Sign in
Servers

Provision

Provision a new VM at runtime: record its root CA identity and issue storage secrets.

Only 1.4.0+ VMs reach this route (it is behind require_cvm_proxy), and every one of them signs, so require_hotkey_auth demands a proven hotkey at the door -- no backwards-compatible "unsigned is acceptable" case exists here, unlike boot attestation. The proven identity is what the rc gate in verify_quote is given.

The RTMR3-attested runtime entry point for new VMs (supersedes /luks/attest going forward). The VM presents its per-boot root CA as the mTLS client cert; the quote's REPORTDATA binds SHA256(that cert's pubkey), so the same cert_hash check that guards /luks/attest also proves CA possession — no bespoke quote logic is needed. require_luks_quote_nonce validates and consumes the runtime nonce; the handler verifies the quote (signature + all RTMR measurements incl. RTMR3), records server.vm_root_ca_cert (idempotent), and returns rotated passphrases, the k3s encryption key, and a confirm nonce.

post/servers/{vm_name}/provision

Path parameters

vm_namestring required

Headers

X-Chutes-Hotkeystring nullable
X-Quote-Noncestring nullable

Request body

quotestring required

Base64-encoded TDX quote (runtime type, RTMR3 extended)

volumesstring[] required

Volume names to rotate passphrases for

Response

Successful Response

volumesobject required
confirm_noncestring required

Single-use nonce for POST /provision/confirm

k3s_encryption_keystring required

k3s encryption key (base64)

Changes

Changed in 4 of the 11 revisions of this API.132