Contract CLI

Edit online

The Contract CLI is a command-line tool that automates the generation and management of contracts for IBM Confidential Computing services.

The Contract CLI simplifies contract workflows for IBM Confidential Computing Containers for Red Hat OpenShift Container Platform (CCCO) that previously required manual OpenSSL scripting and separate binary tools.

Installation

Download the latest release for your platform from the releases page. Supported platforms include Linux (amd64, arm64, s390x, ppc64le), macOS, and Windows.

OpenSSL must be available in your system PATH. To verify installation, run:

contract-cli --version

Key capabilities

  • Encrypt contract sections - Encrypts the workload and environment sections of a contract using embedded or custom encryption certificates. Use the --os ccco flag to target the CCCO platform and --ver to pin a specific certificate version.
  • Sign contracts - Signs a contract that contains encrypted workload and environment sections using a private key. Supports password-protected keys.
  • Generate sealed secrets - Creates sealed secrets for the workload (--type workload) or environment (--type env) sections of a CCCO contract, replacing the need for the separate sealed secret client binary.
  • Create initdata annotations - Generates the gzip-compressed, Base64-encoded initdata annotation value for both Peer Pod and Bare Metal deployments. Bare Metal deployments can include the SE header binary directly using the --sehdr flag.
  • List certificate versions - Lists the embedded encryption certificate versions available for each platform without requiring a download from IBM Cloud.