Skip to main content
Version: 2.22

CLI reference

Use the Constellation CLI to create and manage your clusters.

Usage:

constellation [command]

Commands:

  • config: Work with the Constellation configuration file
    • generate: Generate a default configuration and state file
    • fetch-measurements: Fetch measurements for configured cloud provider and image
    • instance-types: Print the supported instance types for all cloud providers
    • kubernetes-versions: Print the Kubernetes versions supported by this CLI
    • migrate: Migrate a configuration file to a new version
  • create: Create instances on a cloud platform for your Constellation cluster
  • apply: Apply a configuration to a Constellation cluster
  • mini: Manage MiniConstellation clusters
    • up: Create and initialize a new MiniConstellation cluster
    • down: Destroy a MiniConstellation cluster
  • status: Show status of a Constellation cluster
  • verify: Verify the confidential properties of a Constellation cluster
  • upgrade: Find and apply upgrades to your Constellation cluster
    • check: Check for possible upgrades
    • apply: Apply an upgrade to a Constellation cluster
  • recover: Recover a completely stopped Constellation cluster
  • terminate: Terminate a Constellation cluster
  • iam: Work with the IAM configuration on your cloud provider
    • create: Create IAM configuration on a cloud platform for your Constellation cluster
      • aws: Create IAM configuration on AWS for your Constellation cluster
      • azure: Create IAM configuration on Microsoft Azure for your Constellation cluster
      • gcp: Create IAM configuration on GCP for your Constellation cluster
    • destroy: Destroy an IAM configuration and delete local Terraform files
    • upgrade: Find and apply upgrades to your IAM profile
      • apply: Apply an upgrade to an IAM profile
  • version: Display version of this CLI
  • init: Initialize the Constellation cluster
  • ssh: Generate a certificate for emergency SSH access

constellation config​

Work with the Constellation configuration file

Synopsis​

Work with the Constellation configuration file.

Options​

  -h, --help   help for config

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation config generate​

Generate a default configuration and state file

Synopsis​

Generate a default configuration and state file for your selected cloud provider.

constellation config generate {aws|azure|gcp|openstack|qemu|stackit} [flags]

Options​

  -a, --attestation string   attestation variant to use {aws-sev-snp|aws-nitro-tpm|azure-sev-snp|azure-tdx|azure-trustedlaunch|gcp-sev-snp|gcp-sev-es|qemu-vtpm}. If not specified, the default for the cloud provider is used
  -h, --help                 help for generate
  -k, --kubernetes string    Kubernetes version to use in format MAJOR.MINOR (default "v1.30")
  -t, --tags strings         additional tags for created resources given a list of key=value

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation config fetch-measurements​

Fetch measurements for configured cloud provider and image

Synopsis​

Fetch measurements for configured cloud provider and image.

A config needs to be generated first.

constellation config fetch-measurements [flags]

Options​

  -h, --help                   help for fetch-measurements
  -s, --signature-url string   alternative URL to fetch measurements' signature from
  -u, --url string             alternative URL to fetch measurements from

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation config instance-types​

Print the supported instance types for all cloud providers

Synopsis​

Print the supported instance types for all cloud providers.

constellation config instance-types [flags]

Options​

  -h, --help   help for instance-types

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation config kubernetes-versions​

Print the Kubernetes versions supported by this CLI

Synopsis​

Print the Kubernetes versions supported by this CLI.

constellation config kubernetes-versions [flags]

Options​

  -h, --help   help for kubernetes-versions

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation config migrate​

Migrate a configuration file to a new version

Synopsis​

Migrate a configuration file to a new version.

constellation config migrate [flags]

Options​

  -h, --help   help for migrate

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation create​

Create instances on a cloud platform for your Constellation cluster

Synopsis​

Create instances on a cloud platform for your Constellation cluster.

constellation create [flags]

Options​

  -h, --help   help for create
  -y, --yes    create the cluster without further confirmation

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation apply​

Apply a configuration to a Constellation cluster

Synopsis​

Apply a configuration to a Constellation cluster to initialize or upgrade the cluster.

constellation apply [flags]

Options​

      --conformance           enable conformance mode
  -h, --help                  help for apply
      --merge-kubeconfig      merge Constellation kubeconfig file with default kubeconfig file in $HOME/.kube/config
      --skip-helm-wait        install helm charts without waiting for deployments to be ready
      --skip-phases strings   comma-separated list of upgrade phases to skip
                              one or multiple of { infrastructure | init | attestationconfig | certsans | helm | image | k8s }
  -y, --yes                   run command without further confirmation
                              WARNING: the command might delete or update existing resources without additional checks. Please read the docs.

