Reference

CLI · sihactl

The operator CLI. Everything you do to a SiHA node goes through it, over mTLS.

sihactl is the only way in. The appliance has no shell; the CLI talks to apid on :6443 and authenticates with a client certificate. Your identity comes from a sihaconfig (~/.siha/config by default; see PKI below):

sihactl --sihaconfig ~/.siha/config --addr <node-ip>:6443 <command>

With a context active, --sihaconfig/--addr are optional (the context supplies both). A common shortcut is to alias the connection prefix:

S="sihactl --sihaconfig ~/.siha/config --addr 192.168.5.10:6443"
$S health

Command groups and maintenance mode

sihactl --help organises commands into seven groups: RESOURCES, CONFIG, OBSERVE, LIFECYCLE, NODE, ADOPTION & IDENTITY, and OTHER. Commands marked ✎ work before adoption (maintenance mode — before mTLS is up). Every other command requires a node that has been adopted:

✎ = works before adoption (maintenance mode). Everything else needs mTLS — run 'sihactl adopt' first.

Checking node state

sihactl status --addr <node-ip>:6443    # one-screen overview: adopted / maintenance / unreachable

status first probes with your mTLS identity, then falls back to the open maintenance channel — so it answers at any stage of the adoption lifecycle. Use it to confirm a node is adopted before running health or config apply.

Resources (generic verbs)

CRUD is type-agnostic: the same four verbs work on every resource type, resolved through the runtime. Short aliases (if, acl, natlb, …) and -o yaml are supported.

$S get interfaces              # list interfaces (table)
$S get acl edge-in -o yaml     # one resource as YAML
$S edit interface ext          # open in $EDITOR, apply on save
$S watch interfaces            # stream changes
$S delete acl edge-in          # remove a resource
$S get rd                      # list every resource type served

Controller-owned status types are read-only — the server rejects writes to them.

Config bundles

Apply and manage whole directories of manifests, with cross-resource validation and full history.

$S config validate -f siha-config/   # dry-run + cross-resource checks
$S config apply -f siha-config/       # apply the bundle
$S config history                     # list checkpoints
$S config diff <a> <b>                # diff two checkpoints
$S config save "before-bgp"           # named checkpoint
$S config rollback <checkpoint>       # revert to a checkpoint

Dataplane inspection

$S vpp cli "show interface"           # run a raw vppctl command
$S vpp routes                         # the VPP FIB
$S vpp neighbors                      # ARP / ND table
$S vpp capture -i ext -f "tcp port 80"  # COSI-bound packet capture

vpp capture only spans interfaces declared as Interface resources — it resolves each -i <id> against runtime state. The span is a physical-port mirror: it never decapsulates, so use a -f filter to narrow.

Health, metrics & lifecycle

$S health                    # node health summary
$S version                   # build + image version
$S perf show                 # a snapshot of live metrics
$S perf watch --id=ext       # stream metrics for a selector
$S upgrade <svc> --binary bin/<svc>   # hot-swap a daemon (debug image)
$S web                       # serve the embedded read-only UI

Identity & PKI (host-side)

Your fleet identity is two files (see Getting started): a secret (the CA root, for adoption) and a sihaconfig (your admin cert, for day-2). These run locally — no gRPC involved:

sihactl gen secret prod -o siha-secret.yaml          # mint the fleet CA → secret
sihactl gen context prod --secret siha-secret.yaml \ # derive an admin sihaconfig context
  --endpoint <node-ip>:6443
sihactl context use prod                             # switch the active context

Not sure a type exists? sihactl get rd is the source of truth — it lists every resource type, its aliases, and its columns straight from the node.