---
schema_version: "1"
id: e33535ee65db1c1d772be54150fa9adfb67210a3f2067e710e224576a968736c
title: RTFCTL Reference
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-fabric/latest/rtfctl-reference.md
canonical_url: https://docs.mulesoft.com/runtime-fabric/latest/rtfctl-reference
source_site: docs.mulesoft.com
content_type: documentation
content_hash: e9f7b13bb3de4d81a7232a55711ca9b13c26105f00867eaacf0eb42900ef6faf
description: MuleSoft Documentation Site
release: "3.0"
latest: true
---
---
product: Runtime Fabric
version: 3.0
is-latest-version: true
---

# RTFCTL Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Use this reference for `rtfctl` commands.

## Install, Upgrade, and Validate Runtime Fabric with RTFCTL

Use these commands to install, upgrade, and validate a Runtime Fabric.

<table><colgroup><col> <col></colgroup><thead><tr><th>Command</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><a href="#install"><code>install</code></a></p></div></div></td><td><div><div><p>Installs Runtime Fabric</p></div></div></td></tr><tr><td><div><div><p><a href="#validate"><code>validate</code></a></p></div></div></td><td><div><div><p>Validates the cluster for Runtime Fabric installation</p></div></div></td></tr><tr><td><div><div><p><a href="#version"><code>version</code></a></p></div></div></td><td><div><div><p>Displays the Runtime Fabric version information</p></div></div></td></tr></tbody></table>

### `install`

- Installs Runtime Fabric

rtfctl install <activation\_data>

- Override the Docker image registry URL and secret

  rtfctl install <activation\_data> --image-pull-registry <string> --image-pull-secret <string>

### `validate`

Validates the cluster for a Runtime Fabric installation

- Performs a validation check

  rtfctl validate <activation\_data>

- Performs a validation check and passes the `fabric.tf` configuration file that contains proxy
  settings

  rtfctl validate -f <path\_to\_settings\_file>

  To validate installation with a proxy, you must specify proxy settings in your `settings` file:

MULE\_LICENSE=<your-mule-license> ACTIVATION\_DATA=<activation\_data>
HTTP\_PROXY=http://<proxy\_domain>.com:<port>

- Override the Docker image registry URL and secret

  rtfctl validate <activation\_data> --image-pull-registry <string> --image-pull-secret <string>

### `version`

Displays the Runtime Fabric version information

rtfctl version --namespace <rtf\_namespace>

## Back Up and Restore a Runtime Fabric with RTFCTL

Use these commands to back up and restore a Runtime Fabric.

<table><colgroup><col> <col></colgroup><thead><tr><th>Command</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><a href="#backup"><code>backup</code></a></p></div></div></td><td><div><div><p>Performs a back up of the local Runtime Fabric state</p></div></div></td></tr><tr><td><div><div><p><a href="#restore"><code>restore</code></a></p></div></div></td><td><div><div><p>Restores local Runtime Fabric state from a backup</p></div></div></td></tr></tbody></table>

### `backup`

Performs a back up of the local Runtime Fabric state.

rtfctl backup <backup\_file\_name>.tar.gz --namespace <rtf\_namespace>

### `restore`

Restores the local Runtime Fabric state from a backup

rtfctl restore <backup\_file\_name>.tar.gz --namespace <rtf\_namespace>

Restore only the core Runtime Fabric software components without triggering application
synchronization from the control plane.

rtfctl restore <backup\_file\_name>.tar.gz --namespace <rtf\_namespace> --core-software-only

## Configure Runtime Fabric with RTFCTL

Use these commands to configure Runtime Fabric.

<table><colgroup><col> <col></colgroup><thead><tr><th>Command</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><a href="#apply"><code>apply</code></a></p></div></div></td><td><div><div><p>Applies changes to a Runtime Fabric configuration</p></div></div></td></tr><tr><td><div><div><p><a href="#update"><code>update</code></a></p></div></div></td><td><div><div><p>Updates rtfctl</p></div></div></td></tr><tr><td><div><div><p><a href="#wait"><code>wait</code></a></p></div></div></td><td><div><div><p>Waits for Runtime Fabric components to become ready</p></div></div></td></tr><tr><td><div><div><p><a href="#renew"><code>renew-expired-client-cert</code></a></p></div></div></td><td><div><div><p>Renews an expired client certificate using a pre-downloaded package</p></div></div></td></tr></tbody></table>

### `apply`

Applies changes to a Runtime Fabric configuration.

