CHCTL Command Reference¶

chctl is the CloudHedge OmniDeq CLI for application discovery, containerization, and migration to Kubernetes.

Prerequisites - All commands (except appliance setup and offline discovery with a pre-cached tool) require a valid login. Run chctl login first. - Configuration (server URL + JWT token) is stored at ~/.cloudhedge/config.json. - Check the version any time with chctl --version.

Ordered by the typical user journey: Login → Vault → Discover → Rationalize → Transform → Cruize (Deploy) → EKS → Report, followed by the Smoke Test, Appliance Management, and Utilities.

Command	Description	Key Options
`chctl login`	Authenticate to the appliance and save the session token.	`--username, -u`, `--password, -p` (omit to be prompted securely), `--server, -s`

Example

chctl login --server https://<appliance-host> --username <user> --password <pass>

2. Vault (Credential Management)¶

Vaults store the credentials used by discovery, build, registry, and cloud operations.

Create a vault¶

Command	Description	Key Options
`chctl vault create password`	Username/password vault (e.g. SSH/WinRM host login).	`--vaultname`, `--username`, `--password`
`chctl vault create ssh`	SSH private-key vault.	`--vaultname`, `--sshkey` (key file path)
`chctl vault create aws`	AWS access/secret key vault.	`--vaultname`, `--accesskey`, `--secretkey`
`chctl vault create azure`	Azure service-principal vault.	`--vaultname`, `--subscriptionid`, `--tenantid`, `--clientid`, `--clientsecret`, `--clienturl`
`chctl vault create gke`	Google GKE vault.	`--vaultname`, `--gkeProjectName`, `--gkeConfigFile`
`chctl vault create kerberos`	Kerberos/AD vault for Windows discovery.	`--vaultname`, `--domainRealm`, `--domainUsername`, `--domainPassword`, `--kerberosConfig`
`chctl vault create dockerjson`	Docker `config.json` vault.	`--vaultname`, `--dockerConfig`
`chctl vault create registry`	Container-registry vault.	`--vaultname`, `--registryType`, `--registryServer`, `--vaultId`
`chctl vault create buildbox`	Build machine (buildbox) definition.	`--vaultname`, `--host`, `--port`, `--username`, `--credentialVault`, `--osType`, `--connectionType`
`chctl vault create dynatrace`	Dynatrace integration vault.	`--vaultname` (+ tokens)
`chctl vault create newrelic`	New Relic integration vault.	`--vaultname` (+ tokens)
`chctl vault create datadog`	Datadog integration vault.	`--vaultname` (+ tokens)
`chctl vault create redhat`	Red Hat subscription vault.	`--vaultname` (+ creds)
`chctl vault create json`	Generic JSON vault.	`--vaultname` (+ payload)

Manage vaults¶

Command	Description	Key Options
`chctl vault list`	List all vaults (or one by id).	`--vaultId`, `--output` (table/json)
`chctl vault delete`	Delete a vault by name.	`--name`
`chctl vault validate`	Validate a buildbox vault (connectivity).	—

Note: the appliance never returns stored secrets to the CLI — vaults are write-only.

3. Discover¶

Discover hosts (nodes) into projects (waves), verify connectivity, and run discovery.

Add & manage nodes¶

Command	Description	Key Options
`chctl discover add project`	Add multiple hosts from a CSV file (creates the project).	`--fileName`
`chctl discover add node`	Add a single host to a project.	`--project`, `--osType`, `--host`, `--alias`, `--username`, `--connectionType`, `--vault`, `--port`
`chctl discover delete node`	Delete a node (or all nodes in a project).	`--node`, `--project`, `--all`

Verify connectivity¶

Command	Description	Key Options
`chctl discover check connection`	Verify the appliance can reach the node.	`--node`, `--project`
`chctl discover check prerequisites`	Verify discovery prerequisites on the node.	`--node`, `--project`

Run discovery¶

Command	Description	Key Options
`chctl discover start-discover node`	Run discovery on a single node.	`--node`, `--project`
`chctl discover start-discover project`	Run discovery on all nodes in a project.	`--project`

