kibo egress
Create and manage caller-owned SOCKS5 Egresses. This page lists the usage, examples, and flags of kibo egress and its subcommands, generated from the kibo source code.
Every command on this page also takes the global flags --endpoint, --json, and --timeout. See CLI reference for kibo.
An Egress is a SOCKS5 endpoint you operate. A public-internet network policy references it with destinations, and new TCP connections to those destinations leave through it instead of leaving directly; see kibo workspace network set. One Egress can serve many Workspaces.
Subcommands:
kibo egress annotations: Replace or clear the annotations of a Egresskibo egress create: Create a SOCKS5 Egresskibo egress delete: Delete an Egress no Workspace referenceskibo egress get: Get an Egresskibo egress labels: Replace or clear the labels of a Egresskibo egress list: List Egresseskibo egress update: Replace the endpoint, credentials, TLS and UDP settings of an Egress
kibo egress annotations
Replace or clear the annotations of a Egress.
Subcommands:
kibo egress annotations clear: Remove all annotations of a Egresskibo egress annotations set: Replace all annotations of a Egress
kibo egress annotations clear
Replaces the annotations of a Egress with an empty map.
Submitting the annotations already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.
kibo egress annotations clear <egress-id> [flags]| Flag | Default | Description |
|---|---|---|
--command-id <key> | idempotency key for this change; see kibo help command-ids | |
--expected-revision <revision> | annotations revision the command is submitted against; read from the server when omitted |
kibo egress annotations set
Replaces the complete annotations of a Egress with the given key=value pairs. Keys not named are removed; nothing is merged. Use "egress annotations clear" to remove every annotation.
Submitting the annotations already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.
kibo egress annotations set <egress-id> <key=value>... [flags]| Flag | Default | Description |
|---|---|---|
--command-id <key> | idempotency key for this change; see kibo help command-ids | |
--expected-revision <revision> | annotations revision the command is submitted against; read from the server when omitted |
kibo egress create
Creates an Egress at revision 1. Reference it from a Workspace with kibo workspace network set --egress <id> --egress-destination <cidr>.
--address is the SOCKS5 endpoint, host:port. Each forwarded connection is requested with CONNECT to the address the guest dialed. An endpoint written as an address in a private, local or platform range, or a hostname resolving into one, is refused; the endpoint is checked again on every dial.
--username needs a password and the password needs --username: the endpoint then authenticates both (RFC 1929, each 1 to 255 bytes). The password is read from --password-stdin, --password-file, or a no-echo prompt on a terminal; it has no flag of its own. It is write-only: no read, list or output shows it.
--tls, --tls-server-name or --tls-ca-cert-file run the negotiation and the forwarded traffic inside TLS. The certificate is verified against the system trust roots, or only against --tls-ca-cert-file (PEM, at most 64 KiB) when given, and against --tls-server-name, by default the host of --address.
Destinations forward TCP only. --udp also lets a policy that references the Egress send the queries of a udp Resolver through it, carried with UDP ASSOCIATE; the datagrams travel in clear text to the relay address the endpoint answers, even with --tls. Without --udp such a policy is refused, and while one exists an update without --udp is refused. The server must advertise workspace.network_policy.egress.socks5.
kibo egress create [flags]Examples:
kibo egress create --address proxy.example.com:1080
kibo egress create --address proxy.example.com:1080 --username alice --password-file ./proxy-password
kibo egress create --address 203.0.113.10:1080 --tls --tls-server-name proxy.example.com --tls-ca-cert-file ./proxy-ca.pem
kibo egress create --address proxy.example.com:1080 --udp| Flag | Default | Description |
|---|---|---|
--address <host:port> | Required | SOCKS5 endpoint as host:port; host is an IP address or a hostname |
--annotation <key=value> | annotation key=value; stored as given and never selectable (repeatable) | |
--command-id <key> | idempotency key for this change; see kibo help command-ids | |
--label <key=value> | label key=value; selectable with list --label (repeatable) | |
--password-file <path> | read the SOCKS5 password from the file at path | |
--password-stdin | read the SOCKS5 password from stdin | |
-q, --quiet | print only the IDs of the resources in the result | |
--tls | run the SOCKS5 negotiation and the forwarded traffic inside TLS | |
--tls-ca-cert-file <path> | PEM file at path whose certificates replace the system trust roots for this endpoint; implies --tls | |
--tls-server-name <name> | name sent as SNI and verified against the endpoint certificate; implies --tls; the host of --address when omitted | |
--udp | let a policy that references this Egress send the queries of a udp Resolver through it with UDP ASSOCIATE | |
--username <username> | SOCKS5 username; the endpoint then also needs a password |
kibo egress delete
Deletes an Egress. While the network policy of any Workspace that is not deleted references it, the server refuses (exit 13); remove the reference first with kibo workspace network remove <workspace-id> --egress <id>. Connections still draining through the Egress are closed at once.
kibo egress delete <egress-id> [flags]Also available as kibo egress rm.
| Flag | Default | Description |
|---|---|---|
--command-id <key> | idempotency key for this change; see kibo help command-ids | |
-q, --quiet | print only the IDs of the resources in the result |
kibo egress get
Get an Egress.
kibo egress get <egress-id> [flags]| Flag | Default | Description |
|---|---|---|
-q, --quiet | print only the IDs of the resources in the result | |
--wide | show every field, including revisions and full digests |
kibo egress labels
Replace or clear the labels of a Egress.