> [!NOTE] You can use the `rtfctl apply system-configuration` command to update OpenShift
> system-configuration values. Other rtfctl apply commands are not effective for OpenShift. For any
> other updates, modify the values in the OpenShift console.

- Applies an HTTP proxy configuration

  rtfctl apply http-proxy http://<host>:<port> --namespace <rtf\_namespace>

- Applies an HTTP proxy configuration with hostnames bypassing the proxy

  rtfctl apply http-proxy http://<host>:<port> --no-proxy "DOMAIN1.com,DOMAIN2.com" --namespace
  <rtf\_namespace>

- Applies an HTTP proxy configuration with authentication

  rtfctl apply http-proxy http://<username>:<password>@<host>:<port> --namespace <rtf\_namespace>

- Clears an HTTP proxy configuration

  rtfctl apply http-proxy "" --no-proxy "" --namespace <rtf\_namespace>

- Applies a secure property

  rtfctl apply secure-property --key <key> --value <value> --app-namespace <app\_namespace>
  --namespace <rtf\_namespace>

- Applies a system configuration on a host node

  rtfctl apply system-configuration

- Applies a system configuration on a host node without downloading the latest scripts

  rtfctl apply system-configuration --skip-download

- Applies a Mule license

  rtfctl apply mule-license <base64\_encoded\_license> --namespace <rtf\_namespace>

  If Runtime Fabric is installed via Helm, you must update the `mule-license` property in the Helm
  values.

- Applies a monitoring proxy

  rtfctl apply monitoring-proxy http://<host>:<port> --namespace <rtf\_namespace>

- Clears a monitoring proxy configuration

  rtfctl apply monitoring-proxy "" --namespace <rtf\_namespace>

### `update`

Updates `rtfctl`.

- Updates `rtfctl` from the US Cloud

  rtfctl update

- Updates `rtfctl` from the EU Cloud

  rtfctl update --host eu1.anypoint.mulesoft.com

- Updates `rtfctl` from the Canada Cloud

  rtfctl update --host ca1.platform.mulesoft.com

- Updates `rtfctl` from the Japan Cloud

  rtfctl update --host jp1.platform.mulesoft.com

- Updates `rtfctl` from the India Cloud

  rtfctl update --host in1.platform.mulesoft.com

- Updates `rtfctl` from the Australia Cloud

  rtfctl update --host au1.platform.mulesoft.com

- Updates `rtfctl` from the United Kingdom Cloud

  rtfctl update --host gb1.platform.mulesoft.com

### `wait`

Waits for Runtime Fabric components to become ready

- Specifies the number of seconds to wait

rtfctl wait <value\_in\_seconds> --namespace <rtf\_namespace>

- Specifies the number of seconds to pass before timing out the wait (Default is 600 seconds)

rtfctl wait --timeout <value\_in\_seconds> --namespace <rtf\_namespace>

### `renew`

Renews an expired client certificate using a pre-downloaded package

rtfctl renew-expired-client-cert <cert-bundle-filename>

## Troubleshoot Runtime Fabric with RTFCTL

Use these commands to troubleshoot Runtime Fabric.

<table><colgroup><col> <col></colgroup><thead><tr><th>Command</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><a href="#get"><code>get</code></a></p></div></div></td><td><div><div><p>Displays one or more resources</p></div></div></td></tr><tr><td><div><div><p><a href="#ping"><code>ping</code></a></p></div></div></td><td><div><div><p>Tests network connectivity</p></div></div></td></tr><tr><td><div><div><p><a href="#report"><code>report</code></a></p></div></div></td><td><div><div><p>Generates a diagnostics report</p></div></div></td></tr><tr><td><div><div><p><a href="#status"><code>status</code></a></p></div></div></td><td><div><div><p>Displays the status of Runtime Fabric</p></div></div></td></tr><tr><td><div><div><p><a href="#test"><code>test</code></a></p></div></div></td><td><div><div><p>Verifies outbound network connectivity to the Runtime Fabric control plane</p></div></div></td></tr></tbody></table>

