Command reference

Reference release: v0.19.176.

This reference is derived from the published cloudtaser-cli Cobra command tree, flag definitions and help. It describes the release pinned by this reference; qualification of live behavior is separate.

Command	Purpose
cloudtaser-cli	CloudTaser CLI — deploy, discover, and diagnose workload secret protection
cloudtaser-cli assess	Assess protection readiness and the next step for each node pool
cloudtaser-cli assess node-evidence	Read platform facts directly on a target Linux node
cloudtaser-cli beacon	Manage cloudtaser-beacon relay instances
cloudtaser-cli beacon install	Install a cloudtaser-beacon instance (systemd | docker | k8s | kubernetes)
cloudtaser-cli beacon join	Add a new beacon to an existing HA cluster via --bootstrap-from
cloudtaser-cli beacon status	Query a cloudtaser-beacon's health, gossip, and ring state
cloudtaser-cli beacon tenant	Administer isolated relay tenant credentials
cloudtaser-cli beacon tenant issue	Issue one key to two private inherited pipes
cloudtaser-cli completion	Generate the autocompletion script for the specified shell
cloudtaser-cli completion bash	Generate the autocompletion script for bash
cloudtaser-cli completion fish	Generate the autocompletion script for fish
cloudtaser-cli completion powershell	Generate the autocompletion script for powershell
cloudtaser-cli completion zsh	Generate the autocompletion script for zsh
cloudtaser-cli debug	Comprehensive system diagnostic report
cloudtaser-cli demo	Demo commands — generate scripts, run steps, serve the interactive demo
cloudtaser-cli demo generate	Generate an end-to-end CloudTaser sovereignty demo script
cloudtaser-cli demo run	Execute demo steps natively with JSON event output
cloudtaser-cli demo serve	HTTP server + session manager for the interactive web demo
cloudtaser-cli emergency	Emergency incident response operations
cloudtaser-cli emergency revoke	Mass-revoke vault tokens for incident response
cloudtaser-cli help	Help about any command
cloudtaser-cli preflight	Deprecated: use assess --component to check requirements
cloudtaser-cli source	Manage the secret source (OpenBao)
cloudtaser-cli source apply-plan	Apply a migration plan to the secret store (create policies and roles)
cloudtaser-cli source authority	Prepare administrator-approved enrollment authority
cloudtaser-cli source authority activate	Bind a staged graph after administrator maintenance
cloudtaser-cli source authority approve-operator-mint	Publish immutable finite operator scope; source activation is separate
cloudtaser-cli source authority binding	Read an active, verified public authority binding
cloudtaser-cli source authority export-operator-introduction	Export the active registered operator introduction to a private file
cloudtaser-cli source authority host-launch-policy	Render the managed host launch policy from public authority approval
cloudtaser-cli source authority prepare	Render a public, exact read-only workload authority approval
cloudtaser-cli source authority provision	Stage a verified immutable authority generation and target JWT trust
cloudtaser-cli source authority refresh-jwks	Refresh the active cluster's JWT keys; restart Port after success
cloudtaser-cli source authority render	Render the exact public authority document
cloudtaser-cli source authority revoke-tokens	Offline administrator maintenance for CA retirement
cloudtaser-cli source authority rotate-salt	Offline administrator maintenance for CA retirement
cloudtaser-cli source check	Check OpenBao readiness for CloudTaser
cloudtaser-cli source configure	Configure policies, roles, and auth methods on the secret store
cloudtaser-cli source deregister	Remove a cluster registration from the secret store
cloudtaser-cli source host-launch	Admit one managed Port process on this administrator-controlled Linux host
cloudtaser-cli source host-launch prepare	Prepare a public signed-release-bound approval on the EU Linux host
cloudtaser-cli source host-launch reconcile	Remove an expired launch's exact source AppRole and policy
cloudtaser-cli source host-launch revoke	Retire a stopped launch's exact AppRole, policy and login tokens
cloudtaser-cli source host-launch-managed	Managed autonomous Port launch using platform identity
cloudtaser-cli source install	Install and bootstrap a secret store for CloudTaser
