CLI reference
Every kudurru command, its arguments and its flags.
One binary is the server, the supervisors and the client. The client verbs
talk to the REST API of a server chosen by --server or a context saved by
kudurru login; kudurru admin talks to the local admin socket instead. The
same text is available offline as kudurru <command> --help.
Global flags
Every command accepts these flags.
--ca-file string PEM bundle to trust for the API server
--cli-config string CLI contexts file (default $KUDURRU_CLI_CONFIG or
~/.config/kudurru/config.yaml)
--config string path to the server's kudurru.yaml (default
"/etc/kudurru/kudurru.yaml")
--context string CLI context to use (default: the current context, or
$KUDURRU_CONTEXT)
--insecure-skip-tls-verify do not verify the server's TLS certificate (lab use only)
-n, --namespace string namespace for namespaced kinds (default: the context's,
else "default")
-o, --output string output format: table, wide, json, yaml or name
--request-timeout duration timeout of each API request (default 30s)
--server string API server URL, e.g. https://dns.example (overrides the
context; env KUDURRU_SERVER)
--token string API token kdr_… (overrides the context; env KUDURRU_TOKEN)
kudurru admin
Break-glass operations over the server's unix socket (default /run/kudurru/kudurru.sock). They do not use the API or a token: the server admits root, its own user (65532 in the distroless image, which is what docker exec and kubectl exec get), or a configured group.
docker exec kudurru kudurru admin reset-password admin
kubectl exec -n dns deploy/kudurru -- kudurru admin create-token --expires-in 1h
Flags:
--protocol string socket protocol: auto, http or ndjson (default "auto")
--socket string admin socket path (default $KUDURRU_ADMIN_SOCKET or
/run/kudurru/kudurru.sock)
kudurru admin create-token
Mint an API token and print it once on stdout. Without --user the token belongs to the built-in break-glass service account and expires after 24h unless --expires-in says otherwise; with --user it is a personal token of that local user.
kudurru admin create-token [flags]
Flags:
--description string what the token is for
--expires-in string lifetime, e.g. 1h (default 24h for break-glass tokens)
--user string local user owning the token (default: the break-glass service account)
kudurru admin list-users
List local users.
kudurru admin list-users
kudurru admin reset-password
Set a local user's password and require a change at the next login. Without --password the server generates one and prints it once. The username defaults to the built-in admin; --create makes that account when it does not exist.
kudurru admin reset-password [username] [flags]
Flags:
--create create the user (as the built-in admin) when it does not exist
--password string new password (default: generated by the server)
--password-stdin read the new password from stdin
--revoke-tokens also revoke every API token of the user (a reset alone revokes
sessions, not tokens)
kudurru api
Send a raw request to the API (path relative to /api/v1).
kudurru api <method> <path> | api <path> [flags]
Examples:
kudurru api /version
kudurru api POST /cache/flush
kudurru api PATCH /settings --data '{"cache":{"maxEntries":200000}}'
kudurru api POST /apply --data @zones.json
Flags:
--content-type string Content-Type of the body (default application/json)
-d, --data string request body: inline text, @file, or @- for stdin
-H, --header stringArray extra header Name: value (repeatable)
kudurru apply
Create or update objects from manifests. Documents may be multi-document YAML, JSON objects, JSON arrays or a List. Every document is a whole object applied with manager "api" (POST /api/v1/apply); objects owned by a file or an integration are refused with "managed_by" and the owner.
kudurru apply -f file|dir|- [flags]
Examples:
kudurru apply -f zones.yaml
kudurru apply -f objects.d/ -R
cat lists.yaml | kudurru apply -f -
Flags:
-f, --filename stringArray file, directory or - for stdin (repeatable)
-R, --recursive descend into subdirectories of -f directories
kudurru audit
Show the audit log of API writes.
kudurru audit [flags]
Flags:
--actor string principal name
--kind string object kind
--limit int maximum entries (default 100)
--name string object name
--since string RFC 3339 time or a duration back from now (24h)
kudurru backup
Save every object (zones, record sets, lists, client groups, policies) as a multi-document YAML file. Status and server-set metadata are dropped so the file re-applies cleanly with kudurru restore -f. --safe redacts credentials embedded in URLs (user:password@ and token/key/secret query parameters) so the file can be shared; such a backup needs the secrets filled in before restore.
