On-box commands

Two separate command sets reach a Customer Edge, and neither contains the other.

• On the box, the Site CLI has 6 top-level commands and 89 execcli subcommands.
• Over the network, the debug API has its own catalog of 43.

Most of the on-box surface has no API equivalent: the whole Vega control plane, the Envoy wrappers, packet capture, the kubelet parameter set, the edit-* files and the auxiliary root-access pair are reachable only from the box.

Getting to them needs SSH or the serial console, and one thing that is documented nowhere:

execcli is a hidden command

execcli does not appear in the Site CLI’s interactive menu. It takes a command name as its argument, and typing execcli followed by Tab lists all 89 with the appliance’s own one-line description for each. That completion menu is the authoritative catalog for a build, and it is what sitecli/exec-catalog.json records.

How this was measured, and how the sets overlap

The set below is not transcribed from a vendor document. It was read from a live node with scripts/sitecli_ssh_harvest.py and committed to sitecli/exec-catalog.json with its provenance. The current catalog records software build crt-20260201-0179, site state PROVISIONED, and capture time 2026-08-03T16:47:48Z.

Against the debug API’s 43 commands, that gives two figures worth keeping straight:

• 49 execcli subcommands have no API equivalent.
• 54 commands across the whole on-box surface have no API equivalent; the additional five live at the top level rather than under execcli.

Both are correct; a reader who recomputes one and finds the other has not made a mistake. Every figure here derives from sitecli/catalog.json and sitecli/exec-catalog.json.

Five commands that do not exist

factory-reset, upgrade, reboot, show and clear are not on this build. They are the kind of thing a Site CLI plausibly has, they were carried in this repository’s classification for a while on that assumption, and no enumeration found them. The top level has exactly six entries: configure, configure-generic-hardware, configure-network, configure-http-proxy, diagnosis and update-tx-queue-len-vhost0.

Three API commands are not execcli subcommands

Looking for these under execcli finds nothing, which reads as “the command is missing”:

• diagnosis is a top-level Site CLI command. Type it at the >>> prompt directly, with no execcli prefix.
• health and dig are reachable over the debug API and appear in neither on-box menu. They are API-only on this build.

What is documented, and what is only listed

A Customer Edge runs Linux and a number of third-party daemons. Documenting their commands would duplicate their own references and imply F5 owns them, so the rule is: document F5’s software, and for everything else document only what is specific to a CE.

Three tiers, because “ours” and “theirs” is not a clean split. The split is recorded in sitecli/command-classification.json.

Tier	Treatment
F5 software	Full documentation — purpose, syntax, arguments, captured output, what to look for. Argo, Vega, vpm, vifdump, configure*, the edit-* set, kubelet parameters, root access.
CE-specific interpretation	A third-party tool whose output means something particular on a CE. The CE-specific reading is documented and the tool’s own semantics are left upstream.
Passthrough	Plain Linux or third-party with nothing CE-specific to say. Listed as available, with a pointer upstream. No prose.

That distinction decides whether a page exists at all, and it is what keeps this documentation from rotting into a worse copy of the man pages.

F5 software

Vega control planeSix vegactl commands: configuration objects, introspection tables, trace buffers, and which node holds the primary role.

EnvoyFour wrappers around Envoy's admin interface — listeners, clusters, and two config dumps.

Packet captureThe five vifdump commands. Documented, never run here: they write capture files onto the node.

Kubelet parametersRead, add and remove custom kubelet parameters. Support-directed.

vpm serviceThe agent that registers the node and runs the platform containers.

Configuration filesThe four edit-* commands that open F5-owned files on the node.

Auxiliary root accessCreating and removing the xuser root account. Support-directed, and it leaves the node modified.

Node configurationThe four configure* commands at the Site CLI top level.

Passthrough

Available on the box and not documented here — these are the operating system and third-party daemons, not F5’s software, and their own references are better than anything this page could restate.

Commands	Upstream
ping, netstat, lsof, ip, ip-link-show, nmcli, tracepath	iproute2, NetworkManager
top, check-mem, sysctl, load-sysctl-conf, journalctl, files, rpm-ostree, chronyc-sources	coreutils, procps, systemd, rpm-ostree, chrony
edit-etc-hosts, edit-sysctl-conf	The files are the operating system’s
systemctl-status-crio, systemctl-status-docker, systemctl-status-kubelet, systemctl-status-iscsid, systemctl-status-multipathd	systemd
systemctl-restart-crio, systemctl-restart-docker, systemctl-restart-kubelet, systemctl-restart-iscsid, systemctl-restart-multipathd	systemd — every one of these interrupts workloads on the node

Two of these are worth knowing about even though they get no page. files performs file operations and will only write beneath /tmp. And every systemctl-restart-* is disruptive by definition — restarting crio or kubelet interrupts the workloads on that node.

Maintenance commands need an explicit safety classification

The seven additions to this build’s on-box menu are collect-database-stats, iptables-lv, the three marker-exists-* commands, systemctl-restart-NetworkManager and systemctl-start-crio-prune. Maintenance commands documents which are read-only, which write, and which are never executed.

collect-debug-info is a separate case: it appears in no menu and no catalog. The Site CLI welcome text says the CLI “allows to … collect debug information for support”, so the name was most likely derived from that prose rather than observed. It is marked unverified and deliberately not probed — running an unknown command speculatively on a live node is how a vifdump packet capture got started on a CE that was still registering.