List / get¶

Command	Description	Key Options
`chctl discover get projects`	List all projects.	`--output` (table/json)
`chctl discover get nodes`	List nodes in a project.	`--project`, `--output`
`chctl discover get error-logs`	Collect discovery-log errors from a project's hosts into a CSV.	`--project` or `--inventory`, `--vault-creds`, `--output`, `--all-hosts`, `--workers`, `--timeout` (see `--help` for the full set)

Offline / air-gapped discovery¶

Command	Description	Key Options
`chctl discover local`	Run offline discovery on a remote host, or many via an inventory CSV; downloads results to a folder.	`--node`, `--osType`, `--userName`, `--password`, `--project`, `--inventory`, `--out-dir`, `--clean`, and for domain Windows: `--win-realm`, `--krb5-config`, `--krb-ccache`
`chctl discover upload`	Upload offline discovery result files from a folder to the appliance.	`--osType`, `--project`, `--dirPath`, `--wait, -w`

Bulk offline example

chctl discover local --inventory hosts.csv --project MyProject --out-dir ./results
chctl discover upload --dirPath ./results --project MyProject

Kerberos (domain-joined Windows)¶

For Windows hosts that only accept domain / Active Directory (Kerberos) logins rather than local WinRM basic auth, add --win-realm. This switches WinRM to Kerberos/SPNEGO.

Flag	Meaning
`--win-realm`	Kerberos realm, UPPERCASE (e.g. `NEWDOMAIN.LOCAL`). Setting it turns Kerberos on.
`--krb5-config`	Path to a `krb5.conf` describing the realm's KDC. Required with `--win-realm`.
`--krb-ccache`	Path to an existing Kerberos credential cache (from `kinit`). Recommended — see note below.

Working recipe (tested against AD):

Write a krb5.conf with the KDC's real IP and DNS lookup off (AD often advertises extra, unreachable adapter IPs):

[libdefaults]
    default_realm    = NEWDOMAIN.LOCAL
    dns_lookup_kdc   = false
    dns_lookup_realm = false
    rdns             = false
[realms]
    NEWDOMAIN.LOCAL = {
        kdc          = 192.168.1.184
        admin_server = 192.168.1.184
    }
[domain_realm]
    .newdomain.local = NEWDOMAIN.LOCAL
    newdomain.local  = NEWDOMAIN.LOCAL

If the realm isn't in DNS, map the KDC and the target host in /etc/hosts (the target must be reachable by its FQDN — Kerberos uses the SPN HTTP/<fqdn>):

echo "192.168.1.184 dc01.newdomain.local"            | sudo tee -a /etc/hosts
echo "192.168.1.57  winhost.newdomain.local winhost"  | sudo tee -a /etc/hosts

Get a ticket with MIT kinit, then run discovery pointing at that cache:

KRB5_CONFIG=./krb5.conf kinit Administrator@NEWDOMAIN.LOCAL
klist     # confirm a krbtgt ticket

chctl discover local \
  --osType windows \
  --node winhost.newdomain.local \
  --userName Administrator --password unused \
  --win-realm NEWDOMAIN.LOCAL \
  --krb5-config ./krb5.conf \
  --krb-ccache /tmp/krb5cc_$(id -u) \
  --project MyProject --out-dir ./results

Why --krb-ccache is needed: chctl's built-in password login is commonly rejected by AD (KDC_ERR_PREAUTH_FAILED). Letting MIT kinit obtain the ticket and passing it via --krb-ccache is the reliable path; --password is then unused (any value). Re-run kinit when the ticket expires.

Ports: the KDC must be reachable on 88/TCP and 88/UDP (an Administrator ticket is often too big for UDP and forces TCP), and the target on 5986/TCP (WinRM HTTPS). Running chctl under sudo? Either sudo kinit (cache at /tmp/krb5cc_0) or keep your user's cache and point --krb-ccache at it — root can read it.