kudurru backup --out file.yaml [--safe] [flags]
Flags:
--exclude-managed skip objects owned by files or integrations
--out string file to write (- for stdout)
--safe redact credentials embedded in URLs
kudurru blocking
Show or toggle blocking.
kudurru blocking disable
Turn blocking off, indefinitely or for a duration (30s, 5m, 1h).
kudurru blocking disable [duration] [flags]
Flags:
--until string re-enable at this RFC 3339 time
kudurru blocking enable
Turn blocking on.
kudurru blocking enable
kudurru blocking status
Show whether blocking is on.
kudurru blocking status
kudurru cache
Manage the response cache.
kudurru cache flush
Flush the whole cache, or the entries of one name.
kudurru cache flush [name]
kudurru completion
Generate a shell completion script.
bash: source <(kudurru completion bash)
zsh: kudurru completion zsh > "${fpath[1]}/_kudurru"
fish: kudurru completion fish > ~/.config/fish/completions/kudurru.fish
powershell: kudurru completion powershell | Out-String | Invoke-Expression
kudurru completion bash|zsh|fish|powershell
kudurru config
Inspect the server configuration and manage CLI contexts.
kudurru config current-context
Print the current CLI context.
kudurru config current-context
kudurru config delete-context
Delete a CLI context and its stored token.
kudurru config delete-context <name>
kudurru config get-contexts
List the CLI contexts.
kudurru config get-contexts
kudurru config schema
List every settings key with its scope and flags.
kudurru config schema
kudurru config set-context
Create or change a CLI context without logging in.
kudurru config set-context <name> [--server URL] [--default-namespace ns] [flags]
Flags:
--default-namespace string default namespace of the context
kudurru config show
Print the effective configuration.
kudurru config show
kudurru config use-context
Switch the current CLI context.
kudurru config use-context <name>
kudurru delete
Delete objects by name or by manifest.
kudurru delete (<kind> <name...> | -f file|dir|-) [flags]
Examples:
kudurru delete zone lab-example-com
kudurru delete rrset web -n apps
kudurru delete -f zones.yaml
Flags:
-f, --filename stringArray file, directory or - naming the objects to delete
--ignore-not-found treat a missing object as deleted
-R, --recursive descend into subdirectories of -f directories
kudurru describe
Show an object's spec, status conditions and diagnoses.
kudurru describe <kind> <name>
kudurru doctor
Check the local configuration and environment, then the API server:
config the config file parses and validates
dataDir exists, is a directory, is writable, is not world-writable
ports every configured listener address can be bound (or is in use by
a running kudurru)
api the API server answers (the CLI context, --server, or the local
listeners.api.address)
token the CLI token is accepted (GET /auth/me)
diagnoses configuration diagnoses reported by the server (GET /info/messages)
vrrp warns when `kudurru vip run --legacy` renders keepalived without
auth_hmac (unauthenticated VRRP adverts); silent on nodes
without keepalived
Exits non-zero when a check fails.
kudurru doctor [flags]
Flags:
--keepalived-config kudurru vip run keepalived.conf rendered by kudurru vip run
(default "/etc/keepalived/keepalived.conf")
--skip-api do not contact the API server
--skip-ports do not test whether listener ports can be bound
--vip-run-dir kudurru vip run run directory shared with kudurru vip run
(legacy-mode marker) (default "/run/kudurru")
kudurru edge
dnsdist supervisor: render the configuration or run dnsdist (PID 1 of the kudurru-dnsdist image).
kudurru edge render
Print the dnsdist configuration the supervisor would run (credentials are random per call).
