cloudtaser-cli emergency revoke

Immediately revokes all vault tokens associated with CloudTaser clusters.

Use this during a security incident when you need to: - Revoke all tokens for a specific cluster (--fingerprint) - Revoke all tokens across every registered cluster (--all) - Optionally lock down auth methods to prevent re-authentication (--lockdown) - Clean up per-cluster policies

This is an irreversible emergency operation. Revoked tokens cannot be recovered; affected workloads will lose vault access until new tokens are provisioned via a fresh target connect / source register cycle.

Usage

cloudtaser-cli emergency revoke [flags]

Examples

# Revoke tokens for a single compromised cluster.
  cloudtaser-cli emergency revoke \
    --fingerprint 0ad50c05-1153-4508-9237-4cb2912e2c23 \
    --secretstore-address https://vault.eu.example.com \
    --secretstore-token-file /etc/cloudtaser/admin.token

  # Revoke tokens for ALL clusters (full lockdown during a breach).
  cloudtaser-cli emergency revoke --all --lockdown --yes \
    --secretstore-address https://vault.eu.example.com \
    --secretstore-token-file /etc/cloudtaser/admin.token

  # Preview what would happen without making changes.
  cloudtaser-cli emergency revoke --all --dry-run \
    --secretstore-address https://vault.eu.example.com

Flags

Flag	Type	Default	Required	Description
--all	bool	false	no	revoke tokens for ALL registered clusters
--dry-run	bool	false	no	show what would be revoked without making changes
--fingerprint	string	(empty)	no	revoke tokens for a specific cluster fingerprint
--help, -h	bool	false	no	help for revoke
--lockdown	bool	false	no	also disable K8s auth methods after revoking tokens
--secretstore-address, -a	string	(empty)	no	secret store address (required; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-allow-insecure	bool	false	no	allow explicitly requested insecure secret store TLS options (development only)
--secretstore-skip-verify	bool	false	no	skip secret store TLS certificate verification (requires --secretstore-allow-insecure; development only)
--secretstore-token	string	(empty)	no	secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure)
--secretstore-token-file	string	(empty)	no	path to a file containing the secret store token, or '-' to read it from stdin
--tenant-id	string	(empty)	no	revoke tokens for a specific tenant (not yet implemented)
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--yes, -y	bool	false	no	skip confirmation prompt

All commands