Overview Returns the identity of either an api key or a certificate. Syntax Return the identity from an api-key:

Overview Generate a new data encryption key (DEK) from a secret key on the KES server. The output of the command includes both a plaintext key and a ciphertext representation. The output resembles the following: plaintext: kk/+NxO1LHb9ilbai7B9qo60649zNPmSVuJ2akEJFQ4= ciphertext: lbFBRVMyNTYtR0NNX1NIQTI1NtkgMTRlYjE3YWVjMTBjZDMxYTZiYzAwNmJhODFkNjM1ODnEEKOclQFBMYNZ3dVJPCrldAHEDLkZD9YgLpFW77+8b8Qw7Tn/6tFhyYUoFzS4+jYv8ty/Y5bqKzU6lPUEq/O8xEnYs92wEyvdSfTpTDEH8a8Q To encrypt or decrypt the keys, use kes key encrypt or kes key decrypt.

Overview Assign a KES policy to identities. Syntax kes policy assign \ <policy> \ <identity> \ [--insecure, -k] Parameters policy The name of the policy to add to the identity.

Installation The KES server and CLI is available as a single binary, container image or can be build from source. Binary Downloads Binary Releases

Overview Displays information about an identity on the KES server. The output resembles the following: Identity 3ecfcdf38fcbe141ae26a1030f81e96b753365a46760ae6b578698a97c59fd22 Created At 2023-02-15 07:59:37 Role Admin Syntax kes identity info \ [--color <string>] \ [<identity>] \ [--insecure, -k] \ [--json] Parameters --color Optional

Overview Add a new secret to use on the KES server. Syntax kes secrete create \ <name> \ <value> \ [--file <path>] \ [--insecure, -e] Parameters name Required

Overview Display a list of secrets on the KES server. You can display a list of all secrets or a list that match a specific pattern. Syntax kes secret ls \ [--color <string>] \ [--insecure, -k] \ [--json] \ [<'pattern'>] Parameters --color Optional

Key Manager is a distributed keystore and supports scaling through adding new key manager nodes to an existing deployment. For Linux deployments, scaling requires deploying Key Manager on the new nodes and adding them using CLI commands. For Kubernetes deployments, scaling requires changing the number of replicas.

Overview Display the status of the KES server. Syntax kes status \ [--api] \ [--color <string>] \ [--insecure, -k] \ [--json] \ [--short, -s] Parameters --api List all server APIs.

ToDo: Document exporting the key database, HSMs, etc. May also need scaffolding for K8s vs Linux