cloudtaser-cli demo generate

Generates a shell script that runs an end-to-end demonstration of CloudTaser data sovereignty protection. The script is designed for asciinema recording and live presentations.

The demo walks through seven steps: 1. Deploy an unprotected sample app with a K8s Secret 2. Show the problem — secret visible in /proc/1/environ 3. Store the secret in an EU-hosted secret store 4. Annotate the deployment to enable CloudTaser injection 5. Verify secret is in memory only — not in K8s Secrets or /proc 6. Attempt /proc/PID/mem read — blocked by eBPF enforcement 7. Show the protection score from the wrapper health endpoint

The generated script is written to stdout. Review it carefully before executing.

Usage

cloudtaser-cli demo generate [flags]

Examples

# Generate demo script with defaults
  cloudtaser-cli demo generate

  # Generate with pauses for live presentation
  cloudtaser-cli demo generate --pause

  # Generate with cleanup and custom namespace
  cloudtaser-cli demo generate --namespace=my-demo --cleanup

  # Save to a file for asciinema recording
  cloudtaser-cli demo generate --pause > demo.sh && chmod +x demo.sh

Flags

Flag	Type	Default	Required	Description
--allow-http	bool	false	no	permit plain http:// secret store address (the public openbao helm chart defaults to HTTP; use this flag when targeting that listener)
--cleanup	bool	false	no	Include cleanup steps at the end
--help, -h	bool	false	no	help for generate
--namespace	string	cloudtaser-demo	no	Kubernetes namespace for the demo
--pause	bool	false	no	Add pauses between steps for live presentations
--secretstore-address	string	https://openbao.openbao.svc:8200	no	secret store address for the demo (defaults to https://; pass --allow-http for plain-HTTP listeners like the public openbao helm chart; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)

All commands