Subcommands:
kibo egress labels clear: Remove all labels of a Egresskibo egress labels set: Replace all labels of a Egress
kibo egress labels clear
Replaces the labels of a Egress with an empty map.
Submitting the labels already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.
kibo egress labels clear <egress-id> [flags]| Flag | Default | Description |
|---|---|---|
--command-id <key> | idempotency key for this change; see kibo help command-ids | |
--expected-revision <revision> | labels revision the command is submitted against; read from the server when omitted |
kibo egress labels set
Replaces the complete labels of a Egress with the given key=value pairs. Keys not named are removed; nothing is merged. Use "egress labels clear" to remove every label.
Submitting the labels already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.
kibo egress labels set <egress-id> <key=value>... [flags]| Flag | Default | Description |
|---|---|---|
--command-id <key> | idempotency key for this change; see kibo help command-ids | |
--expected-revision <revision> | labels revision the command is submitted against; read from the server when omitted |
kibo egress list
List Egresses.
kibo egress list [flags]Also available as kibo egress ls.
Examples:
kibo egress list --label team=infra| Flag | Default | Description |
|---|---|---|
--all | read every page, not only the first | |
-l, --label <key=value> | only list resources whose label key has exactly this value; every entry must match (repeatable) | |
-L, --label-column <key> | show this label key as a column of its own (repeatable) | |
--page-size <number> | maximum number of results on a page | |
--page-token <token> | token from the Next line of the previous page | |
-q, --quiet | print only the IDs of the resources in the result | |
--wide | show every field, including revisions and full digests |
kibo egress update
Replaces the whole spec of an Egress: a flag not given ends up empty, and the password must be given again, because it cannot be read back. Equal content keeps the revision; different content increments it.
The command returns once the change is stored. Each running Workspace that references the Egress then switches its new connections to the new revision, which kibo workspace get shows under Egress applied. Connections already established through the previous revision keep running for --drain-seconds (default 600, at most 3600, 0 closes them when the new revision takes over).
kibo reads the current revision and submits against it unless --expected-revision is given; a change that landed in between is refused (exit 13). With --command-id, also pass --expected-revision.
--address is the SOCKS5 endpoint, host:port. Each forwarded connection is requested with CONNECT to the address the guest dialed. An endpoint written as an address in a private, local or platform range, or a hostname resolving into one, is refused; the endpoint is checked again on every dial.
--username needs a password and the password needs --username: the endpoint then authenticates both (RFC 1929, each 1 to 255 bytes). The password is read from --password-stdin, --password-file, or a no-echo prompt on a terminal; it has no flag of its own. It is write-only: no read, list or output shows it.
--tls, --tls-server-name or --tls-ca-cert-file run the negotiation and the forwarded traffic inside TLS. The certificate is verified against the system trust roots, or only against --tls-ca-cert-file (PEM, at most 64 KiB) when given, and against --tls-server-name, by default the host of --address.
Destinations forward TCP only. --udp also lets a policy that references the Egress send the queries of a udp Resolver through it, carried with UDP ASSOCIATE; the datagrams travel in clear text to the relay address the endpoint answers, even with --tls. Without --udp such a policy is refused, and while one exists an update without --udp is refused. The server must advertise workspace.network_policy.egress.socks5.
kibo egress update <egress-id> [flags]Examples:
kibo egress update egr-01k6… --address proxy.example.com:1080 --username alice --password-stdin < ./proxy-password| Flag | Default | Description |
|---|---|---|
--address <host:port> | Required | SOCKS5 endpoint as host:port; host is an IP address or a hostname |
--command-id <key> | idempotency key for this change; see kibo help command-ids | |
--drain-seconds <0> | how long connections established through the previous revision keep running before they are closed, 0 to 3600; the server default of 600 when omitted | |
--expected-revision <revision> | Egress revision the change is submitted against; read from the server when omitted | |
--password-file <path> | read the SOCKS5 password from the file at path | |
--password-stdin | read the SOCKS5 password from stdin | |
-q, --quiet | print only the IDs of the resources in the result | |
--tls | run the SOCKS5 negotiation and the forwarded traffic inside TLS | |
--tls-ca-cert-file <path> | PEM file at path whose certificates replace the system trust roots for this endpoint; implies --tls | |
--tls-server-name <name> | name sent as SNI and verified against the endpoint certificate; implies --tls; the host of --address when omitted | |
--udp | let a policy that references this Egress send the queries of a udp Resolver through it with UDP ASSOCIATE | |
--username <username> | SOCKS5 username; the endpoint then also needs a password |
kibo exit codes
This page lists the exit codes of kibo, generated from the kibo source code. With --json, the category of a failure is also in the error field of the output.
kibo exposure
Publish a port inside a Workspace as a public HTTPS URL. This page lists the usage, examples, and flags of kibo exposure and its subcommands, generated from the kibo source code.