cloudtaser-cli source configure

Configures a previously initialized secret store (OpenBao or Vault) with the policies, roles, and authentication methods required for CloudTaser sovereign secret injection.

With --beacon-tenant-stdin this command instead performs only a fresh tenant credential transaction. Supply the expected --beacon-tenant-id, an HTTPS --secretstore-address, and a separate private --admin-token-fd pipe. The source generates its own independent salt; existing tenant state is never overwritten. No policy configuration flags may be combined with this mode.

This command: 1. Configure the Kubernetes auth method (see --kubernetes-auth) 2. Enable KV v2 secret engine 3. Create CloudTaser wrapper, operator and Volume Shield broker policies 4. Create their Kubernetes auth roles (skipped with --kubernetes-auth none) 5. Create the migrate policy and the operator-enrollment and pod token roles 6. Reconcile the exact cloudtaser-port policy and AppRole (no SecretID) 7. Enable stdout audit logging where the backend allows it

Kubernetes auth (--kubernetes-auth): in-cluster OpenBao runs as a pod of the workload cluster and verifies ServiceAccount JWTs with its own pod ServiceAccount CA and JWT (default). Against an OpenBao that is not a pod this fails before any other change and removes the auth mount it created. external OpenBao runs outside the workload cluster and pods authenticate to it directly. Requires --kubernetes-host and --kubernetes-ca-cert-file; --kubernetes-token-reviewer-jwt-file is optional. The server-local pod fallback is disabled. none No Kubernetes auth mount, config or roles. For stores that workloads reach only through the CloudTaser Port (P2P / beacon relay), such as a VM-hosted OpenBao. The Port policy grant is reconciled in every mode.

Requires a root token or a token with sufficient privileges. Pass the token via --secretstore-token-file or SECRETSTORE_TOKEN.

These settings can also be set via environment variables. Flags take precedence. The --kubernetes-* flags are flag-only.

Environment variables: OPENBAO_ADDR Secret store service URL OPENBAO_NAMESPACE K8s namespace where secret store is deployed OPENBAO_RELEASE_NAME Helm release name BOOTSTRAP_KV_PATH KV v2 mount path (default "secret") BOOTSTRAP_AUTH_PATH Kubernetes auth mount path (default "kubernetes") BOOTSTRAP_POLICY_NAME Policy name (default "cloudtaser") BOOTSTRAP_ROLE_NAME Role name (default "cloudtaser") BOOTSTRAP_ROLE_BOUND_SA_NAMES Bound service account names (default "") BOOTSTRAP_ROLE_BOUND_SA_NAMESPACES Bound service account namespaces (default "") BOOTSTRAP_ROLE_TTL Role token TTL (default "1h") BOOTSTRAP_OPERATOR_SA_NAME Operator service account name (default "cloudtaser-operator") BOOTSTRAP_OPERATOR_NAMESPACE Operator namespace (default "cloudtaser-system")

Usage

cloudtaser-cli source configure [flags]

Examples

# Configure with namespace auto-discovery
  cloudtaser-cli source configure --namespace openbao --secretstore-token-file /etc/cloudtaser/admin.token

  # Configure using a root token (from init output)
      cloudtaser-cli source configure \
        --secretstore-address https://openbao.vault.svc:8200 \
        --secretstore-token-file /etc/cloudtaser/admin.token

      # Configure using environment variables
      export OPENBAO_ADDR=https://openbao.vault.svc:8200
      export SECRETSTORE_TOKEN="$(cat /etc/cloudtaser/admin.token)"
      cloudtaser-cli source configure

  # Configure with custom policy/role names
      cloudtaser-cli source configure \
        --secretstore-address https://openbao.vault.svc:8200 \
        --secretstore-token-file /etc/cloudtaser/admin.token \
        --policy-name my-policy \
        --secretstore-role my-role

  # VM-hosted OpenBao reached only through the CloudTaser Port (no Kubernetes auth)
      cloudtaser-cli source configure \
        --secretstore-address http://127.0.0.1:8200 \
        --kv-mount cloudtaser \
        --kubernetes-auth none \
        --secretstore-token-file /etc/cloudtaser/admin.token

  # External OpenBao that workload pods authenticate to directly
      cloudtaser-cli source configure \
        --secretstore-address https://openbao.example.eu:8200 \
        --secretstore-token-file /etc/cloudtaser/admin.token \
        --kubernetes-auth external \
        --kubernetes-host https://203.0.113.10:6443 \
        --kubernetes-ca-cert-file ./cluster-ca.pem

  # Dry-run to see what would be configured
      cloudtaser-cli source configure \
        --namespace openbao \
        --secretstore-token-file /etc/cloudtaser/admin.token \
        --dry-run

