Skip to main content

Backup-ZrClusterCaKey

Exports a passphrase-encrypted backup of the cluster CA private key, so the CA can be recovered on a new issuer host.

Syntax​

Backup-ZrClusterCaKey
    -OutFile <string>
    -Passphrase <SecureString>
    [-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
    [-WhatIf] [-Confirm]

Description​

Backup-ZrClusterCaKey retrieves the cluster CA private key from the connected manager and writes it to disk encrypted under the passphrase you supply. The resulting file lets you recover the CA on a new issuer host with Restore-ZrClusterCaKey. Requires an active workspace or an explicit -Managers list.

warning

This backup contains the cluster CA private key — the secret that signs every node certificate. The encrypted file is useless without the passphrase, so store the two separately and off the issuer host. Never commit the backup (or the passphrase) to source control, share it over insecure channels, or leave it on the issuer machine. Anyone holding both the file and the passphrase can impersonate your cluster CA.

Parameters​

ParameterTypeRequiredDescription
-OutFilestringYesPath to write the encrypted CA-key backup file to. Position 0.
-PassphraseSecureStringYesPassphrase used to encrypt the backup; required to restore it later.
-Managersstring[]NoManagement Service endpoints to target; when omitted the active workspace's managers are used.
-PortintNoManagement Service port for bare-host managers. Default 7801.
-TokenstringNoAdmin bearer token for authenticated control-plane calls.
-TimeoutSecintNoPer-request timeout in seconds. Default 30.

Supports -WhatIf and -Confirm.

Examples​

Write an encrypted backup of the cluster CA private key using an interactively entered passphrase.

Backup-ZrClusterCaKey -OutFile cluster-ca-key.enc -Passphrase (Read-Host -AsSecureString)