kibo resolver

Create and manage caller-chosen DNS Resolvers. This page lists the usage, examples, and flags of kibo resolver and its subcommands, generated from the kibo source code.

Every command on this page also takes the global flags --endpoint, --json, and --timeout. See CLI reference for kibo.

A Resolver is a DNS server you choose. A guest sends every DNS query to one address on its own link; a public-internet network policy that references a Resolver has those queries forwarded to it, directly from the host or through an Egress of the same policy, instead of to the deployment resolvers; see kibo workspace network set. One Resolver can serve many Workspaces.

Subcommands:

• kibo resolver annotations: Replace or clear the annotations of a Resolver
• kibo resolver create: Create a Resolver
• kibo resolver delete: Delete a Resolver no Workspace references
• kibo resolver get: Get a Resolver
• kibo resolver labels: Replace or clear the labels of a Resolver
• kibo resolver list: List Resolvers
• kibo resolver update: Replace the protocol and upstream of a Resolver

kibo resolver annotationsCopy Anchor Link

Replace or clear the annotations of a Resolver.

Subcommands:

• kibo resolver annotations clear: Remove all annotations of a Resolver
• kibo resolver annotations set: Replace all annotations of a Resolver

kibo resolver annotations clearCopy Anchor Link

Replaces the annotations of a Resolver with an empty map.

Submitting the annotations already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo resolver annotations clear <resolver-id> [flags]

kibo resolver annotations setCopy Anchor Link

Replaces the complete annotations of a Resolver with the given key=value pairs. Keys not named are removed; nothing is merged. Use "resolver annotations clear" to remove every annotation.

Submitting the annotations already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo resolver annotations set <resolver-id> <key=value>... [flags]

kibo resolver createCopy Anchor Link

Creates a Resolver at revision 1. Reference it from a Workspace with kibo workspace network set --resolver <id> --resolver-path direct.

Exactly one of --udp, --tcp, --tls and --https gives the protocol and the upstream:

--udp, --tcp  an IP address or IP:port, port 53 by default; an IPv6
              address with a port goes in brackets. A hostname is refused.
              A udp Resolver sends the queries the guest makes over TCP to
              the same address over TCP.
--tls         DNS over TLS, host or host:port, port 853 by default.
--https       DNS over HTTPS with POST, https://host[:port]/path, port 443
              by default, without user information, query or fragment.

Write an IP address the way the server prints it: no leading zeros, IPv6 compressed and lowercase. The host of --tls and --https is also the name the upstream certificate is verified against with the system trust roots; for an IP address the certificate must carry that address.

A Resolver has no credential: every read shows its whole content, including the URL path. The server must advertise workspace.network_policy.resolver.

kibo resolver create [flags]

Examples:

kibo resolver create --udp 192.0.2.53
kibo resolver create --tls dns.example.com
kibo resolver create --https https://dns.example.com/dns-query --label team=infra

kibo resolver deleteCopy Anchor Link

Deletes a Resolver. While the network policy of any Workspace that is not deleted references it, the server refuses (exit 13); remove the reference first with kibo workspace network remove <workspace-id> --resolver <id>.

kibo resolver delete <resolver-id> [flags]

Also available as kibo resolver rm.

kibo resolver getCopy Anchor Link

Get a Resolver.

kibo resolver get <resolver-id> [flags]

kibo resolver labelsCopy Anchor Link

Replace or clear the labels of a Resolver.

Subcommands:

• kibo resolver labels clear: Remove all labels of a Resolver
• kibo resolver labels set: Replace all labels of a Resolver

kibo resolver labels clearCopy Anchor Link

Replaces the labels of a Resolver with an empty map.

Submitting the labels already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo resolver labels clear <resolver-id> [flags]

kibo resolver labels setCopy Anchor Link

Replaces the complete labels of a Resolver with the given key=value pairs. Keys not named are removed; nothing is merged. Use "resolver labels clear" to remove every label.

Submitting the labels already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo resolver labels set <resolver-id> <key=value>... [flags]

kibo resolver listCopy Anchor Link

List Resolvers.

kibo resolver list [flags]

Also available as kibo resolver ls.

Examples:

kibo resolver list --label team=infra

kibo resolver updateCopy Anchor Link

Replaces the whole spec of a Resolver. Equal content keeps the revision; different content increments it. While a Workspace sends queries to the Resolver directly, an upstream in a private, local or platform range, or a hostname resolving into one, is refused.

The command returns once the change is stored. Each running Workspace that references the Resolver then sends its new queries to the new revision, which kibo workspace get shows under Resolver applied. Queries already sent complete against the previous revision.

kibo reads the current revision and submits against it unless --expected-revision is given; a change that landed in between is refused (exit 13). With --command-id, also pass --expected-revision.

Exactly one of --udp, --tcp, --tls and --https gives the protocol and the upstream:

--udp, --tcp  an IP address or IP:port, port 53 by default; an IPv6
              address with a port goes in brackets. A hostname is refused.
              A udp Resolver sends the queries the guest makes over TCP to
              the same address over TCP.
--tls         DNS over TLS, host or host:port, port 853 by default.
--https       DNS over HTTPS with POST, https://host[:port]/path, port 443
              by default, without user information, query or fragment.

Write an IP address the way the server prints it: no leading zeros, IPv6 compressed and lowercase. The host of --tls and --https is also the name the upstream certificate is verified against with the system trust roots; for an IP address the certificate must carry that address.

A Resolver has no credential: every read shows its whole content, including the URL path. The server must advertise workspace.network_policy.resolver.

kibo resolver update <resolver-id> [flags]

Examples:

kibo resolver update rsv-01k6… --https https://dns.example.com/dns-query