kudurru edge render [flags]
Flags:
--acl strings client prefixes allowed to query (default: private
and loopback ranges)
--api string dnsdist webserver/API address (loopback only)
(default "127.0.0.1:8083")
--api-key-group string group (name or gid) of the --api-key-out file,
e.g. keepalived_script; default unchanged
--api-key-out string write the per-start dnsdist API key here (0640),
e.g. /run/kudurru/dnsdist-api.key
--authoritative-cache cache the authoritative pool briefly and flush it
on zone serial changes
--authoritative-cache-ttl int max TTL (s) of the authoritative cache (default 30)
--authoritative-zones strings zones routed to the authoritative pool, in
addition to those polled from /internal/zones
--backend-port int kudurru DNS port for entries without a port and
EndpointSlices without the named port (default 5353)
--backend-port-name string EndpointSlice port name carrying DNS (default "dns")
--backends string static backends: comma-separated
[name=]host[:port] (port default --backend-port);
EVERY edge lists ALL kudurru nodes
--backends-from string membership source: static (from --backends) or
endpointslice:<namespace>/<service> (default "static")
--cache-size int resolver pool packet cache entries (default 200000)
--console string dnsdist console address (loopback only) (default
"127.0.0.1:5199")
--doh string enable the DoH frontend on host:port (the host
must be a --listen address; the chart's form);
with any of --dot/--doh/--doq/--doh3 the frontends
are do53 plus those given
--doh3 string enable the DoH3 frontend on host:port (the host
must be a --listen address; the chart's form);
with any of --dot/--doh/--doq/--doh3 the frontends
are do53 plus those given
--doq string enable the DoQ frontend on host:port (the host
must be a --listen address; the chart's form);
with any of --dot/--doh/--doq/--doh3 the frontends
are do53 plus those given
--dot string enable the DoT frontend on host:port (the host
must be a --listen address; the chart's form);
with any of --dot/--doh/--doq/--doh3 the frontends
are do53 plus those given
--dynblocks enable dnsdist dynamic blocking
--dynblocks-nxdomain-rate int per-client NXDOMAIN rate that triggers a dynamic
block; 0 disables (default 20)
--dynblocks-qps int per-client query rate (qps over 10 s) that
triggers a dynamic block (default 50)
--ebpf push dynamic-block drops into an eBPF socket
filter (needs CAP_SYS_ADMIN)
--internal-port int kudurru internal listener port (zone serial
polling); 0 disables (default 8082)
--listen strings addresses every frontend binds (default [0.0.0.0])
--out string write the rendered files into this directory
instead of stdout
--pool-authoritative string load-balancing policy of the authoritative pool
(default "leastOutstanding")
--pool-resolver string load-balancing policy of the resolver pool
(default "chashed")
--protocols strings frontends (do53,dot,doh,doq,doh3); default do53
plus all TLS ones when --tls-dir is set
--proxy-protocol-secret-file string PROXYv2 TLV 0xE0 shared secret (printable, >= 32
bytes: openssl rand -hex 32); required unless
every backend is loopback
--renderer string configuration format: yaml (dnsdist.yml +
functions-only dnsdist.lua) or lua (dnsdist.conf)
(default "yaml")
--server-id string dnsdist general.server_id; default the host name
--threads int Do53 listener threads (default 2)
--tls-dir string directory with tls.crt+tls.key (or
fullchain.pem+privkey.pem): enables
DoT/DoH/DoQ/DoH3, watched for rotation
--transfer-sources strings addresses/prefixes allowed to send
AXFR/IXFR/NOTIFY/UPDATE through the edge
kudurru edge run
Render, check, exec and supervise dnsdist (docs/architecture.md §3.6).
kudurru edge run [flags]
Flags:
--acl strings client prefixes allowed to query (default: private
and loopback ranges)
--api string dnsdist webserver/API address (loopback only)
(default "127.0.0.1:8083")
--api-key-group string group (name or gid) of the --api-key-out file,
e.g. keepalived_script; default unchanged
--api-key-out string write the per-start dnsdist API key here (0640),
e.g. /run/kudurru/dnsdist-api.key
--authoritative-cache cache the authoritative pool briefly and flush it
on zone serial changes
--authoritative-cache-ttl int max TTL (s) of the authoritative cache (default 30)
--authoritative-zones strings zones routed to the authoritative pool, in
addition to those polled from /internal/zones
--backend-port int kudurru DNS port for entries without a port and
EndpointSlices without the named port (default 5353)
--backend-port-name string EndpointSlice port name carrying DNS (default "dns")
--backends string static backends: comma-separated
[name=]host[:port] (port default --backend-port);
EVERY edge lists ALL kudurru nodes
