cloudtaser-cli beacon tenant issue¶
Generate one independent 32-byte tenant registration key. Send the same salt-free {tenant_id,auth_key} JSON record to --relay-record-fd and --handoff-fd. Both descriptors must be distinct private writable pipes numbered 3 or higher; stdout, stderr, regular files, terminals and shared pipes are refused. No salt is generated here. Run source configure --beacon-tenant-stdin at the source to create its salt. The supervisor must wait for BOTH consumers and retain only non-secret receipts. Issuance alone does not prove Secret Manager or source provisioning succeeded.
The --tenant-id is canonicalized per wire rules (lowercased). Non-canonical uppercase hex input is accepted and lowercased before use.
With --dry-run, no key is generated and no data is written to any pipe. Instead, the record shape with a redacted key is printed to stderr.
Usage¶
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--dry-run |
bool | false |
no | print the record shape with a redacted key; generate no key and write no pipes |
--handoff-fd |
int | -1 |
no | separate private inherited pipe to source configure stdin |
--help, -h |
bool | false |
no | help for issue |
--relay-record-fd |
int | -1 |
no | private inherited pipe to Secret Manager version creation stdin |
--tenant-id |
string | (empty) |
no | canonical public tenant ID (lowercase hex/UUID; uppercase is canonicalized) |
--timeout |
duration | 20m0s |
no | maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env) |