Flags

Flag	Type	Default	Required	Description
--admin-token-fd	int	-1	no	separate private inherited token pipe for --beacon-tenant-stdin
--allow-plaintext-vault	bool	false	no	allow plain HTTP vault discovery (NOT for production; vault traffic including tokens sent in cleartext)
--backend	string	openbao	no	secret store backend: openbao or vault
--beacon-auth-key	string	(empty)	no	base64-encoded beacon auth key to store in vault (from beacon install output)
--beacon-materials-dir	string	(empty)	no	path to beacon activation materials directory (reads PEM files and stores in vault)
--beacon-tenant-id	string	(empty)	no	expected canonical tenant ID for --beacon-tenant-stdin
--beacon-tenant-stdin	bool	false	no	configure only a fresh tenant from a private stdin pipe; source generates its independent salt
--bound-sa-names	string	(empty)	no	one enrolled service account (no default role, env: BOOTSTRAP_ROLE_BOUND_SA_NAMES)
--bound-sa-namespaces	string	(empty)	no	one enrolled namespace (no wildcard, env: BOOTSTRAP_ROLE_BOUND_SA_NAMESPACES)
--dry-run	bool	false	no	print what would be done without making changes
--generate-beacon-auth-key	bool	false	no	generate a new beacon auth key and store it in vault
--help, -h	bool	false	no	help for configure
--kubeconfig	string	(empty)	no	path to kubeconfig file
--kubernetes-auth	string	in-cluster	no	Kubernetes auth setup: in-cluster (OpenBao is a pod of the workload cluster), external (OpenBao outside the cluster; needs --kubernetes-host and --kubernetes-ca-cert-file), or none (workloads reach this store only through the CloudTaser Port, e.g. a VM-hosted OpenBao)
--kubernetes-ca-cert-file	string	(empty)	no	PEM CA certificate(s) for --kubernetes-host; files with private keys are refused (--kubernetes-auth external only)
--kubernetes-host	string	(empty)	no	Kubernetes API server https URL that OpenBao calls for TokenReview (--kubernetes-auth external only)
--kubernetes-token-reviewer-jwt-file	string	(empty)	no	optional file holding a TokenReview JWT; without it each login's own JWT reviews itself, so workload ServiceAccounts need system:auth-delegator (--kubernetes-auth external only)
--kv-mount	string	(empty)	no	KV v2 mount path (default "secret", env: BOOTSTRAP_KV_PATH)
--namespace, -n	string	openbao	no	K8s namespace where secret store is deployed (env: OPENBAO_NAMESPACE)
--operator-namespace	string	(empty)	no	operator namespace (default "cloudtaser-system", env: BOOTSTRAP_OPERATOR_NAMESPACE)
--operator-sa-name	string	(empty)	no	operator service account name (default "cloudtaser-operator", env: BOOTSTRAP_OPERATOR_SA_NAME)
--policy-name	string	(empty)	no	policy name (default "cloudtaser", env: BOOTSTRAP_POLICY_NAME)
--release-name	string	(empty)	no	Helm release name (env: OPENBAO_RELEASE_NAME)
--replace-app-policy	bool	false	no	explicitly replace existing app grants even when no secret paths are declared (maintenance window)
--replace-app-role	bool	false	no	explicitly replace existing app role bindings (maintenance acknowledgement affecting all consumers)
--role-max-ttl	string	(empty)	no	maximum role token lifetime (default 24h; 1m <= role-ttl <= role-max-ttl <= 24h, env: BOOTSTRAP_ROLE_MAX_TTL)
--role-ttl	string	(empty)	no	role token TTL (default "1h", env: BOOTSTRAP_ROLE_TTL)
--secret-paths	string	(empty)	no	exact comma-separated KV-v2 app records; no wildcard grant (env: BOOTSTRAP_ROLE_SECRET_PATHS); requires finite --bound-sa-names and --bound-sa-namespaces
--secretstore-address	string	(empty)	no	secret store service URL (env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR, OPENBAO_ADDR)
--secretstore-auth-path	string	(empty)	no	Kubernetes auth mount path (default "kubernetes", env: BOOTSTRAP_AUTH_PATH)
--secretstore-ca-file	string	(empty)	no	PEM CA bundle for verified secret-store TLS (env: VAULT_CACERT)
--secretstore-role	string	(empty)	no	role name (default "cloudtaser", env: BOOTSTRAP_ROLE_NAME)
--secretstore-token	string	(empty)	no	root token or token with admin privileges
--secretstore-token-file	string	(empty)	no	path to file containing token, or '-' for stdin
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--workload-cidrs	string	(empty)	no	optional explicit app-token source CIDRs (env: BOOTSTRAP_WORKLOAD_CIDRS); ineffective behind shared NAT; does not stop node root

All commands