--backends-from string membership source: static (from --backends) or
endpointslice:<namespace>/<service> (default "static")
--cache-size int resolver pool packet cache entries (default 200000)
--config-dir string directory for the rendered configuration (default
"/etc/dnsdist")
--console string dnsdist console address (loopback only) (default
"127.0.0.1:5199")
--debounce duration delay before re-rendering after membership or
certificate changes (default 5s)
--dnsdist-bin string dnsdist executable (default "dnsdist")
--dnsdist-user string uid[:gid] dnsdist switches to after binding its
sockets and creating the eBPF maps (dnsdist
--uid/--gid), for a supervisor started as root;
dnsdist keeps only capabilities_to_retain
--doh string enable the DoH frontend on host:port (the host
must be a --listen address; the chart's form);
with any of --dot/--doh/--doq/--doh3 the frontends
are do53 plus those given
--doh3 string enable the DoH3 frontend on host:port (the host
must be a --listen address; the chart's form);
with any of --dot/--doh/--doq/--doh3 the frontends
are do53 plus those given
--doq string enable the DoQ frontend on host:port (the host
must be a --listen address; the chart's form);
with any of --dot/--doh/--doq/--doh3 the frontends
are do53 plus those given
--dot string enable the DoT frontend on host:port (the host
must be a --listen address; the chart's form);
with any of --dot/--doh/--doq/--doh3 the frontends
are do53 plus those given
--drain duration readiness 503 period before a restart (default 1s)
--dynblocks enable dnsdist dynamic blocking
--dynblocks-nxdomain-rate int per-client NXDOMAIN rate that triggers a dynamic
block; 0 disables (default 20)
--dynblocks-qps int per-client query rate (qps over 10 s) that
triggers a dynamic block (default 50)
--ebpf push dynamic-block drops into an eBPF socket
filter (needs CAP_SYS_ADMIN)
--health-address string supervisor listener: /healthz/ready,
/healthz/live, /status, /metrics (default ":8084")
--internal-ca-file string CA of the kudurru internal listener (default
derived from KUDURRU_ENCRYPTION_KEY)
--internal-port int kudurru internal listener port (zone serial
polling); 0 disables (default 8082)
--internal-server-name string TLS server name of the internal listener (default
internal.kudurru.invalid)
--internal-token-file string bearer token of the kudurru internal listener
(default derived from KUDURRU_ENCRYPTION_KEY)
--listen strings addresses every frontend binds (default [0.0.0.0])
--log-format string json or text (default "json")
--log-level string debug, info, warn or error (default "info")
--poll-zones poll backends' /internal/zones (needs
KUDURRU_ENCRYPTION_KEY[_FILE] or
--internal-token-file) (default true)
--pool-authoritative string load-balancing policy of the authoritative pool
(default "leastOutstanding")
--pool-resolver string load-balancing policy of the resolver pool
(default "chashed")
--protocols strings frontends (do53,dot,doh,doq,doh3); default do53
plus all TLS ones when --tls-dir is set
--proxy-protocol-secret-file string PROXYv2 TLV 0xE0 shared secret (printable, >= 32
bytes: openssl rand -hex 32); required unless
every backend is loopback
--readiness-address string alias of --health-address (the chart's form)
(default ":8084")
--renderer string configuration format: yaml (dnsdist.yml +
functions-only dnsdist.lua) or lua (dnsdist.conf)
(default "yaml")
--server-id string dnsdist general.server_id; default the host name
--stop-timeout duration dnsdist SIGTERM grace period before SIGKILL
(default 10s)
--threads int Do53 listener threads (default 2)
--tls-dir string directory with tls.crt+tls.key (or
fullchain.pem+privkey.pem): enables
DoT/DoH/DoQ/DoH3, watched for rotation
--transfer-sources strings addresses/prefixes allowed to send
AXFR/IXFR/NOTIFY/UPDATE through the edge
--zone-poll duration interval of the /internal/zones serial poll
(default 5s)
kudurru export
Print objects as re-appliable YAML (all kinds by default).
kudurru export [kind...] [flags]
Flags:
--exclude-managed skip objects owned by files or integrations
--safe redact credentials embedded in URLs
kudurru get
List or show objects. Kinds and their aliases:
dnszones zone, zones, dnszone (cluster-scoped)
dnsrecordsets rrset, rrsets, dnsrecordset
blocklists list, lists, blocklist, bl
clientgroups cg, clientgroup
policies pol, policy
kudurru get <kind> [name...] [flags]
Examples:
kudurru get zones
kudurru get rrset -A -o wide
kudurru get blocklist ads -n default -o yaml
kudurru get pol -l team=platform
Flags:
-A, --all-namespaces list across all namespaces
-l, --selector string label selector, e.g. app=web,tier!=db
kudurru health
Probe a running instance (Docker HEALTHCHECK; --vrrp is the keepalived check).
