vyos-1x.git/op-mode-definitions, branch rolling

op-mode: T861: add "show secure-boot detail" command

2026-10-05T20:41:37+00:00

"show secure-boot" only reported whether Secure Boot is enabled, not who signed the running Linux Kernel. An image signed by the VyOS CA could not be told apart from one signed with a custom Machine Owner Key. "show secure-boot detail" now lists issuer and subject of the Kernel image signature certificates. The same information is added to the raw "show version" data as "secure_boot_detail", issuer and subject delimited by ",". The key is only present when Secure Boot is enabled and a signature could be read.

op-mode: T9354: replace "reset connection" with "reconnect interface"

2026-09-25T19:02:06+00:00

"connect interface" and "disconnect interface" cannot be combined to restart a dialer interface when the CLI session runs over that very interface, yet the command which does cover it was filed under an unrelated top-level node and was hard to find. It is now "reconnect interface ", mirroring the existing connect and disconnect commands. "reset connection" is removed, no alias is kept. The removed command was reachable through the REST API as a "reset" path. A dedicated "/reconnect" endpoint takes its place, so the operation stays available to API consumers.

kdump: T8868: Implement kernel crash dump support

2026-08-20T13:35:07+00:00

Add new CLI subtree 'system option kdump' with memory reservation and local dump path configuration. Also add 'show system kdump' and 'show system kdump dumps' operation mode commands to get status of the configuration and list of dumps. Extend 'show tech-support report' and 'generate tech-support archive' with kdump service status, active config files and the recently kernel dump file.

pki: T9135: add "show pki ca/certificate text" command

2026-08-10T19:34:19+00:00

"show pki ca/certificate " only ever offered PEM output, which isn't practical for a human to actually read. Add a "text" form that runs the certificate through OpenSSL's own "-text" formatter, the same human-readable breakdown "openssl x509 -text" produces.

op-mode: T9135: add CLI tab-completion for existing CA/certificate names

2026-08-10T19:09:13+00:00

"import pki ca " and "import pki certificate " only ever offered a literal "" hint, never the names of CAs/certificates already present in the running configuration - useful when re-importing an updated certificate under its existing name, not just when adding a brand new one.

op-mode: T9135: allow importing a CA certificate from a remote URL

2026-08-10T19:04:07+00:00

The path argument to the CA import command now also accepts a remote URL (http, https, ftp, sftp, scp, tftp, ...), detected by scheme, in addition to a local file path. Makes it convenient to pull a well-known public intermediate directly by URL instead of downloading and pasting PEM content by hand.

container: T7736: give container veths a deterministic host_interface_name

2026-08-04T18:36:28+00:00

Podman's default "vethN" auto-naming for a container's host-side veth can collide with VyOS's own "virtual-ethernet vethN" interfaces. Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name" network connect option) and use it to name every non-macvlan container network attachment "veth-" instead, eliminating the collision by construction. Container names too long to fit are shortened to a recognizable prefix plus a short hash of the full name; verify() rejects the rare case where two containers still generate the same interface name. Add "show container interface" to display the resulting name-to-container mapping.

op-mode: T9009: add "show log priority " command

2026-07-01T19:01:16+00:00

op-mode: T9009: rename "monitor log level" to priority to match journalctl

2026-07-01T19:01:14+00:00

op-mode: T8372: add "show log facility " command

2026-06-29T14:58:53+00:00