Kubernetes Operations

This page lists the available commands for the keymanager-k8s script. Additionally, it provides details for commonly used commands.

The keymanager-k8s script, created by the installer, runs all post-installation tasks. It offers the same command set as the Docker installer's keymanager CLI.

Commands

Command	Purpose
status	Show pod status and health checks
services	Toggle optional services (MCP, Discovery, Compliance, KMIP)
add-tsb	Onboard an additional on-prem TSB instance
tls-rotate	Re-create the self-signed TLS key and certificate of the Key Manager UI and restart the gateway
uninstall	Remove the Helm releases, Secrets, and persistent volumes (chart archives are kept; --purge removes them too)
start / stop	Scale the stack up / down (replica counts are preserved)
logs <svc>	View service logs, all services or a specific one
restart [svc]	Restart services, all or a specific one
update	Pull the pinned chart and upgrade in place
check-updates	Compare the running chart with what is published
self-update	Update the keymanager script itself to the latest version
version	Show chart, app, and running image versions
help	Show the help message

tls-rotate accepts --cn <common-name> and --san <dns1,ip1,...>. Without flags, it prompts for the common name and the subject alternative names.

warning

Restarting the auth service seals the KMS. This applies to keymanager-k8s restart, keymanager-k8s restart auth, and keymanager-k8s update. Unseal the instance via /unseal.

Status

keymanager-k8s status reports the pod states followed by the service health checks. The same report is available as ./install_k8s.sh status.

Logs

Pass a service name to narrow the output to the component you are investigating:

keymanager-k8s logs auth         # authentication requests and activity
keymanager-k8s logs kmip-server  # KMIP Server, its own Helm release

Without a service name, the command lists the available services.

Stop and Start

keymanager-k8s stop scales all deployments to zero replicas; data in persistent volumes and Secrets is untouched. keymanager-k8s start restores the previous replica counts.

Updates

Run keymanager-k8s check-updates to see whether a newer chart is published, then keymanager-k8s update to upgrade the deployment in place. After the update, you should:

1. Check pod status
2. Unseal the KMS
3. Verify the gateway and key workflows

keymanager-k8s self-update updates the script itself and does not touch the running stack.

Uninstall

keymanager-k8s uninstall removes the Helm releases, Secrets, and persistent volumes. The KMS UI keeps all state in HSM data objects (nothing is stored in cluster volumes). These objects are not deleted by keymanager-k8s uninstall. Therefore, the KMS UI can be reinstalled without data loss, as long as you connect it to the same Base Partition.

danger

If you manually delete the objects storing the KMS state from the Base Partition via an API (REST, JCE, PKCS#11, ...), the KMS needs to be reinstalled from scratch.