### `get`

Displays one or more resources

- Prints a list of all applications in all environments

  rtfctl get apps --namespace <rtf\_namespace>

- Prints a list of all applications in a specific environment

  rtfctl get apps --app-namespace <app\_namespace> --namespace <rtf\_namespace>

- Displays an HTTP proxy configurations

  rtfctl get http-proxy --namespace <rtf\_namespace>

- Displays a monitoring proxy configuration

  rtfctl get monitoring-proxy --namespace <rtf\_namespace>

- Displays secure properties

  rtfctl get secure-properties --app-namespace <app\_namespace> --namespace <rtf\_namespace>

- Displays the Mule license

  rtfctl get mule-license --namespace <rtf\_namespace>

- Displays Runtime Fabric registry credentials

  rtfctl get registry-credentials <activation\_data>

### `ping`

Tests network connectivity

- Pings example.com from inside an application, using the first replica by default

  rtfctl ping <app\_name> <host\_or\_ip\_address> --app-namespace <app\_namespace> --namespace
  <rtf\_namespace>

- Attempts to connect to example.com on port `12345` from inside an application, using the first
  replica by default

  rtfctl ping <app\_name> <host\_or\_ip\_address> --port <port> --app-namespace <app\_namespace>
  --namespace <rtf\_namespace>

### `report`

Generates a diagnostics report at `rtf-report.tar.gz`

rtfctl report --namespace <rtf\_namespace>

Run rtfctl report tasks in parallel by using the `workers` flag that controls the number of tasks to
run in parallel. The default value is 10.

rtfctl report --workers <num\_of\_workers>

Faster compression of the tarball generated by `rtfctl report` with the `--use-fast-compression`
flag. The default value is false.

rtfctl report --use-fast-compression=true

Select which application namespaces to include in the report besides the installation namespace by
using the `--namespaces` flag. The flag controls what to include in the reports and can result in
faster collection if only selected namespaces are reported.

# Reports rtf installation default namespace (rtf)

rtfctl report

# Reports only <rtf\_namespace>

rtfctl report -n <rtf\_namespace>

# Reports for <app\_namespace\_1> and <app\_namespace\_2> application namespaces that belong to <rtf\_namespace>

rtfctl report -n <rtf\_namespace> --app-namespaces <app\_namespace\_1>,<app\_namespace\_2> rtfctl
report -n <rtf\_namespace> --app-namespaces <app\_namespace\_1> --app-namespaces <app\_namespace\_2>

# Report for all application namespaces that belong to <rtf\_namespace>

rtfctl report -n <rtf\_namespace> --app-namespaces all

Specifies the name of the helm release to support installations using custom release names.

rtfctl report --release-name <agentReleaseName>

### `status`

Displays the status of Runtime Fabric

- Displays status output in JSON

  rtfctl status --output json --namespace <rtf\_namespace>

- Checks Kubernetes DNS health

  rtfctl status dns-check --node-label "<k>:<v>"

### `test`

Verifies outbound network connectivity to the Runtime Fabric control plane.

- Schedules a check on any nodes

  rtfctl test outbound-network --namespace <rtf\_namespace>

- Schedules a check the nodes satisfying the `node-label` parameter

  rtfctl test outbound-network --node-label "<k>:<v>" --namespace <rtf\_namespace>

- Schedules a check on all nodes

  rtfctl test outbound-network --all --namespace <rtf\_namespace>

## Manage Mule Apps on Runtime Fabric with RTFCTL

Use these commands to manage applications deployed to Runtime Fabric.

<table><colgroup><col> <col></colgroup><thead><tr><th>Command</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><a href="#delete"><code>delete</code></a></p></div></div></td><td><div><div><p>Deletes a secure property</p></div></div></td></tr><tr><td><div><div><p><a href="#describe"><code>describe</code></a></p></div></div></td><td><div><div><p>Displays details for an application</p></div></div></td></tr><tr><td><div><div><p><a href="#disk"><code>disk</code></a></p></div></div></td><td><div><div><p>Displays disk usage for an application</p></div></div></td></tr><tr><td><div><div><p><a href="#memory"><code>memory</code></a></p></div></div></td><td><div><div><p>Displays the JVM memory usage in a pod</p></div></div></td></tr><tr><td><div><div><p><a href="#package"><code>package</code></a></p></div></div></td><td><div><div><p>Creates a debugging information package for an application</p></div></div></td></tr><tr><td><div><div><p><a href="#restart"><code>restart</code></a></p></div></div></td><td><div><div><p>Restarts an application</p></div></div></td></tr><tr><td><div><div><p><a href="#heapdump"><code>heapdump</code></a></p></div></div></td><td><div><div><p>Captures a JVM heap dump</p></div></div></td></tr><tr><td><div><div><p><a href="#threaddump"><code>threaddump</code></a></p></div></div></td><td><div><div><p>Captures a JVM thread dump</p></div></div></td></tr></tbody></table>