X-Ray (process deep-dive)¶

Command	Description	Key Options
`chctl discover xray start`	Start X-Ray on a process.	`--project`, `--hostName`, `--processName`, `--pid`
`chctl discover xray status`	Check X-Ray status.	`--project`, `--hostName`, `--processName`, `--pid`
`chctl discover xray latestStatus`	Check the latest X-Ray status.	`--project`, `--hostName`, `--processName`, `--pid`
`chctl discover xray stop`	Stop X-Ray on a process.	`--project`, `--hostName`, `--processName`, `--pid`

4. Rationalize (App Building)¶

Group discovered components into applications. The appliance's App Builder suggests candidate groups (network-connected components, minimum 2 per group); chctl app build promotes those suggestions automatically — creating a new application per group (or updating an existing one) and assigning its components.

Command	Description	Key Options
`chctl app build`	Auto-create/assign applications for a project from the App Builder's suggested component groups.	`--project, -p` (required), `--prefix` (default `auto-`), `--min-components` (default 2), `--apply`, `--timeout`

Example

chctl app build --project MyProject            # dry run — preview the plan (no changes)
chctl app build --project MyProject --apply    # create/assign for real

Dry run by default — without --apply it only prints the plan. Each row's Status is Will create, Will update, Up-to-date (already built — a no-op), Skipped, or Failed. App names are <prefix> + the suggested group name (default prefix auto-). Idempotent: re-running leaves already-built apps untouched. The grouping is computed by the appliance — the same suggestions you see in the web UI's App Builder.

5. Transform (Containerization)¶

Command	Description	Key Options
`chctl transform getProfiles`	List transform profiles for a project.	`--project`, `--output`
`chctl transform getTransformActions`	List transform actions for a profile.	`--profileId` or `--profileName` (+ `--project`), `--output`
`chctl transform getDockerfile`	Get the generated Dockerfile for a service.	`--project`, `--hostName`, `--profileName`, `--output`
`chctl transform createImage`	Build a container image from a discovered Linux process.	`--project`, `--hostName`, `--profileName`, `--serviceName`, `--registryVaultName`, `--registryUser`, `--buildboxName`, `--repositoryName`, `--imageTag`, `--isFinal`

Example

chctl transform createImage --project MyProject --hostName web01 \
  --profileName default --serviceName nginx --buildboxName bb1 \
  --registryVaultName reg --repositoryName myrepo --imageTag v1 --isFinal

6. Cruize (Kubernetes Workload Management)¶

Command	Description	Key Options
`chctl cruize startApplicationDeployment`	Create a workload / application deployment.	`--blueprintName`, `--blueprintVersion`, `--deploymentName`, `--clusterName`, `--environment`, `--clusterNamespace`, `--ingressName`
`chctl cruize updateContainers`	Update a container image in a deployment.	`--blueprintName`, `--blueprintVersion`, `--deploymentName`, `--containerName`, `--imageTag`
`chctl cruize deleteWorkload`	Delete a workload.	`--blueprintName`, `--environment`
`chctl cruize getDeployedApps`	List deployed apps for an EKS blueprint.	`--eks`, `--output`
`chctl cruize downloadHelmChart`	Download the Helm chart for a blueprint.	`--blueprintName`, `--blueprintVersion`
`chctl cruize convertYamlToHelm`	Convert YAML manifests into a Helm chart.	`--yamlPath`, `--outputName`
`chctl cruize addBYOCCluster`	Register a bring-your-own-cluster (BYOC).	`--clusterName`, `--clusterDescription`, `--clusterType`, `--clusterConfig`
`chctl cruize deleteBYOCCluster`	Delete a BYOC cluster.	`--clusterName`
`chctl cruize deploy`	GitOps deploy of an application blueprint to an EKS blueprint.	`--eks`, `--appBlueprintName`, `--appBlueprintVersion`
`chctl cruize promote`	Promote an application from a source to a target EKS blueprint.	`--source`, `--applicationName`, `--target`, `--appBlueprintVersion`