kudurru health [flags]
Flags:
--dns string VIP address:port to probe over udp and tcp
(loopback is probed while this node does not
hold the VIP)
--dnsdist-api string local dnsdist API; empty skips the backend
check (default "http://127.0.0.1:8083")
--dnsdist-api-key-file kudurru edge run dnsdist API key published by kudurru edge run
(default "/run/kudurru/dnsdist-api.key")
--ops-address string ops listener to probe (default "127.0.0.1:8081")
--qname string name queried for TXT (default
"health.kudurru.internal.")
--ready probe readiness instead of liveness
--require-backends int minimum number of dnsdist backends up (default 1)
--timeout duration request timeout (with --vrrp: the probe
budget, 900ms unless set) (default 3s)
--vrrp kudurru vip probe run the keepalived VRRP probe (see kudurru vip
probe)
kudurru import
Import data from other DNS servers.
kudurru import bind
Import a BIND zone file into a zone's record sets.
kudurru import bind <zone> -f file.zone [flags]
Flags:
-f, --filename string zone file in BIND presentation format, or - for stdin
--origin string zone apex, to create the DNSZone when it does not exist yet
kudurru lameduck
Put the local kudurru into lameduck through the ops listener (POST /lameduck, loopback only) and wait for the duration, if one is given, so the edge's health checks (dnsdist must-resolve on health.kudurru.internal., every second) and the Kubernetes endpoints take the node out before it stops. Queries that still arrive are answered. --cancel leaves lameduck.
In Kubernetes use it as the preStop hook: lifecycle: { preStop: { exec: { command: ["kudurru", "lameduck", "5s"] } } }
kudurru lameduck [duration] [flags]
Examples:
kudurru lameduck 5s
kudurru lameduck --cancel
Flags:
--cancel leave lameduck
--ops-address string ops listener of the local node (loopback) (default "127.0.0.1:8081")
--timeout duration request timeout (default 3s)
kudurru lists
Inspect and refresh block and allow lists.
kudurru lists allow
Add domains to the "ui-allow" list.
kudurru lists allow <domain...> [flags]
Flags:
--list string target list (default ui-allow)
--regex entries are regular expressions
kudurru lists deny
Add domains to the "ui-deny" list.
kudurru lists deny <domain...> [flags]
Flags:
--list string target list (default ui-deny)
--regex entries are regular expressions
kudurru lists list
List block and allow lists with entry counts and fetch state.
kudurru lists list [flags]
Aliases: ls.
Flags:
-A, --all-namespaces list across all namespaces
kudurru lists refresh
Fetch lists now instead of waiting for their refresh interval.
kudurru lists refresh <name...>
kudurru lists search
Show which lists contain a domain.
kudurru lists search <domain>
kudurru login
Log in to a kudurru API server and save the endpoint as a named context in ~/.config/kudurru/config.yaml.
With --token the API token is verified (GET /auth/me) and stored. With --username the local password is exchanged for a session (POST /auth/login), which then mints an API token for the CLI (POST /auth/tokens). Tokens go to the OS keyring; when no keyring is available (headless Linux, containers) they are kept in the config file, which is written with mode 0600. Set KUDURRU_KEYRING=file to skip the keyring.
kudurru login --server https://dns.example [--token kdr_… | --username admin] [flags]
Examples:
kudurru login --server https://dns.example --token kdr_abc123def456_…
kudurru login --server https://dns.example --username admin
kudurru login --server https://dns.example --token-stdin < token.txt
echo "$PW" | kudurru login --server http://127.0.0.1:8080 --username admin --password-stdin --name local
Flags:
--default-namespace string default namespace stored in the context
--name string context name (default: the server host)
-p, --password string password (prefer the prompt or --password-stdin)
--password-stdin read the password from stdin
--token-expires-in string lifetime of the minted token, e.g. 720h (default: the server's)
--token-name string name of the token minted for the CLI (default
kudurru-cli@<hostname>)
--token-stdin read the API token from stdin (keeps it out of the process list)
-u, --username string local account to log in with
kudurru logout
Forget the stored token of a context.
kudurru logout [context] [flags]
Flags:
--remove also delete the context
kudurru logs
Show the query log; --follow streams new queries.
kudurru logs [flags]
Aliases: log, querylog.
