KEYLIME_TENANT(1)

📦
version 7.14.3 · 3 versions
, in centos-stream 10

💅 NAME 💅

okay bestie, so keylime_tenant — this is the Keylime tenant management tool, and it's your main character for agent provisioning and policy management ✨ Literally everything you need to boss around your agents lives here.

🌸 SYNOPSIS 🌸

keylime_tenant [OPTIONS] [COMMAND]
🫶 real talk: most operations require root privileges, so please use sudo. i'm not gonna say it again (i will).

🦋 DESCRIPTION 🦋

so keylime_tenant is the primary command-line interface for managing Keylime agents and policies, no cap. it lets you provision agents with TPM-based attestation, manage runtime policies, manage measured boot policies, and vibe with the Keylime registrar and verifier services 💖

the tenant can add, delete, update, and monitor agents — plus it handles all kinds of policies, including runtime policies (for IMA/EVM attestation) and measured boot policies (for boot-time attestation). it supports both push and pull models for agent communication, which is honestly iconic of it.

and the best part?? you can run keylime_tenant on the same system as the Keylime registrar or verifier, or on a totally separate system. your call, your setup 🎀

👑 COMMANDS 👑

  • -c, --command COMMAND — tells it which command to run. valid commands are:
    • add: add a new agent to the system (this is the default btw)
    • delete: remove an agent from the system
    • update: update an existing agent's configuration
    • regstatus: show agent status from registrar
    • cvstatus: show agent status from cloud verifier
    • status: show combined agent status
    • reglist: list all agents in registrar
    • cvlist: list all agents in cloud verifier
    • reactivate: reactivate a failed agent
    • regdelete: delete agent from registrar only
    • bulkinfo: get bulk information about agents
    • addruntimepolicy: add a runtime policy (requires --runtime-policy or --allowlist)
    • showruntimepolicy: display a runtime policy (requires --runtime-policy-name)
    • deleteruntimepolicy: remove a runtime policy (requires --runtime-policy-name)
    • updateruntimepolicy: update a runtime policy (requires --runtime-policy-name)
    • listruntimepolicy: list all runtime policies
    • addmbpolicy: add a measured boot policy (requires --mb-policy-name)
    • showmbpolicy: display a measured boot policy (requires --mb-policy-name)
    • deletembpolicy: remove a measured boot policy (requires --mb-policy-name)
    • updatembpolicy: update a measured boot policy (requires --mb-policy-name)
    • listmbpolicy: list all measured boot policies

✨ OPTIONS ✨

buckle up bestie, there's a lot, but every single one matters 💅

  • -h, --help — shows the help message and dips out
  • --push-model — enables the push model (avoids requests to keylime-agent)
  • -t, --targethost AGENT_IP — the IP address of the host to provision
  • -tp, --targetport AGENT_PORT — the port of the host to provision
  • -r, --registrarhost REGISTRAR_IP — the IP address of the registrar where to retrieve the agents data from
  • -rp, --registrarport REGISTRAR_PORT — the port of the registrar
  • --cv_targethost CV_AGENT_IP — the IP address of the host to provision that the verifier will use (optional). use this only if it's different than the argument to option -t/--targethost
  • -v, --cv VERIFIER_IP — the IP address of the cloud verifier
  • -vp, --cvport VERIFIER_PORT — the port of the cloud verifier
  • -vi, --cvid VERIFIER_ID — the unique identifier of a cloud verifier
  • -nvc, --no-verifier-check — disables the check that confirms whether the agent is being processed by the specified verifier. only use this with -c/--command delete or reactivate ⚠️
  • -u, --uuid AGENT_UUID — UUID for the agent to provision
  • -f, --file FILE — delivers the specified plaintext file to the provisioned agent
  • --cert CA_DIR — create and deliver a certificate using a CA created by ca-util. pass in the CA directory, or use "default" to use the standard directory
  • -k, --key KEYFILE — an intermediate key file produced by user_data_encrypt
  • -p, --payload PAYLOAD — specifies the encrypted payload to deliver with encrypted keys specified by -k
  • --include INCL_DIR — includes additional files in the provided directory in the certificate zip file. must be specified with --cert
  • --runtime-policy RUNTIME_POLICY — specifies the file path of a runtime policy
  • --runtime-policy-checksum RUNTIME_POLICY_CHECKSUM — specifies the SHA-256 checksum of a runtime policy
  • --runtime-policy-sig-key RUNTIME_POLICY_SIG_KEY — specifies the public key file used to validate the runtime policy signature
  • --runtime-policy-url RUNTIME_POLICY_URL — specifies the URL of a remote runtime policy
  • --runtime-policy-name RUNTIME_POLICY_NAME — the name of the runtime policy to operate with
  • --mb-policy MB_POLICY — the measured boot policy to operate with
  • --mb-policy-name MB_POLICY_NAME — the name of the measured boot policy to operate with
  • --tpm_policy TPM_POLICY — specifies a TPM policy in JSON format. example: {"15":"0000000000000000000000000000000000000000"}
  • --verify — blocks on cryptographically checked key derivation confirmation from the agent once it's been provisioned
  • --supported-version SUPPORTED_VERSION — the API version that's supported by the agent. detected automatically by default 🪄

