Sign in
Servers

Attest Luks

Rotate LUKS passphrases for new-format VMs (version >= 1.3.0).

DEPRECATED: superseded by POST /provision, which does the same storage rotation and additionally records the VM root CA identity. Kept unchanged for legacy in-field VMs; retire once the fleet upgrades.

The VM embeds the luks_quote_nonce (received in the boot attestation response) in a TDX quote after extending RTMR3 in initramfs. require_luks_quote_nonce validates and consumes the nonce; the handler then calls verify_quote which checks the TDX signature and all RTMR measurements including RTMR3. Returns rotated passphrases, the k3s encryption key, and a confirm nonce.

post/servers/{vm_name}/luks/attest

Path parameters

vm_namestring required

Headers

X-Chutes-Hotkeystring nullable
X-Quote-Noncestring nullable

Request body

quotestring required

Base64-encoded TDX quote (runtime type, RTMR3 extended)

volumesstring[] required

Volume names to rotate passphrases for

Response

Successful Response

volumesobject required
confirm_noncestring required

Single-use nonce for the confirm endpoint

k3s_encryption_keystring required

k3s encryption key (base64)

Changes

Changed in 2 of the 11 revisions of this API.11