### `delete`

Deletes a secure property

rtfctl delete secure-property <sample\_key> -n <app\_namespace>

### `describe`

Displays details for an application in a specific namespace

rtfctl describe apps <app\_name> --namespace <rtf\_namespace> rtfctl describe apps <app\_name>
--app-namespace <app\_namespace> --namespace <rtf\_namespace>

### `disk`

Displays disk usage for an application

- Displays the disk usage for an application, using the first replica by default

  rtfctl disk <app\_name> --app-namespace <app\_namespace> --namespace <rtf\_namespace>

- Displays the disk usage for an application, using a specific replica

  rtfctl disk <app\_name> --details --pod <replica\_name> --app-namespace <app\_namespace>
  --namespace <rtf\_namespace>

### `memory`

Displays the JVM memory usage in a pod

- Gets the JVM memory for each replica

  rtfctl memory <app\_name> --app-namespace <app\_namespace> --namespace <rtf\_namespace>

- Gets the JVM memory for a particular replica

  rtfctl memory <app\_name> --pod <replica\_name> --app-namespace <app\_namespace> --namespace
  <rtf\_namespace>

### `package`

Creates a debugging information package for an application

- Creates a package for an application using the first pod by default

  rtfctl package <app\_name> <application\_package\_filename> --app-namespace <app\_namespace>
  --namespace <rtf\_namespace>

- Creates a package for an application containing the apps, policies, and `.mule` directories

  rtfctl package <app\_name> <application\_package\_filename> --apps --policies --dotmule
  --app-namespace <app\_namespace> --namespace <rtf\_namespace>

- Creates a package for an application containing a heap dump

  rtfctl package <app\_name> <application\_package\_filename> --heap-dump --app-namespace
  <app\_namespace> --namespace <rtf\_namespace>

### `restart`

Restarts an application

rtfctl restart <app\_name> --app-namespace <app\_namespace> --namespace <rtf\_namespace>

### `heapdump`

Triggers a JVM heap dump

- Performs a JVM heap dump for an application, saving it as `` `/tmp/dump.hprof ``, using the first
  replica by default

  rtfctl heapdump <app\_name> <destination\_path> --app-namespace <app\_namespace> --namespace
  <rtf\_namespace>

- Performs a JVM heap dump for an application, saving it as `/tmp/dump.hprof`, using a specific
  replica

  rtfctl heapdump <app\_name> <destination\_path> --pod <replica\_name> --app-namespace
  <app\_namespace> --namespace <rtf\_namespace>

### `threaddump`

Triggers a JVM threaddump

- Performs a JVM thread dump for an application using the first replica by default

  rtfctl threaddump <app\_name> --app-namespace <app\_namespace> --namespace <rtf\_namespace>

- Performs a JVM thread dump for an application using a specific replica

  rtfctl threaddump <app\_name> --pod <replica\_name> --app-namespace <app\_namespace> --namespace
  <rtf\_namespace>

## Manage the Agent Truststore with RTFCTL

Use these commands to inspect and update the CA certificates the Runtime Fabric agent uses for mTLS
connections to the Anypoint control plane.

<table><colgroup><col> <col></colgroup><thead><tr><th>Command</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><a href="#agent-truststore-info"><code>agent-truststore info</code></a></p></div></div></td><td><div><div><p>Print a summary of the agent truststore and <code>ca.pem</code></p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-retrieve-truststore"><code>agent-truststore retrieve-agent-truststore</code></a></p></div></div></td><td><div><div><p>Download the PKCS#12 truststore from the cluster secret to a local file</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-retrieve-ca-pem"><code>agent-truststore retrieve-ca-pem</code></a></p></div></div></td><td><div><div><p>Download the ca.pem bundle from the cluster secret to a local file</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-merge-p12"><code>agent-truststore merge-pem-into-p12</code></a></p></div></div></td><td><div><div><p>Add certificates from a PEM file into a local PKCS#12 truststore</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-merge-pem"><code>agent-truststore merge-pem-into-pem</code></a></p></div></div></td><td><div><div><p>Add certificates from one PEM file into another PEM bundle</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-update-truststore"><code>agent-truststore update-truststore-in-secret</code></a></p></div></div></td><td><div><div><p>Upload a local PKCS#12 truststore into the cluster secret</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-update-ca-pem"><code>agent-truststore update-ca-pem-in-secret</code></a></p></div></div></td><td><div><div><p>Upload a local PEM bundle into the cluster secret as ca.pem</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-refresh"><code>agent-truststore refresh-secret-with-pem</code></a></p></div></div></td><td><div><div><p>Merge a PEM into the cluster truststore and ca.pem in one step</p></div></div></td></tr></tbody></table>

