kibo resolver

本页列出 kibo resolver 及其子命令的用法、示例与参数，由 kibo 的源码生成；说明文字与 kibo --help 相同，为英文。

Create and manage caller-chosen DNS Resolvers.

本页的每个命令还接受全局参数 --endpoint、--json 与 --timeout，见 kibo CLI 参考。

A Resolver is a DNS server you choose. A guest sends every DNS query to one address on its own link; a public-internet network policy that references a Resolver has those queries forwarded to it, directly from the host or through an Egress of the same policy, instead of to the deployment resolvers; see kibo workspace network set. One Resolver can serve many Workspaces.

子命令：

• kibo resolver annotations: Replace or clear the annotations of a Resolver
• kibo resolver create: Create a Resolver
• kibo resolver delete: Delete a Resolver no Workspace references
• kibo resolver get: Get a Resolver
• kibo resolver labels: Replace or clear the labels of a Resolver
• kibo resolver list: List Resolvers
• kibo resolver update: Replace the protocol and upstream of a Resolver

kibo resolver annotations复制标题链接

Replace or clear the annotations of a Resolver.

子命令：

• kibo resolver annotations clear: Remove all annotations of a Resolver
• kibo resolver annotations set: Replace all annotations of a Resolver

kibo resolver annotations clear复制标题链接

Replaces the annotations of a Resolver with an empty map.

Submitting the annotations already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo resolver annotations clear <resolver-id> [flags]

kibo resolver annotations set复制标题链接

Replaces the complete annotations of a Resolver with the given key=value pairs. Keys not named are removed; nothing is merged. Use "resolver annotations clear" to remove every annotation.

Submitting the annotations already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo resolver annotations set <resolver-id> <key=value>... [flags]

kibo resolver create复制标题链接

Creates a Resolver at revision 1. Reference it from a Workspace with kibo workspace network set --resolver <id> --resolver-path direct.

Exactly one of --udp, --tcp, --tls and --https gives the protocol and the upstream:

--udp, --tcp  an IP address or IP:port, port 53 by default; an IPv6
              address with a port goes in brackets. A hostname is refused.
              A udp Resolver sends the queries the guest makes over TCP to
              the same address over TCP.
--tls         DNS over TLS, host or host:port, port 853 by default.
--https       DNS over HTTPS with POST, https://host[:port]/path, port 443
              by default, without user information, query or fragment.

Write an IP address the way the server prints it: no leading zeros, IPv6 compressed and lowercase. The host of --tls and --https is also the name the upstream certificate is verified against with the system trust roots; for an IP address the certificate must carry that address.

A Resolver has no credential: every read shows its whole content, including the URL path. The server must advertise workspace.network_policy.resolver.

kibo resolver create [flags]

示例：

kibo resolver create --udp 192.0.2.53
kibo resolver create --tls dns.example.com
kibo resolver create --https https://dns.example.com/dns-query --label team=infra

kibo resolver delete复制标题链接

Deletes a Resolver. While the network policy of any Workspace that is not deleted references it, the server refuses (exit 13); remove the reference first with kibo workspace network remove <workspace-id> --resolver <id>.

kibo resolver delete <resolver-id> [flags]

也可以写作 kibo resolver rm。

kibo resolver get复制标题链接

Get a Resolver.

kibo resolver get <resolver-id> [flags]

kibo resolver labels复制标题链接

Replace or clear the labels of a Resolver.

子命令：

• kibo resolver labels clear: Remove all labels of a Resolver
• kibo resolver labels set: Replace all labels of a Resolver

kibo resolver labels clear复制标题链接

Replaces the labels of a Resolver with an empty map.

Submitting the labels already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo resolver labels clear <resolver-id> [flags]

kibo resolver labels set复制标题链接

Replaces the complete labels of a Resolver with the given key=value pairs. Keys not named are removed; nothing is merged. Use "resolver labels clear" to remove every label.

Submitting the labels already stored succeeds without changing anything. See kibo help command-ids for --command-id and --expected-revision.

kibo resolver labels set <resolver-id> <key=value>... [flags]

kibo resolver list复制标题链接

List Resolvers.

kibo resolver list [flags]

也可以写作 kibo resolver ls。

示例：

kibo resolver list --label team=infra

kibo resolver update复制标题链接

Replaces the whole spec of a Resolver. Equal content keeps the revision; different content increments it. While a Workspace sends queries to the Resolver directly, an upstream in a private, local or platform range, or a hostname resolving into one, is refused.

The command returns once the change is stored. Each running Workspace that references the Resolver then sends its new queries to the new revision, which kibo workspace get shows under Resolver applied. Queries already sent complete against the previous revision.

kibo reads the current revision and submits against it unless --expected-revision is given; a change that landed in between is refused (exit 13). With --command-id, also pass --expected-revision.

Exactly one of --udp, --tcp, --tls and --https gives the protocol and the upstream:

--udp, --tcp  an IP address or IP:port, port 53 by default; an IPv6
              address with a port goes in brackets. A hostname is refused.
              A udp Resolver sends the queries the guest makes over TCP to
              the same address over TCP.
--tls         DNS over TLS, host or host:port, port 853 by default.
--https       DNS over HTTPS with POST, https://host[:port]/path, port 443
              by default, without user information, query or fragment.

Write an IP address the way the server prints it: no leading zeros, IPv6 compressed and lowercase. The host of --tls and --https is also the name the upstream certificate is verified against with the system trust roots; for an IP address the certificate must carry that address.

A Resolver has no credential: every read shows its whole content, including the URL path. The server must advertise workspace.network_policy.resolver.

kibo resolver update <resolver-id> [flags]

示例：

kibo resolver update rsv-01k6… --https https://dns.example.com/dns-query