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation mini​

Manage MiniConstellation clusters

Synopsis​

Manage MiniConstellation clusters.

Options​

  -h, --help   help for mini

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation mini up​

Create and initialize a new MiniConstellation cluster

Synopsis​

Create and initialize a new MiniConstellation cluster.

A mini cluster consists of a single control-plane and worker node, hosted using QEMU/KVM.

constellation mini up [flags]

Options​

  -h, --help               help for up
      --merge-kubeconfig   merge Constellation kubeconfig file with default kubeconfig file in $HOME/.kube/config (default true)

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation mini down​

Destroy a MiniConstellation cluster

Synopsis​

Destroy a MiniConstellation cluster.

constellation mini down [flags]

Options​

  -h, --help   help for down
  -y, --yes    terminate the cluster without further confirmation

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation status​

Show status of a Constellation cluster

Synopsis​

Show the status of a constellation cluster.

Shows microservice, image, and Kubernetes versions installed in the cluster. Also shows status of current version upgrades.

constellation status [flags]

Options​

  -h, --help   help for status

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation verify​

Verify the confidential properties of a Constellation cluster

Synopsis​

Verify the confidential properties of a Constellation cluster. If arguments aren't specified, values are read from constellation-state.yaml.

constellation verify [flags]

Options​

      --cluster-id string      expected cluster identifier
  -h, --help                   help for verify
  -e, --node-endpoint string   endpoint of the node to verify, passed as HOST[:PORT]
  -o, --output string          print the attestation document in the output format {json|raw}

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation upgrade​

Find and apply upgrades to your Constellation cluster

Synopsis​

Find and apply upgrades to your Constellation cluster.

Options​

  -h, --help   help for upgrade

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation upgrade check​

Check for possible upgrades

Synopsis​

Check which upgrades can be applied to your Constellation Cluster.

constellation upgrade check [flags]

Options​

  -h, --help            help for check
      --ref string      the reference to use for querying new versions (default "-")
      --stream string   the stream to use for querying new versions (default "stable")
  -u, --update-config   update the specified config file with the suggested versions

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation upgrade apply​

Apply an upgrade to a Constellation cluster

Synopsis​

Apply an upgrade to a Constellation cluster by applying the chosen configuration.

constellation upgrade apply [flags]

Options​

      --conformance           enable conformance mode
  -h, --help                  help for apply
      --skip-helm-wait        install helm charts without waiting for deployments to be ready
      --skip-phases strings   comma-separated list of upgrade phases to skip
                              one or multiple of { infrastructure | helm | image | k8s }
  -y, --yes                   run upgrades without further confirmation
                              WARNING: might delete your resources in case you are using cert-manager in your cluster. Please read the docs.
                              WARNING: might unintentionally overwrite measurements in the running cluster.

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation recover​

Recover a completely stopped Constellation cluster

Synopsis​

Recover a Constellation cluster by sending a recovery key to an instance in the boot stage.

This is only required if instances restart without other instances available for bootstrapping.

constellation recover [flags]

Options​

  -e, --endpoint string   endpoint of the instance, passed as HOST[:PORT]
  -h, --help              help for recover

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation terminate​

Terminate a Constellation cluster

Synopsis​

Terminate a Constellation cluster.

The cluster can't be started again, and all persistent storage will be lost.

constellation terminate [flags]

Options​

  -h, --help   help for terminate
  -y, --yes    terminate the cluster without further confirmation

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation iam​

Work with the IAM configuration on your cloud provider

Synopsis​

Work with the IAM configuration on your cloud provider.

Options​

  -h, --help   help for iam

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation iam create​

Create IAM configuration on a cloud platform for your Constellation cluster

Synopsis​

Create IAM configuration on a cloud platform for your Constellation cluster.