### `agent-truststore info`

Prints a summary of the agent keystore secret, including all certificates loaded in the PKCS#12
truststore and ca.pem, along with their subjects, expiry dates, and days remaining.

- Print a human-readable summary

  rtfctl agent-truststore info --namespace rtf

- Print machine-readable JSON output

  rtfctl agent-truststore info -o json --namespace rtf

### `agent-truststore retrieve-agent-truststore`

Downloads the `agent-truststore.p12` file from the cluster secret to a local file. The password is
read automatically from the `truststore-password` key in the secret.

rtfctl agent-truststore retrieve-agent-truststore -o agent-truststore-bk.p12 --namespace rtf

- Override the secret name and the output file

  rtfctl agent-truststore retrieve-agent-truststore --secret agent-keystore -o
  agent-truststore-bk.p12 --namespace rtf

### `agent-truststore retrieve-ca-pem`

Downloads the `ca.pem` bundle from the cluster secret to a local file.

rtfctl agent-truststore retrieve-ca-pem -o ca-bk.pem --namespace rtf

### `agent-truststore merge-pem-into-p12`

Adds the certificates from a PEM file into a local PKCS#12 truststore file (certificates-only
format). Duplicate certificates are detected by subject and skipped.

rtfctl agent-truststore merge-pem-into-p12 -i agent-truststore-bk.p12 -c new-ca.pem -o
agent-truststore-new.p12

### `agent-truststore merge-pem-into-pem`

Merges certificates from one PEM file into another PEM bundle. Duplicate certificates are detected
by subject and skipped.

rtfctl agent-truststore merge-pem-into-pem -i ca-bk.pem -c new-ca.pem -o ca-new.pem

### `agent-truststore update-truststore-in-secret`

Uploads a local PKCS#12 file into the agent keystore secret, replacing the `agent-truststore.p12`
key.

rtfctl agent-truststore update-truststore-in-secret -i agent-truststore-new.p12 --namespace rtf

### `agent-truststore update-ca-pem-in-secret`

Uploads a local PEM bundle into the agent keystore secret, replacing the `ca.pem` key.

rtfctl agent-truststore update-ca-pem-in-secret -i ca-new.pem --namespace rtf

### `agent-truststore refresh-secret-with-pem`

Reads the current truststore and `ca.pem` from the cluster secret, merges the provided PEM into
both, displays the certificate subjects to upload, and—after confirmation—patches the secret. Use
`--yes` to skip the interactive prompts.

- Interactive (asks for confirmation before each upload)

  rtfctl agent-truststore refresh-secret-with-pem -c new-ca.pem --namespace rtf

- Non-interactive (suitable for automation)

  rtfctl agent-truststore refresh-secret-with-pem -c new-ca.pem --yes --namespace rtf

## Uninstall Runtime Fabric with RTFCTL

To uninstall Runtime Fabric using `rtfctl` commands, follow these steps:

1.  Using Runtime Manager, delete all Mule app and API gateways deployed on Runtime Fabric.

2.  Verify on all associated environments that you have removed all applications.

3.  In Runtime Manager, delete the Runtime Fabric.

4.  Run the `rtfctl uninstall` command to uninstall the Runtime Fabric services from the Kubernetes
    cluster.

5.  Run the `rtfctl uninstall --confirm` command to verify the uninstall operation.

6.  After the uninstall command finishes, verify that there are no Runtime Fabric applications or
    services running in the cluster.

## See Also

- [Using RTFCTL Tool Overview](https://docs.mulesoft.com/runtime-fabric/latest/using-rtfctl)