Installation The KES server and CLI is available as a single binary, container image or can be build from source. Binary Downloads Binary Releases

Overview Displays information about an identity on the KES server. The output resembles the following: Identity 3ecfcdf38fcbe141ae26a1030f81e96b753365a46760ae6b578698a97c59fd22 Created At 2023-02-15 07:59:37 Role Admin Syntax kes identity info \ [--color <string>] \ [<identity>] \ [--insecure, -k] \ [--json] Parameters --color Optional

Overview Add a new secret to use on the KES server. Syntax kes secrete create \ <name> \ <value> \ [--file <path>] \ [--insecure, -e] Parameters name Required

Overview Display a list of secrets on the KES server. You can display a list of all secrets or a list that match a specific pattern. Syntax kes secret ls \ [--color <string>] \ [--insecure, -k] \ [--json] \ [<'pattern'>] Parameters --color Optional

Key Manager is a distributed keystore and supports scaling through adding new key manager nodes to an existing deployment. For Linux deployments, scaling requires deploying Key Manager on the new nodes and adding them using CLI commands. For Kubernetes deployments, scaling requires changing the number of replicas.

Overview Display the status of the KES server. Syntax kes status \ [--api] \ [--color <string>] \ [--insecure, -k] \ [--json] \ [--short, -s] Parameters --api List all server APIs.

ToDo: Document exporting the key database, HSMs, etc. May also need scaffolding for K8s vs Linux

Overview Encrypt the contents of a plaintext data encryption key with a key. The plaintext value of a data encryption key can be used to encrypt or decrypt data. Avoid storing the plaintext on disk, as it allows decryption of data without requiring access to the Secret key used to generate the DEK. Syntax kes key encrypt \ <name> \ <message> \ [--insecure,-k] Parameters name Required

You can configure workflows to run on a schedule or to run when certain events happen.

Command deprecated The kes identity ls command has been deprecated as of KES release 2024-06-17T15-47-05Z. Use kes ls instead. Overview Outputs a list of policies on the KES server.