Options​

  -h, --help            help for create
      --update-config   update the config file with the specific IAM information
  -y, --yes             create the IAM configuration without further confirmation

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation iam create aws​

Create IAM configuration on AWS for your Constellation cluster

Synopsis​

Create IAM configuration on AWS for your Constellation cluster.

constellation iam create aws [flags]

Options​

  -h, --help            help for aws
      --prefix string   name prefix for all resources (required)
      --zone string     AWS availability zone the resources will be created in, e.g., us-east-2a (required)
                        See the Constellation docs for a list of currently supported regions.

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
      --update-config      update the config file with the specific IAM information
  -C, --workspace string   path to the Constellation workspace
  -y, --yes                create the IAM configuration without further confirmation

constellation iam create azure​

Create IAM configuration on Microsoft Azure for your Constellation cluster

Synopsis​

Create IAM configuration on Microsoft Azure for your Constellation cluster.

constellation iam create azure [flags]

Options​

  -h, --help                      help for azure
      --region string             region the resources will be created in, e.g., westus (required)
      --resourceGroup string      name prefix of the two resource groups your cluster / IAM resources will be created in (required)
      --servicePrincipal string   name of the service principal that will be created (required)
      --subscriptionID string     subscription ID of the Azure account. Required if the 'ARM_SUBSCRIPTION_ID' environment variable is not set

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
      --update-config      update the config file with the specific IAM information
  -C, --workspace string   path to the Constellation workspace
  -y, --yes                create the IAM configuration without further confirmation

constellation iam create gcp​

Create IAM configuration on GCP for your Constellation cluster

Synopsis​

Create IAM configuration on GCP for your Constellation cluster.

constellation iam create gcp [flags]

Options​

  -h, --help               help for gcp
      --prefix string      Prefix for the service account ID and VM ID that will be created (required)
                           Must be letters, digits, or hyphens.
      --projectID string   ID of the GCP project the configuration will be created in (required)
                           Find it on the welcome screen of your project: https://console.cloud.google.com/welcome
      --zone string        GCP zone the cluster will be deployed in (required)
                           Find a list of available zones here: https://cloud.google.com/compute/docs/regions-zones#available

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
      --update-config      update the config file with the specific IAM information
  -C, --workspace string   path to the Constellation workspace
  -y, --yes                create the IAM configuration without further confirmation

constellation iam destroy​

Destroy an IAM configuration and delete local Terraform files

Synopsis​

Destroy an IAM configuration and delete local Terraform files.

constellation iam destroy [flags]

Options​

  -h, --help   help for destroy
  -y, --yes    destroy the IAM configuration without asking for confirmation

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation iam upgrade​

Find and apply upgrades to your IAM profile

Synopsis​

Find and apply upgrades to your IAM profile.

Options​

  -h, --help   help for upgrade

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation iam upgrade apply​

Apply an upgrade to an IAM profile

Synopsis​

Apply an upgrade to an IAM profile.

constellation iam upgrade apply [flags]

Options​

  -h, --help   help for apply
  -y, --yes    run upgrades without further confirmation

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation version​

Display version of this CLI

Synopsis​

Display version of this CLI.

constellation version [flags]

Options​

  -h, --help   help for version

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation init​

Initialize the Constellation cluster

Synopsis​

Initialize the Constellation cluster.

Start your confidential Kubernetes.

constellation init [flags]

Options​

      --conformance        enable conformance mode
  -h, --help               help for init
      --merge-kubeconfig   merge Constellation kubeconfig file with default kubeconfig file in $HOME/.kube/config
      --skip-helm-wait     install helm charts without waiting for deployments to be ready

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace

constellation ssh​

Generate a certificate for emergency SSH access

Synopsis​

Generate a certificate for emergency SSH access to your SSH-enabled constellation cluster.

constellation ssh [flags]

Options​

  -h, --help         help for ssh
      --key string   the path to an existing SSH public key

Options inherited from parent commands​

      --debug              enable debug logging
      --force              disable version compatibility checks - might result in corrupted clusters
      --tf-log string      Terraform log level (default "NONE")
  -C, --workspace string   path to the Constellation workspace