Command Line Interface (CLI)
The MarbleRun CLI allows you to install MarbleRun on your cluster and interacts with the control plane through the Client API for all administrative tasks in the service mesh.
Reference
Usage:
marblerun [command]
Commands:
- install: Installs MarbleRun on a Kubernetes cluster
- uninstall: Remove MarbleRun from a Kubernetes cluster
- precheck: Check if your Kubernetes cluster supports SGX
- check: Check the status of MarbleRun's control plane
- manifest: Manages manifest for the MarbleRun Coordinator
- get: Get the manifest from the MarbleRun Coordinator
- log: Get the update log from the MarbleRun Coordinator
- set: Sets the manifest for the MarbleRun Coordinator
- signature: Prints the signature of a MarbleRun manifest
- update: Manage manifest updates for the MarbleRun Coordinator
- apply: Update the MarbleRun Coordinator with the specified manifest
- acknowledge: Acknowledge a pending update for the MarbleRun Coordinator (Enterprise feature)
- cancel: Cancel a pending manifest update for the MarbleRun Coordinator (Enterprise feature)
- get: View a pending manifest update (Enterprise feature)
- verify: Verify the signature of a MarbleRun manifest
- certificate: Retrieves the certificate of the MarbleRun Coordinator
- root: Returns the root certificate of the MarbleRun Coordinator
- intermediate: Returns the intermediate certificate of the MarbleRun Coordinator
- chain: Returns the certificate chain of the MarbleRun Coordinator
- secret: Manage secrets for the MarbleRun Coordinator
- status: Retrieve information about the status of the MarbleRun Coordinator
- recover: Recover the MarbleRun Coordinator from a sealed state
- package-info: Print the package signature properties of an enclave
- version: Display version of this CLI and (if running) the MarbleRun Coordinator
marblerun install
Installs MarbleRun on a Kubernetes cluster
Synopsis
Installs MarbleRun on a Kubernetes cluster
marblerun install [flags]
Examples
# Install MarbleRun in simulation mode
marblerun install --simulation
# Install MarbleRun using a custom PCCS
marblerun install --dcap-pccs-url https://pccs.example.com/sgx/certification/v4/ --dcap-secure-cert FALSE
Options
--client-server-port int Set the client server port. Needs to be configured to the same port as in your client tool stack (default 4433)
--dcap-pccs-url string Provisioning Certificate Caching Service (PCCS) server address. Defaults to Azure PCCS. (default "https://global.acccache.azure.net/sgx/certification/v4/")
--dcap-secure-cert string To accept insecure HTTPS certificate from the PCCS, set this option to FALSE (default "TRUE")
--disable-auto-injection Install MarbleRun without auto-injection webhook
--domain strings Sets additional DNS names and IPs for the Coordinator TLS certificate
--enterprise-access-token string Access token for Enterprise Coordinator. Leave empty for default installation
-h, --help help for install
--marblerun-chart-path string Path to MarbleRun helm chart
--mesh-server-port int Set the mesh server port. Needs to be configured to the same port as in the data-plane marbles (default 2001)
--resource-key string Resource providing SGX, different depending on used device plugin. Use this to set tolerations/resources if your device plugin is not supported by MarbleRun
--simulation Set MarbleRun to start in simulation mode
--version string Version of the Coordinator to install, latest by default
--wait Wait for MarbleRun installation to complete before returning
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun uninstall
Remove MarbleRun from a Kubernetes cluster
Synopsis
Remove MarbleRun from a Kubernetes cluster
marblerun uninstall [flags]
Options
-h, --help help for uninstall
--wait Wait for the uninstallation to complete before returning
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun precheck
Check if your Kubernetes cluster supports SGX
Synopsis
Check if your Kubernetes cluster supports SGX
marblerun precheck [flags]
Options
-h, --help help for precheck
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun check
Check the status of MarbleRun's control plane
Synopsis
Check the status of MarbleRun's control plane
marblerun check [flags]
Options
-h, --help help for check
--timeout uint Time to wait before aborting in seconds (default 60)
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun manifest
Manages manifest for the MarbleRun Coordinator
Synopsis
Manages manifests for the MarbleRun Coordinator. Used to either set the manifest, update an already set manifest, or return a signature of the currently set manifest to the user
Examples
manifest set manifest.json example.com:4433 [--era-config=config.json] [--insecure]
Options
-h, --help help for manifest
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun manifest get
Get the manifest from the MarbleRun Coordinator
Synopsis
Get the manifest from the MarbleRun Coordinator. Optionally get the manifests signature or merge updates into the displayed manifest.