cloudtaser-cli source install bao	Deploy TLS-secured OpenBao on Kubernetes via Helm
cloudtaser-cli source install port	Configure a secret store and deploy CloudTaser Port
cloudtaser-cli source peer	Manage beacon peers for a source secret store
cloudtaser-cli source peer approve	Approve and activate a new beacon peer from its ctb1 token
cloudtaser-cli source prepare	Prepare finite administrator source resources
cloudtaser-cli source prepare port-introduction-pki	Prepare and read back dedicated Port introduction PKI
cloudtaser-cli source provision-bao-tls	Provision barrier-backed OpenBao listener PKI after initialization and unseal
cloudtaser-cli source rebootstrap	Perform an explicitly authorized credential rebootstrap
cloudtaser-cli source rebootstrap port	Rebootstrap a fresh managed Port replacement Pod with a finite verified credential handoff
cloudtaser-cli source register	Advanced: pre-register cluster fingerprints in bulk
cloudtaser-cli source rotate-certs	Force-rotate port mTLS certificates for a registered cluster
cloudtaser-cli source session-authority	Prepare finite one-use source capabilities for reviewed demo sessions
cloudtaser-cli source status	Check secret store connectivity and health
cloudtaser-cli source verify-plan	Verify that all secrets in a migration plan exist in the secret store
cloudtaser-cli target	Manage the target Kubernetes cluster
cloudtaser-cli target activate-beacon-auth	Deliver a beacon auth key to the operator without storing it in Kubernetes objects
cloudtaser-cli target audit	Generate a data sovereignty compliance audit report
cloudtaser-cli target check	Deprecated: use cloudtaser-cli assess
cloudtaser-cli target connect	Connect a Kubernetes cluster to an external OpenBao instance
cloudtaser-cli target connect drata	Connect CloudTaser to Drata for automated compliance evidence
cloudtaser-cli target connect secureframe	Connect CloudTaser to Secureframe for automated compliance evidence
cloudtaser-cli target connect vanta	Connect CloudTaser to Vanta for automated compliance evidence
cloudtaser-cli target debug	Collect a diagnostic report from the CloudTaser operator
cloudtaser-cli target discover	Discover workloads using Kubernetes secrets or secret injector annotations
cloudtaser-cli target enroll	Enroll a Kubernetes cluster with the CloudTaser SaaS platform
cloudtaser-cli target enroll-introduction	Enroll CSI-free source introduction and emit public Helm values (experimental)
cloudtaser-cli target fingerprint	Print the cluster fingerprint for advanced pre-registration
cloudtaser-cli target fingerprint clear-latch	Recover an operator whose cluster-fingerprint check has latched
cloudtaser-cli target import	Generate a script to import secrets from a cloud provider into OpenBao
cloudtaser-cli target install	Install the CloudTaser operator on the target cluster
cloudtaser-cli target migrate	Migrate Kubernetes secrets to the EU secret store
cloudtaser-cli target migrate-introduction	Enroll and switch an existing CSI/authKey installation with verified live-template rollback (experimental)
cloudtaser-cli target migrate-port-ram-key	Migrate a native Port serving key with one operator restart and a bounded lease window
cloudtaser-cli target netpol	Generate Kubernetes NetworkPolicies to restrict secret store access
cloudtaser-cli target preflight	Discover read-only platform prerequisites and recommend a candidate values overlay
cloudtaser-cli target protect	Generate a protection plan to migrate workloads to CloudTaser
cloudtaser-cli target revoke	Emergency revoke target cluster vault tokens through the admin proxy
cloudtaser-cli target rotate	Trigger a rolling restart of CloudTaser-protected workloads
cloudtaser-cli target site-inputs	Discover and validate reviewed public site coordinates for a platform overlay
cloudtaser-cli target status	Show the status of CloudTaser components in the cluster
cloudtaser-cli target tail	Stream live enforcement events from the eBPF daemonset
cloudtaser-cli target uninstall	Uninstall CloudTaser from the target cluster
cloudtaser-cli target validate	Validate CloudTaser deployment and secret store connectivity
cloudtaser-cli version	Print the CLI version
cloudtaser-cli wire	Diagnose CloudTaser beacon wire protocol connectivity
cloudtaser-cli wire status	Run beacon wire-protocol reachability and pairing diagnostics