itself does not change.
Run it on a server's machine, with the key file the servers use. With --db-file, OZ0_DB or --dev it also checks the key against the cluster and writes an audit entry; an edge apart from management runs it without. It needs no licence: unwrap-to-file is the way back to a plain file.
Usage
oz0 server secrets-key wrap --command COMMAND [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--command | command | the key command that wraps the key from now on | |
--confirm-backup | bool | with --forget-plain: an offline copy of the key exists, apart from the database's backups (recorded as confirm-backup does, with the database) | |
--data-dir | string | ~/.local/share/orchestrator-zero | server data directory |
--db-file | file | a file (- for stdin) holding the PostgreSQL URL of the management database, such as postgres://oz0:PASSWORD@db:5432/oz0 (or set OZ0_DB); the URL can carry a password, so it never goes on the command line | |
--dev | bool | a dev server's data directory (--data-dir) instead of a cluster's database | |
--forget-plain | bool | shred <file>.plain, the plain copy wrap kept, once the wrapped file unwraps to the same key | |
--from-command | command | --command | with --rewrap: the key command that unwraps the file now |
--note | string | with --forget-plain: where the offline copy is kept, one line for the audit log; never the key | |
--rewrap | bool | rotate the wrapping key of a file that is wrapped already | |
--secrets-key-file | string | the secrets key file the edges start with (--secrets-key-file of server start) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.