CHchutes
Servers

Attest Luks

Changed on

Rotate LUKS passphrases for new-format VMs (version >= 1.3.0).

DEPRECATED: superseded by POST /provision, which does the same storage rotation and additionally records the VM root CA identity. Kept unchanged for legacy in-field VMs; retire once the fleet upgrades.

The VM embeds the luks_quote_nonce (received in the boot attestation response) in a TDX quote after extending RTMR3 in initramfs. require_luks_quote_nonce validates and consumes the nonce; the handler then calls verify_quote which checks the TDX signature and all RTMR measurements including RTMR3. Returns rotated passphrases, the k3s encryption key, and a confirm nonce.

post/servers/{vm_name}/luks/attest

Request

  • Base URL
    https://api.chutes.ai (the document declares no server; this is the origin it was published from)
  • URL
    https://api.chutes.ai/servers/{vm_name}/luks/attest
  • Auth
    none declared

Path parameters

vm_namestring required

Headers

X-Chutes-Hotkeystring nullable
X-Quote-Noncestring nullable

Request body

quotestring required

Base64-encoded TDX quote (runtime type, RTMR3 extended)

volumesstring[] required

Volume names to rotate passphrases for

Response

Successful Response

string required

Changes

  • 23e8895b217dRevision changes
    • breaking

      the response's body type changed from object to string for status

    • breaking

      removed the required property from the response with the status

    • breaking

      removed the required property from the response with the status

    • breaking

      removed the required property from the response with the status

    • info

      added the optional property // to the response with the status

    • info

      added the optional property // to the response with the status

  • 8d909638091eRevision changes
    • info

      endpoint added