Reference

CLI · sihactl

The operator CLI. Everything you do to a SiHA node goes through it, over mTLS.

sihactl is the only way in. The appliance has no shell; the CLI talks to apid on :6443 and authenticates with a client certificate.

sihactl --addr <node-ip>:6443 --pki-dir <pki-dir> <command>

A common shortcut is to alias the connection prefix:

S="sihactl --addr 192.168.5.10:6443 --pki-dir pki"
$S health

Resources (generic verbs)

CRUD is type-agnostic: the same four verbs work on every resource type, resolved through the runtime. Short aliases (if, acl, natlb, …) and -o yaml are supported.

$S get interfaces              # list interfaces (table)
$S get acl edge-in -o yaml     # one resource as YAML
$S edit interface ext          # open in $EDITOR, apply on save
$S watch interfaces            # stream changes
$S delete acl edge-in          # remove a resource
$S get rd                      # list every resource type served

Controller-owned status types are read-only — the server rejects writes to them.

Scaffold a resource

Don’t hand-write manifests from memory. generate rd prints a blank skeleton — every spec field, no values, with enum hints — for any type. It runs offline (no node connection) off the compiled-in type catalogue.

sihactl generate rd interface       # skeleton for one type
sihactl gen rd acl                  # short alias
sihactl gen rd > all-types.yaml     # every writable type, multi-doc
sihactl gen rd acl | $EDITOR -       # fill in, then apply

Example (sihactl gen rd acl):

type: ACLs.acl.siha
metadata:
  namespace: acl
  id: "" # resource id (singletons use "default")
spec:
  family: "" # one of: ipv4 | ipv6 | dual
  defaultAction: "" # one of: accept | drop | accept_stateful
  rules:
    - action: "" # one of: accept | drop | accept_stateful
      protocol: 0
      sourceCidr: ""
      destinationCidr: ""
      destinationPortFirst: 0
      destinationPortLast: 0

Config bundles

Apply and manage whole directories of manifests, with cross-resource validation and full history.

$S config validate -f siha-config/   # dry-run + cross-resource checks
$S config apply -f siha-config/       # apply the bundle
$S config history                     # list checkpoints
$S config diff <a> <b>                # diff two checkpoints
$S config save "before-bgp"           # named checkpoint
$S config rollback <checkpoint>       # revert to a checkpoint

Dataplane inspection

$S vpp cli "show interface"           # run a raw vppctl command
$S vpp routes                         # the VPP FIB
$S vpp neighbors                      # ARP / ND table
$S vpp capture -i ext -f "tcp port 80"  # COSI-bound packet capture

vpp capture only spans interfaces declared as Interface resources — it resolves each -i <id> against runtime state. The span is a physical-port mirror: it never decapsulates, so use a -f filter to narrow.

Health, metrics & lifecycle

$S health                    # node health summary
$S version                   # build + image version
$S perf show                 # a snapshot of live metrics
$S perf watch --id=ext       # stream metrics for a selector
$S upgrade <svc> --binary bin/<svc>   # hot-swap a daemon (debug image)
$S web                       # serve the embedded read-only UI

PKI (host-side)

PKI helpers run locally — no gRPC involved — to bootstrap and inspect the mTLS bundle a node trusts.

sihactl pki bootstrap        # generate the CA + admin/client certs
sihactl pki fingerprint      # print the CA fingerprint

Not sure a type exists? sihactl get rd is the source of truth — it lists every resource type, its aliases, and its columns straight from the node.