cloudtaser-cli demo run

Executes one or all demo steps, emitting JSON events to stdout for each action taken. When --step is set to a specific step number (1-7), only that step runs. When --step is 0 (default), all steps run sequentially.

Each output line is a JSON object: {"step": 1, "type": "line", "data": "Creating namespace demo-abc123..."} {"step": 1, "type": "done", "data": "step_complete: namespace ready"}

This command is designed to be called by 'demo serve', which reads the JSON events and routes them to SSE channels for the browser.

Step 5 (and --step 0) requires an explicit scoped Secretstore token via --secretstore-token-file PATH or - for stdin. Token input is bounded to 64 KiB and validated before any cluster access. No token environment variable or default token file is read. Other steps can run without a Secretstore token.

Usage

cloudtaser-cli demo run [flags]

Examples

# Run all steps
  cloudtaser-cli demo run --namespace demo-test --secretstore-token-file -

  # Run only step 1
  cloudtaser-cli demo run --step 1 --namespace demo-test

  # Run step 3 with explicit fingerprint
  cloudtaser-cli demo run --step 3 --fingerprint 0ad50c05-1153-4508-9237-4cb2912e2c23 \
    --vm3-relay https://relay.example.com

Flags

Flag	Type	Default	Required	Description
--beacon-address	string	beacon.cloudtaser.io:443	no	beacon address
--beacon-auth-key	string	(empty)	no	hex-encoded beacon auth key (operator.broker.beacon.authKey); if empty, step 4 fetches from vm3-relay or vault
--chart-version	string	(empty)	no	helm chart version to install
--fingerprint	string	(empty)	no	cluster fingerprint (UUID); if omitted, auto-derived from kube-system UID
--help, -h	bool	false	no	help for run
--init-salt	string	(empty)	no	hex-encoded 32-byte beacon init salt (operator.broker.beacon.initSalt); if empty, step 4 fetches from vault via vm3-relay
--kubeconfig	string	(empty)	no	path to kubeconfig file
--namespace, -n	string	(empty)	no	demo namespace to create/use (e.g. demo-abc123)
--secretstore-address	string	https://localhost:8200	no	secret store address
--secretstore-token-file	string	(empty)	no	explicit scoped migrate token path or - for stdin (required for step 5 or all steps)
--step	int	0	no	step number to execute (1-7); 0 runs all sequentially
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--vm3-relay	string	(empty)	no	Secret-store relay address for step 3 registration (HTTPS required by default)
--vm3-relay-insecure	bool	false	no	allow http:// scheme for --vm3-relay (trusted development/VPC endpoints only)
--vm3-relay-token	string	(empty)	no	bearer token for vm3-relay authentication (falls back to DEMO_VM3_RELAY_TOKEN env)

All commands