💀 DEPRECATED OPTIONS 💀

🚨 heads up bestie: these are deprecated and may be removed in future versions. they still work (for now) but the glow-up is real and you should migrate.
  • --allowlist ALLOWLIST — DEPRECATED: migrate to runtime policies for continued functionality. specifies the file path of an allowlist
  • --allowlist-url ALLOWLIST_URL — DEPRECATED: migrate to runtime policies for continued functionality. specifies the URL of a remote allowlist
  • --allowlist-name ALLOWLIST_NAME — DEPRECATED: migrate to runtime policies for continued functionality. the name of the allowlist to operate with
  • --exclude IMA_EXCLUDE — DEPRECATED: migrate to runtime policies for continued functionality. specifies the location of an IMA exclude list
  • --mb_refstate MB_POLICY — DEPRECATED: use --mb-policy instead. specifies the location of a measured boot reference state
  • --signature-verification-key IMA_SIGN_VERIFICATION_KEYS — DEPRECATED: provide verification keys as part of a runtime policy for continued functionality. specifies an IMA file signature verification key

🌈 EXAMPLES 🌈

add a new agent:

sudo keylime_tenant -c add -t 192.168.1.100 -u agent-001

add an agent with a runtime policy:

sudo keylime_tenant -c add -t 192.168.1.100 -u agent-001 --runtime-policy /path/to/policy.json

check agent status:

sudo keylime_tenant -c status -u agent-001

delete an agent:

sudo keylime_tenant -c delete -u agent-001

list all agents:

sudo keylime_tenant -c cvlist

add a runtime policy:

sudo keylime_tenant -c addruntimepolicy --runtime-policy-name my-policy --runtime-policy /path/to/policy.json

add a measured boot policy:

sudo keylime_tenant -c addmbpolicy --mb-policy-name my-mb-policy --mb-policy /path/to/mb-policy.json

provision an agent with certificate delivery:

sudo keylime_tenant -c add -t 192.168.1.100 -u agent-001 --cert default

provision an agent with a custom verifier:

sudo keylime_tenant -c add -t 192.168.1.100 -u agent-001 -v 192.168.1.200 -vp 8881

🎀 FILES 🎀

  • /etc/keylime/tenant.conf — the default configuration file for keylime_tenant. it contains all tenant-related settings, so like... everything you need in one place 🫶

🧚 PREREQUISITES 🧚

before you go off and do the thing, make sure you've got:

  • Keylime verifier service running (default: 127.0.0.1:8881)
  • Keylime registrar service running (default: 127.0.0.1:8891)
  • root privileges (use sudo — yes, again)
  • network connectivity to the registrar and verifier services
  • valid TLS configuration in /etc/keylime/tenant.conf

🔥 SEE ALSO 🔥

keylime_verifier(8), keylime_registrar(8), keylime_agent(8)

for more info about Keylime, visit: https://keylime.dev 🌐

🙈 BUGS 🙈

found something cursed? report bugs to the Keylime project at: https://github.com/keylime/keylime/issues — they wanna know, fr fr.

⭐ AUTHOR ⭐

Keylime Developers — absolute legends 👑

mwah 💋 that's the whole page bestie — KEYLIME_TENANT(1) straight outta the General Commands Manual, dated July 2025. go provision something iconic 🦋✨

📦 where this page comes from