Skip to content

vsatctl recover

Not supported for HSM-protected DEK

The vsatctl recover command is supported only for VSatellites using software-based DEK protection.

Recovery using the CLI or UI is not supported for HSM-protected DEK deployments.

vsatctl recover [flags]

Allows you to pass in the DEK, the passphrase, and the recovery code to restore lost VSatellites.

Note

You must run this command with root privileges because it connects to the VSatellite cluster using credentials from a file that only root users can access.

Examples

You'll copy the full command from the Recovery wizard in Certificate Manager - SaaS, because you need your unique recovery code. Be sure to edit the placeholder texts (in brackets[]) before running the command. 

sudo vsatctl recover \
  --dek [path/to/dek] \ 
  --passphrase [passphrase] \
  --recovery-code ********-*****-*****-*****-***************

Options

      --dek          string          Use to specify the path to where your backedup DEK key is stored.
      --passphrase   string          Passphrase to decrypt Data Encryption Key set payload.
      --recovery-code                Code you copy from the recovery wizard in Certificate Manager - SaaS.
      --skip-img-verify              Recover without enforcing image signature verification. The VSatellite starts in detection mode.
      -h, --help                     Help for recover.

Skip image signature verification

Recovered VSatellites enforce image signature verification by default. Use the --skip-img-verify flag to recover without enforcing it:

sudo vsatctl recover \
  --skip-img-verify \
  --dek [path/to/dek] \
  --passphrase [passphrase] \
  --recovery-code ********-*****-*****-*****-***************

The VSatellite starts in detection mode. Verification still runs and is logged, but no pods are blocked.

Important

Use this option only as a temporary workaround, and only when advised to. Detection mode leaves the VSatellite without the protection that image signature verification provides.

This setting persists across VSatellite updates. To turn enforcement back on, run vsatctl img-verify true.

For more information, see About image signature verification.

See also