Examples:
kudurru logs --client 192.168.1.23 --limit 100
kudurru logs --domain '*.doubleclick.net' --status-class blocked
kudurru logs -f --status blocked_list
Flags:
--client string client IP, CIDR or name (* wildcards)
--domain string domain, exact or with * wildcards
-f, --follow stream new queries (SSE) after the last page
--limit int number of past queries to show (0 with --follow: only new ones)
(default 50)
--list string list name
--no-headers omit the header line
--qtype string query type, e.g. AAAA
--since string start: RFC 3339 or a duration back from now (1h)
--status strings statuses to keep (comma-separated), e.g. blocked_list,cached
--status-class string status class: permitted, blocked, cached, error, ...
--until string end: RFC 3339 or a duration back from now
--upstream string upstream name
--zone string zone name
kudurru nodes
List the cluster's nodes.
kudurru nodes
Aliases: node.
kudurru query
Resolve a name through the server's own pipeline (POST /api/v1/dns/query) and print the answer the way dig does, plus kudurru's verdict: status, upstream, and the list and rule when a query was blocked. --client evaluates the policy of another client address.
kudurru query <name> [type] [flags]
Examples:
kudurru query example.com
kudurru query ads.example.net AAAA --client 192.168.1.23
Flags:
--client string evaluate policy as this client IP
kudurru records
List, add and remove records in a zone.
Aliases: record, rr.
kudurru records add
Create or replace one endpoint (name, type and its targets) in a record set of the zone. The record set defaults to "api-<zone>" and is created on demand. Targets are in presentation format: an address for A/AAAA, a name for CNAME, "10 mail.example.com." for MX, a quoted string for TXT.
kudurru records add <zone> <name> <type> <target...> [flags]
Examples:
kudurru records add home-example-com nas.home.example.com A 192.168.1.10 --ttl 300
kudurru records add home-example-com home.example.com MX "10 mail.home.example.com."
Flags:
--comment string comment stored with the record
--record-set string record set to write (default api-<zone>)
--set-identifier string external-dns set identifier
--ttl int record TTL in seconds (default: the zone's defaultTTL)
kudurru records list
List a zone's records across its record sets.
kudurru records list <zone>
Aliases: ls.
kudurru records rm
Remove one name/type from a zone.
kudurru records rm <zone> <name> <type> [flags]
Aliases: remove, delete.
Flags:
--record-set string only this record set (namespace/name or name)
--set-identifier string only the endpoint with this set identifier
kudurru restore
Re-apply a backup (POST /apply; per-object results).
kudurru restore -f file.yaml [flags]
Flags:
-f, --filename stringArray backup file, or - for stdin
kudurru serve
Run the kudurru node: the store (sqlite or kube), first-boot bootstrap, file-managed objects, zonecache, the query pipeline (ingress, authoritative, cache, upstream) on every configured transport, the Lease-elected controller, the ops and metrics listeners. The API and UI land in milestone M3.
kudurru serve
kudurru settings
Read and change runtime settings (cluster keys and this node's keys).
kudurru settings get
Show settings (redacted) with their scope.
kudurru settings get [key...] [flags]
Flags:
--scope string only cluster or node keys
kudurru settings set
Change settings with a JSON merge patch. Cluster-scope keys go to PATCH /api/v1/settings and apply to every node; node-scope keys go to PATCH /api/v1/node/config on the node that serves the request. hostOnly keys (listener addresses, dataDir, ...) can never be set through the API: put them in kudurru.yaml or the KUDURRU_<SECTION>__<KEY> environment variable on the host. "key-" removes the override so the default applies again.
kudurru settings set key=value... [key-]
Examples:
kudurru settings set cache.maxEntries=200000
kudurru settings set blocking.refreshInterval=12h log.level=debug
kudurru settings set upstreams.bootstrap=9.9.9.9,1.1.1.1
kudurru settings set log.level-
kudurru stats
Query statistics (this node).
kudurru stats summary
Totals, block rate, clients and latency for a window.
kudurru stats summary [flags]
Flags:
--window string window ending now (e.g. 1h, 24h, 168h) (default "24h")
kudurru stats top
Top domains, clients, upstreams, lists or zones.
