cloudtaser-cli source apply-plan

Reads a MigrationPlan YAML file and provisions the secret store with the exact-record policies and finite ServiceAccount roles for each app identity. Multiple app identities in one tenant use --read/-role. The old shared tenant policy is preserved. Update workload role annotations with target migrate and roll workloads first; then rerun with --retire-legacy to explicitly replace the old shared policy with deny-only. Workloads that share a ServiceAccount must declare identical records.

Existing policies and roles are inspected before any writes. Changed grants require --replace-app-policy; changed bindings require --replace-app-role. Each acknowledgement affects every consumer and needs a maintenance window.

For each tenant in the plan: 1. Creates an OpenBao policy "-read" with read access to exact declared app records 2. Creates a Kubernetes auth role "-role" bound to the tenant's namespace and explicit app ServiceAccount 3. Ensures the KV v2 engine is mounted

This command does NOT write secret values -- populating the actual secret data in the secret store is the user's responsibility.

Usage

cloudtaser-cli source apply-plan [plan.yaml] [flags]

Examples

# Apply plan to the secret store
  cloudtaser-cli source apply-plan plan.yaml \
    --secretstore-address https://bao.example.com:8200 \
    --ca-cert ./source-ca.pem --secretstore-token-file ./private-bootstrap.token

  # Dry-run to preview what would be created
  cloudtaser-cli source apply-plan plan.yaml \
    --secretstore-address https://bao.example.com:8200 \
    --ca-cert ./source-ca.pem --secretstore-token-file ./private-bootstrap.token --dry-run

Flags

Flag	Type	Default	Required	Description
--ca-cert	string	(empty)	no	alias for --secretstore-ca-file (verified private-CA trust)
--dry-run	bool	false	no	print what would be created without making changes
--help, -h	bool	false	no	help for apply-plan
--kv-mount	string	secret	no	KV v2 mount path
--replace-app-policy	bool	false	no	acknowledge changing live app grants for all policy consumers (maintenance window)
--replace-app-role	bool	false	no	acknowledge rebinding live app roles for all role consumers (maintenance window)
--retire-legacy	bool	false	no	after re-annotating and rolling workloads onto new per-app roles, explicitly retire their old shared policy (maintenance acknowledgement)
--secretstore-address	string	(empty)	no	secret store address (required; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-auth-path	string	kubernetes	no	kubernetes auth mount path
--secretstore-ca-file	string	(empty)	no	PEM CA bundle for verified secret-store TLS (env: VAULT_CACERT)
--secretstore-token	string	(empty)	no	secretstore token with admin privileges
--secretstore-token-file	string	(empty)	no	path to file containing token, or '-' for stdin
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--workload-cidrs	string	(empty)	no	optional app-token source CIDRs; ineffective behind shared NAT; does not stop node root

All commands