cloudtaser-cli source authority revoke-tokens¶
Stop every Port in the instance and these operators before use. These commands require independent administrator credentials and verified HTTPS. revoke-tokens enumerates all service-token accessors, matches cluster policies and creation roles from every retained catalog or legacy policy/metadata, revokes matches and requires a second empty scan. It also selects cloudtaser-port AppRole logins of the instance, which hold catalog-wide authority, so stop every native Port in the instance first; their reusable SecretIDs are not retired here. Host-launch login tokens require source host-launch revoke for each old approval before this cluster scan. Offline revoke-tokens and rotate-salt refuse any launch in the instance with a live policy, AppRole or login token using the source reservation inventory. Offline rotate-salt also refuses while the ct-retire-mint-brake quota exists or tokens selected for any catalog fingerprint remain. Dry-run/preflight skip these checks. Close descendants with revoke-tokens for every fingerprint in each old launch catalog. Repeated lookup failures require administrator auth/token/tidy, wait, and offline retry; tidy alone does not retire live tokens. rotate-salt checks the managed catalog and replaces salt, registration hashes and the selected source-introduction material snapshot (increasing its revision) with no overlap. rotate-salt requires --prior-info-hash captured from beacon-config before the window; material must still match that baseline, and the final hash must differ. Use exactly one of --enrollment-id E or --host-port. The host-launch/private introduction path needs no enrollment or material; it refuses any source introduction enrollment for the cluster. Its salt record retains only the public rotation_prior_info_hash with the new salt, allowing retries with the original baseline, including a lost final response. Host rotation also requires --salt-baseline-version captured after revocation and writer containment, before the first attempt; retain that same version on every retry. A matching salt hash requires that exact version; recovery requires a newer version and the marker. rotate-salt --host-port --preflight validates first-attempt readiness without writes or an offline requirement; it does not capture the post-revoke witness. Re-export and activate after rotation. Writes are sequential: on failure keep the cohort offline and rerun rotate-salt with the same baseline to resume forward. If material already advanced, review completion receipts before starting a new rotation with a new baseline. revoke-tokens --dry-run validates retained catalogs and scans tokens without revocation or an offline requirement; repeat the real scan after stopping issuers. Never restore exposed salt or certificate versions. No certificate is rotated by these commands; use source rotate-certs separately.
Usage¶
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--confirm-offline |
bool | false |
no | attest all serving Ports and affected operators are stopped and cannot auto-restart |
--dry-run |
bool | false |
no | read-only catalog/token preflight before stopping issuers; does not revoke tokens |
--fingerprint |
string | (empty) |
yes | exact registered cluster fingerprint |
--help, -h |
bool | false |
no | help for revoke-tokens |
--instance |
string | (empty) |
yes | managed source authority instance (all retained generations are scanned) |
--secretstore-address |
string | (empty) |
no | administrator OpenBao HTTPS address |
--secretstore-ca-file |
string | (empty) |
no | PEM CA bundle for verified administrator OpenBao TLS |
--secretstore-token-file |
string | (empty) |
no | independent administrator token file or '-' for stdin |
--timeout |
duration | 20m0s |
no | maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env) |