cloudtaser-cli beacon join

Joins a new beacon instance to an existing HA cluster.

This is a thin wrapper around 'beacon install' with --bootstrap-from pre-set and --peers unset. The CLI resolves the bootstrap DNS name upfront to ensure at least one existing beacon is reachable; otherwise the new node would boot into a solo ring and the operator would not notice until gossip metrics dipped below expected.

join always installs a single instance. To initialise a fresh HA cluster of 3+ beacons at once, use 'beacon install --replicas 3 --type k8s' instead.

Usage

cloudtaser-cli beacon join [flags]

Examples

# Add a fourth beacon to an existing 3-node cluster
  cloudtaser-cli beacon join \
    --type systemd \
    --advertise-addr beacon-4.example.com:443 \
    --bootstrap-from beacon.example.com \
    --gossip-key-file     ./gossip.key \
    --internal-ca-cert-file ./internal-ca.crt \
    --internal-ca-key-file  ./internal-ca.key \
    --internal-cert-file  ./internal.crt \
    --internal-key-file   ./internal.key \
    --public-cert-file    ./beacon-cert.pem \
    --public-key-file     ./beacon-key.pem

Flags

Flag	Type	Default	Required	Description
--advertise-addr	string	(empty)	no	public host:port clients dial (required for --type=systemd/docker)
--allow-any-sni	bool	false	no	explicitly allow any TLS ServerName for an IP-literal systemd/docker install (mutually exclusive with --allowed-sni)
--allowed-sni	string	(empty)	no	comma-separated exact TLS ServerName values accepted by local systemd/docker installs (default: derive the DNS name from --advertise-addr)
--beacon-version	string	(empty)	no	cloudtaser-beacon release tag (default: reviewed CLI companion pin v0.6.23; an override must be a release >= v0.6.21; never resolved from mutable latest)
--bootstrap-from	string	(empty)	no	public DNS of the existing cluster (required)
--dry-run	bool	false	no	render artefacts to stdout without applying
--gossip-key-file	string	(empty)	no	path to the base64-encoded gossip key file (must match the existing cluster)
--help, -h	bool	false	no	help for join
--image	string	(empty)	no	container image reference (--type=k8s only)
--internal-ca-cert-file	string	(empty)	no	path to the cluster's inner-hop mTLS CA cert
--internal-ca-key-file	string	(empty)	no	path to the cluster's inner-hop mTLS CA key
--internal-cert-file	string	(empty)	no	path to this node's inner-hop mTLS leaf cert (signed by the cluster CA)
--internal-key-file	string	(empty)	no	path to this node's inner-hop mTLS leaf key
--namespace, -n	string	cloudtaser-beacon	no	Kubernetes namespace (--type=k8s only)
--public-cert-file	string	(empty)	no	path to this node's public :443 TLS cert
--public-key-file	string	(empty)	no	path to this node's public :443 TLS key
--release-name	string	cloudtaser-beacon	no	release name (--type=k8s only)
--secretstore-address	string	(empty)	no	secret store address for storing the config encryption key (required)
--secretstore-allow-insecure	bool	false	no	required with --secretstore-skip-verify
--secretstore-skip-verify	bool	false	no	skip TLS verification (requires --secretstore-allow-insecure)
--secretstore-token	string	(empty)	no	secret store token (DEPRECATED for argv; prefer SECRETSTORE_TOKEN env or --secretstore-token-file)
--secretstore-token-file	string	(empty)	no	path to a file containing the secret store token, or '-' for stdin
--tenant-mode	string	single	no	beacon trust-boundary model for local systemd/docker installs (single is the supported safe model)
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--type	string	(empty)	no	install type: systemd, docker, or k8s (required)

All commands