7. EKS (AWS Blueprint Lifecycle)¶

Command	Description	Key Options
`chctl eks create`	Create an EKS blueprint from a Git repo.	`--awsVaultName`, `--sshVaultName`, `--eksGitRepositoryUrl`, `--blueprint`
`chctl eks get`	Get EKS blueprint(s).	`--name`, `--options` (debug/resources), `--output`
`chctl eks about`	About the EKS blueprints.	—
`chctl eks output`	Show EKS blueprint outputs.	`--name`
`chctl eks update`	Update an EKS blueprint.	`--name`
`chctl eks delete`	Delete an EKS blueprint.	`--name`

8. Report¶

Download the per-project DART report (Discovery, Assessment, Rationalization) from CHAI — the same data and PDF you get from the web UI's report screen, straight to a local folder.

Command	Description	Key Options
`chctl report download`	Download reports for one or more projects: Data CSVs, the Netwatch CSV, and a UI-matching PDF (rendered using the machine's installed Chrome — no bundled browser).	`--all`, `--project` (repeatable, also comma-separated), `--out` (default `chai-reports`), `--separator` (`,`/`;`), `--skip-data`, `--skip-netwatch`, `--no-pdf`, `--keep-zip`, `--chrome` (path), `--pdf-timeout` (default 90s), `--output`

Examples

chctl report download --all                        # every project
chctl report download --project "ProjectM"         # one project
chctl report download --project "A,B" --no-pdf     # two projects, CSVs only

Output tree: <out>/<Project>/{data/*.csv, netwatch/*.csv, pdf/<Project>.pdf}.

PDF is on by default (--no-pdf to skip) and needs Chrome/Chromium installed — if none is found, CSVs still download and the PDF is skipped with a warning. Project names are validated against CHAI; an unknown project is reported and skipped (no empty folder or blank PDF). Best-effort per project, so one failure doesn't abort the rest.

9. Smoke Test¶

Command	Description	Key Options
`chctl smoke-test`	Prove a freshly installed appliance works end-to-end: login → add sample vault → add sample host (creates a project) → list projects → list hosts.	`--project`, `--vault`, `--vault-username`, `--vault-password`, `--host`, `--alias`, `--host-username`, `--osType`, `--connectionType`, `--port`, `--output` (table/json)

Example

chctl smoke-test                 # human-readable table
chctl smoke-test --output json   # machine-readable (CI); exits non-zero on any failure

Reuses your saved chctl login. Creates fixed-name sample artifacts and leaves them as visible proof; repeat runs stay green.

10. Appliance Management (On-Prem Admin)¶

Run on the appliance host to manage the CloudHedge Enterprise services.

Command	Description	Key Options
`chctl setup appliance`	Install / set up the appliance.	`--skip-load-container`, `--skip-db-setup`, `--target-directory`
`chctl start appliance`	Start the appliance services.	—
`chctl status appliance`	Check appliance service status (`docker compose ps`).	—
`chctl stop appliance`	Stop the appliance services.	—
`chctl patch appliance`	Patch one or more microservices to a given tag.	Per-service flags (e.g. `--core-engine`, `--vault-service`, `--webapp`, `--cruize-service`, …), or `--all`
`chctl update config`	Set the default user account for CloudHedge Enterprise.	`--email`, `--username`, `--password`

Tip: append --help to any command or subcommand (e.g. chctl discover local --help) to see its full, current option list.

CHCTL Command Reference¶

1. Login¶

2. Vault (Credential Management)¶

Create a vault¶

Manage vaults¶

3. Discover¶

Add & manage nodes¶

Verify connectivity¶

Run discovery¶

List / get¶

Offline / air-gapped discovery¶

Kerberos (domain-joined Windows)¶

X-Ray (process deep-dive)¶

4. Rationalize (App Building)¶

5. Transform (Containerization)¶

6. Cruize (Kubernetes Workload Management)¶

7. EKS (AWS Blueprint Lifecycle)¶

8. Report¶

9. Smoke Test¶

10. Appliance Management (On-Prem Admin)¶