kibo egress

本页列出 kibo egress 及其子命令的用法、示例与参数，由 kibo 的源码生成；说明文字与 kibo --help 相同，为英文。

Create and manage caller-owned SOCKS5 Egresses.

本页的每个命令还接受全局参数 --endpoint、--json 与 --timeout，见 kibo CLI 参考。

An Egress is a SOCKS5 endpoint you operate. A public-internet network policy references it with destinations, and new TCP connections to those destinations leave through it instead of leaving directly; see kibo workspace network set. One Egress can serve many Workspaces.

子命令：

• kibo egress annotations: Replace or clear the annotations of a Egress
• kibo egress create: Create a SOCKS5 Egress
• kibo egress delete: Delete an Egress no Workspace references
• kibo egress get: Get an Egress
• kibo egress labels: Replace or clear the labels of a Egress
• kibo egress list: List Egresses
• kibo egress update: Replace the endpoint, credentials, TLS and UDP settings of an Egress

kibo egress annotations复制标题链接

Replace or clear the annotations of a Egress.

子命令：

• kibo egress annotations clear: Remove all annotations of a Egress
• kibo egress annotations set: Replace all annotations of a Egress

kibo egress annotations clear复制标题链接

Replaces the annotations of a Egress with an empty map.

Submitting the annotations already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo egress annotations clear <egress-id> [flags]

kibo egress annotations set复制标题链接

Replaces the complete annotations of a Egress with the given key=value pairs. Keys not named are removed; nothing is merged. Use "egress annotations clear" to remove every annotation.

Submitting the annotations already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo egress annotations set <egress-id> <key=value>... [flags]

kibo egress create复制标题链接

Creates an Egress at revision 1. Reference it from a Workspace with kibo workspace network set --egress <id> --egress-destination <cidr>.

--address is the SOCKS5 endpoint, host:port. Each forwarded connection is requested with CONNECT to the address the guest dialed. An endpoint written as an address in a private, local or platform range, or a hostname resolving into one, is refused; the endpoint is checked again on every dial.

--username needs a password and the password needs --username: the endpoint then authenticates both (RFC 1929, each 1 to 255 bytes). The password is read from --password-stdin, --password-file, or a no-echo prompt on a terminal; it has no flag of its own. It is write-only: no read, list or output shows it.

--tls, --tls-server-name or --tls-ca-cert-file run the negotiation and the forwarded traffic inside TLS. The certificate is verified against the system trust roots, or only against --tls-ca-cert-file (PEM, at most 64 KiB) when given, and against --tls-server-name, by default the host of --address.

Destinations forward TCP only. --udp also lets a policy that references the Egress send the queries of a udp Resolver through it, carried with UDP ASSOCIATE; the datagrams travel in clear text to the relay address the endpoint answers, even with --tls. Without --udp such a policy is refused, and while one exists an update without --udp is refused. The server must advertise workspace.network_policy.egress.socks5.

kibo egress create [flags]

示例：

kibo egress create --address proxy.example.com:1080
kibo egress create --address proxy.example.com:1080 --username alice --password-file ./proxy-password
kibo egress create --address 203.0.113.10:1080 --tls --tls-server-name proxy.example.com --tls-ca-cert-file ./proxy-ca.pem
kibo egress create --address proxy.example.com:1080 --udp

kibo egress delete复制标题链接

Deletes an Egress. While the network policy of any Workspace that is not deleted references it, the server refuses (exit 13); remove the reference first with kibo workspace network remove <workspace-id> --egress <id>. Connections still draining through the Egress are closed at once.

kibo egress delete <egress-id> [flags]

也可以写作 kibo egress rm。

kibo egress get复制标题链接

Get an Egress.

kibo egress get <egress-id> [flags]

kibo egress labels复制标题链接

Replace or clear the labels of a Egress.

子命令：

• kibo egress labels clear: Remove all labels of a Egress
• kibo egress labels set: Replace all labels of a Egress

kibo egress labels clear复制标题链接

Replaces the labels of a Egress with an empty map.

Submitting the labels already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo egress labels clear <egress-id> [flags]

kibo egress labels set复制标题链接

Replaces the complete labels of a Egress with the given key=value pairs. Keys not named are removed; nothing is merged. Use "egress labels clear" to remove every label.

Submitting the labels already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo egress labels set <egress-id> <key=value>... [flags]

kibo egress list复制标题链接

List Egresses.

kibo egress list [flags]

也可以写作 kibo egress ls。

示例：

kibo egress list --label team=infra

kibo egress update复制标题链接

Replaces the whole spec of an Egress: a flag not given ends up empty, and the password must be given again, because it cannot be read back. Equal content keeps the revision; different content increments it.

The command returns once the change is stored. Each running Workspace that references the Egress then switches its new connections to the new revision, which kibo workspace get shows under Egress applied. Connections already established through the previous revision keep running for --drain-seconds (default 600, at most 3600, 0 closes them when the new revision takes over).

kibo reads the current revision and submits against it unless --expected-revision is given; a change that landed in between is refused (exit 13). With --command-id, also pass --expected-revision.

--address is the SOCKS5 endpoint, host:port. Each forwarded connection is requested with CONNECT to the address the guest dialed. An endpoint written as an address in a private, local or platform range, or a hostname resolving into one, is refused; the endpoint is checked again on every dial.

--username needs a password and the password needs --username: the endpoint then authenticates both (RFC 1929, each 1 to 255 bytes). The password is read from --password-stdin, --password-file, or a no-echo prompt on a terminal; it has no flag of its own. It is write-only: no read, list or output shows it.

--tls, --tls-server-name or --tls-ca-cert-file run the negotiation and the forwarded traffic inside TLS. The certificate is verified against the system trust roots, or only against --tls-ca-cert-file (PEM, at most 64 KiB) when given, and against --tls-server-name, by default the host of --address.

Destinations forward TCP only. --udp also lets a policy that references the Egress send the queries of a udp Resolver through it, carried with UDP ASSOCIATE; the datagrams travel in clear text to the relay address the endpoint answers, even with --tls. Without --udp such a policy is refused, and while one exists an update without --udp is refused. The server must advertise workspace.network_policy.egress.socks5.

kibo egress update <egress-id> [flags]

示例：

kibo egress update egr-01k6… --address proxy.example.com:1080 --username alice --password-stdin < ./proxy-password