cloudtaser-cli source authority export-operator-introduction¶
Read the active source authority and registered pairing using an explicit administrator source credential. Verify the live kube-system UID against the requested fingerprint, then atomically create a complete six-field v2 bundle at --output, mode 0600, without overwriting anything. The existing parent must be owned by the caller with mode 0700 on tmpfs; symlink paths are refused. Unpublished cohort pins refuse before any file, source or credential access.
The file contains the tenant-wide beacon HMAC key and the cluster's registered salt, plus public tenant/authority metadata. It has no time-based expiry and is reusable while all fields still match the active source authority and pairing. Verify that tmpfs is non-swappable; the command cannot attest swap settings. Remove the file after activation or if you stop before activation, and export again after source rotation. No secret is printed.
Usage¶
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--dry-run |
bool | false |
no | validate public arguments without reading files, contacting source/cluster, or writing output |
--fingerprint |
string | (empty) |
yes | registered cluster kube-system UID; must match the live kubeconfig |
--help, -h |
bool | false |
no | help for export-operator-introduction |
--instance |
string | (empty) |
yes | active source authority instance |
--kubeconfig |
string | (empty) |
yes | explicit target kubeconfig |
--output |
string | (empty) |
yes | new absolute private file in an existing caller-owned mode-0700 tmpfs directory |
--secretstore-address |
string | (empty) |
yes | verified administrator source HTTPS origin |
--secretstore-ca-file |
string | (empty) |
no | verified source CA PEM |
--secretstore-token-file |
string | (empty) |
yes | explicit administrator credential file or '-' for private stdin |
--timeout |
duration | 20m0s |
no | maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env) |