kudurru stats top [flags]
Examples:
kudurru stats top --dim domains --blocked
kudurru stats top --dim clients --top 20 --window 1h
Flags:
--blocked rank blocked queries only
--dim string dimension: domains, clients, upstreams, lists or zones (default "domains")
--top int number of rows (at most 100) (default 10)
--window string window ending now (default "24h")
kudurru token
Offline helpers for kudurru API tokens.
kudurru token generate
Prints a new random token in the kdr_<id>_<secret> wire form without contacting a server. Set it as KUDURRU_BOOTSTRAP_TOKEN (or write it to the file KUDURRU_BOOTSTRAP_TOKEN_FILE names): the server then stores its hash as a token of the builtin-admin service account <namespace>/bootstrap. --out writes the token to a new file with mode 0600 instead of printing it.
kudurru token generate [--out file] [flags]
Flags:
--out string write the token to this new file (mode 0600) instead of stdout
kudurru version
Print build information.
kudurru version [flags]
Flags:
--json print as JSON
kudurru vip
keepalived supervisor and VIP tools (PID 1 of the kudurru-keepalived image).
kudurru vip drain
Move VIPs off this node for maintenance (track file 300); --undo writes 0.
kudurru vip drain <vip>... [flags]
Flags:
--run-dir string shared run directory (default "/run/kudurru")
--undo end the drain (weight 0)
kudurru vip fifo
Consume keepalived's notify FIFO (run by keepalived as vrrp_notify_fifo_script).
kudurru vip fifo [--node name] [--run-dir dir] <fifo> [flags]
Flags:
--node string node name (keepalived router_id)
--run-dir string directory of vip-state.json (default "/run/kudurru")
kudurru vip probe
Queries --qname over udp and tcp on the VIP while this node holds it (loopback otherwise) and requires --require-backends backends up in the local dnsdist. keepalived runs it every second with a 1 s timeout.
kudurru vip probe [flags]
Flags:
--dns string VIP address:port to probe over udp and tcp
(loopback is probed while this node does not
hold the VIP)
--dnsdist-api string local dnsdist API; empty skips the backend
check (default "http://127.0.0.1:8083")
--dnsdist-api-key-file kudurru edge run dnsdist API key published by kudurru edge run
(default "/run/kudurru/dnsdist-api.key")
--qname string name queried for TXT (default
"health.kudurru.internal.")
--require-backends int minimum number of dnsdist backends up (default 1)
--timeout duration overall probe timeout (keepalived's script
timeout is 1 s) (default 900ms)
kudurru vip rebalance
Hand VIPs this node holds but does not prefer back to their preferred node (writes 300, then 0).
kudurru vip rebalance [flags]
Flags:
--run-dir string shared run directory (default "/run/kudurru")
--timeout duration how long to wait for keepalived to leave MASTER (default 30s)
--vip strings move these VIPs (if held) regardless of priority
kudurru vip render
Print the keepalived.conf the supervisor would run.
kudurru vip render [flags]
Flags:
--dnsdist-api-key-file kudurru edge run dnsdist API key file written by kudurru edge
run (default "/run/kudurru/dnsdist-api.key")
--hmac-key-file string auth_hmac key file; {vrid} is replaced by the
VRID (default "/run/secrets/vrrp_hmac_{vrid}")
--kudurru-bin string kudurru path used in rendered scripts
(root-owned for enable_script_security)
(default "/usr/local/bin/kudurru")
--legacy keepalived 2.3.x: render without auth_hmac
(adverts unauthenticated)
--node-count int number of nodes (default: peers + 1)
--node-name string alias of --router-id (the chart passes
spec.nodeName)
--peers strings the other nodes' unicast addresses
--peers-file string file with one peer address per line, watched:
re-render + SIGHUP on change (overrides --peers)
--peers-from string nodes:<label selector>: peers are the selected
Kubernetes Nodes' InternalIPs (this node
excluded), re-listed every 30 s; the priority
index defaults to this node's position by name
(or its kudurru.io/vip-priority-index label)
--preempt-delay stringArray name=seconds: preempt_delay instead of
nopreempt for that VIP
--priority-index int this node's index: priority 200-10*index for
the first VIP
--probe-command string VRRP check command prefix rendered into
vrrp_script (e.g. "/usr/local/bin/kudurru
health --vrrp") (default
"/usr/local/bin/kudurru health --vrrp")
--require-backends int backends that must be up for this node to hold
a VIP (default 1)
--router-id string node name (router_id); default
$KUDURRU_NODE__NAME or the host name
--run-dir string shared run directory: FIFO, track files,
state, dnsdist API key (default "/run/kudurru")
--track-dnsdist-api string dnsdist API the VRRP probe checks (default
"http://127.0.0.1:8083")
--unicast-src string this node's VRRP source address (default: the
first address of the first VIP's interface)
--vip stringArray VIP as name=addr/len@iface#vrid (repeatable;
the second VIP gets reversed priorities); the
VRID is host-only and never changes
kudurru vip run
Render, keepalived -t, exec and supervise keepalived; SIGHUP on re-render.