marblerun manifest get <IP:PORT> [flags]
Examples
marblerun manifest get $MARBLERUN -s --era-config=era.json
Options
-u, --display-update Set to merge updates into the displayed manifest
-h, --help help for get
--keep-cert Set to keep the certificate of the Coordinator and save it to the location specified by --coordinator-cert
-o, --output string Save output to file instead of printing to stdout
-s, --signature Set to additionally display the manifests signature
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun manifest log
Get the update log from the MarbleRun Coordinator
Synopsis
Get the update log from the MarbleRun Coordinator. The log is list of all successful changes to the Coordinator, including a timestamp and user performing the operation.
marblerun manifest log <IP:PORT> [flags]
Examples
marblerun manifest log $MARBLERUN
Options
-h, --help help for log
-o, --output string Save log to file instead of printing to stdout
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun manifest set
Sets the manifest for the MarbleRun Coordinator
Synopsis
Sets the manifest for the MarbleRun Coordinator
marblerun manifest set <manifest.json> <IP:PORT> [flags]
Examples
marblerun manifest set manifest.json $MARBLERUN --recovery-data=recovery-secret.json --era-config=era.json
Options
-h, --help help for set
-r, --recoverydata string File to write recovery data to, print to stdout if non specified
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun manifest signature
Prints the signature of a MarbleRun manifest
Synopsis
Prints the signature of a MarbleRun manifest
marblerun manifest signature <manifest.json> [flags]
Options
-h, --help help for signature
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun manifest update
Manage manifest updates for the MarbleRun Coordinator
Synopsis
Manage manifest updates for the MarbleRun Coordinator.
Options
-h, --help help for update
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun manifest update apply
Update the MarbleRun Coordinator with the specified manifest
Synopsis
Update the MarbleRun Coordinator with the specified manifest. An admin certificate specified in the original manifest is needed to verify the authenticity of the update manifest.
marblerun manifest update apply <manifest.json> <IP:PORT> [flags]
Examples
marblerun manifest update apply update-manifest.json $MARBLERUN --cert=admin-cert.pem --key=admin-key.pem --era-config=era.json
Options
-c, --cert string PEM encoded admin certificate file (required)
-h, --help help for apply
-k, --key string PEM encoded admin key file (required)
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun manifest update acknowledge
Acknowledge a pending update for the MarbleRun Coordinator (Enterprise feature)
Synopsis
Acknowledge a pending update for the MarbleRun Coordinator (Enterprise feature).
In case of multi-party updates, the Coordinator will wait for all participants to acknowledge the update before applying it. All participants must use the same manifest to acknowledge the pending update.
marblerun manifest update acknowledge <manifest.json> <IP:PORT> [flags]
Examples
marblerun manifest update acknowledge update-manifest.json $MARBLERUN --cert=admin-cert.pem --key=admin-key.pem --era-config=era.json
Options
-c, --cert string PEM encoded admin certificate file (required)
-h, --help help for acknowledge
-k, --key string PEM encoded admin key file (required)
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun manifest update cancel
Cancel a pending manifest update for the MarbleRun Coordinator (Enterprise feature)
Synopsis
Cancel a pending manifest update for the MarbleRun Coordinator (Enterprise feature).
marblerun manifest update cancel <IP:PORT> [flags]
Examples
marblerun manifest update cancel $MARBLERUN --cert=admin-cert.pem --key=admin-key.pem --era-config=era.json
Options
-c, --cert string PEM encoded admin certificate file (required)
-h, --help help for cancel
-k, --key string PEM encoded admin key file (required)
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun manifest update get
View a pending manifest update (Enterprise feature)
Synopsis
View a pending manifest update (Enterprise feature).
marblerun manifest update get <IP:PORT> [flags]
Examples
marblerun manifest update get $MARBLERUN --era-config=era.json
Options
-h, --help help for get
--missing Display number of missing acknowledgements instead of the manifest
-o, --output string Save output to file instead of printing to stdout
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun manifest verify
Verify the signature of a MarbleRun manifest
Synopsis
Verify that the signature returned by the Coordinator is equal to a local signature
marblerun manifest verify <manifest/signature> <IP:PORT> [flags]
Examples
marblerun manifest verify manifest.json $MARBLERUN
Options
-h, --help help for verify
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun certificate
Retrieves the certificate of the MarbleRun Coordinator
Synopsis
Retrieves the certificate of the MarbleRun Coordinator
Options
-h, --help help for certificate
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun certificate root
Returns the root certificate of the MarbleRun Coordinator
Synopsis
Returns the root certificate of the MarbleRun Coordinator
marblerun certificate root <IP:PORT> [flags]
Options
-h, --help help for root
-o, --output string File to save the certificate to (default "marblerunRootCA.crt")
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun certificate intermediate
Returns the intermediate certificate of the MarbleRun Coordinator
Synopsis
Returns the intermediate certificate of the MarbleRun Coordinator
marblerun certificate intermediate <IP:PORT> [flags]
Options
-h, --help help for intermediate
-o, --output string File to save the certificate to (default "marblerunIntermediateCA.crt")
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun certificate chain
Returns the certificate chain of the MarbleRun Coordinator
Synopsis
Returns the certificate chain of the MarbleRun Coordinator
marblerun certificate chain <IP:PORT> [flags]
Options
-h, --help help for chain
-o, --output string File to save the certificate to (default "marblerunChainCA.crt")
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun secret
Manage secrets for the MarbleRun Coordinator
Synopsis
Manage secrets for the MarbleRun Coordinator. Set or retrieve a secret defined in the manifest.
