cloudtaser-cli source check

Performs preflight checks on the OpenBao instance to determine readiness for CloudTaser deployment.

Checks performed: - Connectivity (can reach secret store address) - Health (initialized, unsealed) - Kubernetes auth method enabled - KV v2 engine mounted - Wrapper policy exists - Wrapper role exists - Operator policy exists - Operator role exists

With --kubernetes-auth none (a store configured by 'source configure --kubernetes-auth none', which workloads reach only through the CloudTaser Port), the Kubernetes auth method and the two Kubernetes auth roles are reported as SKIP instead of being required.

Some checks require a token with read access to sys/auth, sys/mounts, and sys/policies. Without a token, only connectivity and health checks are performed.

Usage

cloudtaser-cli source check [flags]

Examples

# Basic connectivity check
  cloudtaser-cli source check --secretstore-address https://vault.eu.example.com

  # Auto-discover from namespace
  cloudtaser-cli source check --namespace vault

      # Full readiness check with token
      cloudtaser-cli source check \
        --secretstore-address https://vault.eu.example.com \
        --secretstore-token-file /etc/cloudtaser/admin.token

      # JSON output for automation
      cloudtaser-cli source check \
        --namespace vault \
        --secretstore-token-file /etc/cloudtaser/admin.token \
        --json

Flags

Flag	Type	Default	Required	Description
--help, -h	bool	false	no	help for check
--json	bool	false	no	output as JSON
--kubeconfig	string	(empty)	no	path to kubeconfig file
--kubernetes-auth	string	in-cluster	no	Kubernetes auth mode the store was configured with: in-cluster, external, or none (none reports the Kubernetes auth checks as SKIP)
--kv-mount	string	(empty)	no	KV v2 mount path (default "secret")
--namespace, -n	string	(empty)	no	K8s namespace to discover secret store in
--operator-policy-name	string	(empty)	no	operator policy name (default "cloudtaser-operator")
--operator-role-name	string	(empty)	no	operator role name (default "cloudtaser-operator")
--policy-name	string	(empty)	no	wrapper policy name (default "cloudtaser")
--secretstore-address	string	(empty)	no	secret store address (or use --namespace for auto-discovery; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-allow-insecure	bool	false	no	allow explicitly requested insecure secret store TLS options (development only)
--secretstore-auth-path	string	(empty)	no	Kubernetes auth mount path (default "kubernetes")
--secretstore-role	string	(empty)	no	wrapper role name (default "cloudtaser")
--secretstore-skip-verify	bool	false	no	skip secret store TLS certificate verification (requires --secretstore-allow-insecure; development only)
--secretstore-token	string	(empty)	no	secret store token (optional, enables detailed checks)
--secretstore-token-file	string	(empty)	no	path to file containing token, or '-' for stdin
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)

All commands