kudurru vip run [flags]
Flags:
--config-path string rendered configuration (default
"/etc/keepalived/keepalived.conf")
--dnsdist-api-key-file kudurru edge run dnsdist API key file written by kudurru edge
run (default "/run/kudurru/dnsdist-api.key")
--health-address string supervisor listener: /healthz/ready,
/healthz/live, /status, /metrics (default ":8085")
--hmac-key-file string auth_hmac key file; {vrid} is replaced by the
VRID (default "/run/secrets/vrrp_hmac_{vrid}")
--keepalived-bin string keepalived executable (default "keepalived")
--kudurru-bin string kudurru path used in rendered scripts
(root-owned for enable_script_security)
(default "/usr/local/bin/kudurru")
--legacy keepalived 2.3.x: render without auth_hmac
(adverts unauthenticated)
--log-format string json or text (default "json")
--log-level string debug, info, warn or error (default "info")
--node-count int number of nodes (default: peers + 1)
--node-name string alias of --router-id (the chart passes
spec.nodeName)
--peers strings the other nodes' unicast addresses
--peers-file string file with one peer address per line, watched:
re-render + SIGHUP on change (overrides --peers)
--peers-from string nodes:<label selector>: peers are the selected
Kubernetes Nodes' InternalIPs (this node
excluded), re-listed every 30 s; the priority
index defaults to this node's position by name
(or its kudurru.io/vip-priority-index label)
--preempt-delay stringArray name=seconds: preempt_delay instead of
nopreempt for that VIP
--priority-index int this node's index: priority 200-10*index for
the first VIP
--probe-command string VRRP check command prefix rendered into
vrrp_script (e.g. "/usr/local/bin/kudurru
health --vrrp") (default
"/usr/local/bin/kudurru health --vrrp")
--require-backends int backends that must be up for this node to hold
a VIP (default 1)
--router-id string node name (router_id); default
$KUDURRU_NODE__NAME or the host name
--run-dir string shared run directory: FIFO, track files,
state, dnsdist API key (default "/run/kudurru")
--stop-timeout duration keepalived SIGTERM grace period (keep below
the container stop grace period) (default 15s)
--track-dnsdist-api string dnsdist API the VRRP probe checks (default
"http://127.0.0.1:8083")
--unicast-src string this node's VRRP source address (default: the
first address of the first VIP's interface)
--vip stringArray VIP as name=addr/len@iface#vrid (repeatable;
the second VIP gets reversed priorities); the
VRID is host-only and never changes
kudurru zones
List, import, export, notify and delete zones.
Aliases: zone.
kudurru zones delete
Delete a zone and every record set that references it.
kudurru zones delete <zone> [flags]
Aliases: rm.
Flags:
--dry-run only report what would be deleted
kudurru zones export
Print a zone in BIND presentation format.
kudurru zones export <zone> [flags]
Flags:
--out string write to this file instead of stdout
kudurru zones get
Show one zone.
kudurru zones get <zone>
kudurru zones import
Import a BIND zone file into a zone's record sets.
kudurru zones import <zone> -f file.zone [flags]
Flags:
-f, --filename string zone file in BIND presentation format, or - for stdin
--origin string zone apex, to create the DNSZone when it does not exist yet
kudurru zones list
List zones with serial, record count and readiness.
kudurru zones list
Aliases: ls.
kudurru zones notify
Send NOTIFY for a zone to its secondaries.
kudurru zones notify <zone>