Options
-c, --cert string PEM encoded MarbleRun user certificate file (required)
-h, --help help for secret
-k, --key string PEM encoded MarbleRun user key file (required)
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun secret set
Set a secret for the MarbleRun Coordinator
Synopsis
Set a secret for the MarbleRun Coordinator. Secrets are loaded from a file in JSON format or directly from a PEM encoded certificate and/or key. In the later case, the name of the secret has to be set with the flag [--from-pem]. Users have to authenticate themselves using a certificate and private key and need permissions in the manifest to write the requested secrets.
marblerun secret set <secret_file> <IP:PORT> [flags]
Examples
# Set a secret from a JSON file
marblerun secret set secret.json $MARBLERUN -c admin.crt -k admin.key
# Set a secret from a PEM encoded file
marblerun secret set certificate.pem $MARBLERUN -c admin.crt -k admin.key --from-pem certificateSecret
Options
--from-pem string name of the secret from a PEM encoded file
-h, --help help for set
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
-c, --cert string PEM encoded MarbleRun user certificate file (required)
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-k, --key string PEM encoded MarbleRun user key file (required)
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun secret get
Retrieve secrets from the MarbleRun Coordinator
Synopsis
Retrieve one or more secrets from the MarbleRun Coordinator. Users have to authenticate themselves using a certificate and private key, and need permissions in the manifest to read the requested secrets.
marblerun secret get SECRETNAME ... <IP:PORT> [flags]
Examples
marblerun secret get genericSecret symmetricKeyShared $MARBLERUN -c admin.crt -k admin.key
Options
-h, --help help for get
-o, --output string File to save the secret to
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
-c, --cert string PEM encoded MarbleRun user certificate file (required)
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-k, --key string PEM encoded MarbleRun user key file (required)
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun status
Retrieve information about the status of the MarbleRun Coordinator
Synopsis
This command provides information about the currently running MarbleRun Coordinator. Information is obtained from the /status endpoint of the Coordinators REST API.
The Coordinator will be in one of these 4 states: 0 recovery mode: Found a sealed state of an old seal key. Waiting for user input on /recovery. The Coordinator is currently sealed, it can be recovered using the [marblerun recover] command.
1 uninitialized: Fresh start, initializing the Coordinator. The Coordinator is in its starting phase.
2 waiting for manifest: Waiting for user input on /manifest. Send a manifest to the Coordinator using [marblerun manifest set] to start.
3 accepting marble: The Coordinator is running, you can add marbles to the mesh or update the manifest using [marblerun manifest update].
marblerun status <IP:PORT> [flags]
Options
-h, --help help for status
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun recover
Recover the MarbleRun Coordinator from a sealed state
Synopsis
Recover the MarbleRun Coordinator from a sealed state
marblerun recover <recovery_key_decrypted> <IP:PORT> [flags]
Examples
marblerun recover recovery_key_decrypted $MARBLERUN
Options
-h, --help help for recover
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun package-info
Print the package signature properties of an enclave
Synopsis
Print the package signature properties of an enclave
marblerun package-info [flags]
Options
-h, --help help for package-info
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file
marblerun version
Display version of this CLI and (if running) the MarbleRun Coordinator
Synopsis
Display version of this CLI and (if running) the MarbleRun Coordinator
marblerun version [flags]
Options
-h, --help help for version
Options inherited from parent commands
--accepted-tcb-statuses strings Comma-separated list of user accepted TCB statuses (default [UpToDate,SWHardeningNeeded])
--coordinator-cert string Path to MarbleRun Coordinator's root certificate to use for TLS connections (default "$HOME/.config/marblerun/coordinator-cert.pem")
--era-config string Path to a remote-attestation config file in JSON format. If none is provided, the command attempts to use './coordinator-era.json'. If that does not exist, the command will attempt to load a matching config file from the MarbleRun GitHub repository
-i, --insecure Set to skip quote verification, needed when running in simulation mode
-n, --namespace string Kubernetes namespace of the MarbleRun installation (default "marblerun")
--nonce string (Optional) nonce to use for quote verification. If set, the Coordinator will generate a quote over sha256(CoordinatorCert + nonce)
--save-sgx-quote string If set, save the Coordinator's SGX quote to the specified file