cloudtaser-cli source deregister

Removes a cluster's fingerprint registration AND every per-cluster secret written into the cloudtaser KV mount during register/init from the secret store. After deregistration, the port will no longer accept connections from this cluster and no residual secret material (port CA, broker/client private keys, beacon salt) is left behind.

Use --fingerprint to deregister a single cluster, or --all to deregister every registered cluster (useful for demo reset).

this command now deletes the per-cluster port CA, ECDSA broker/client private keys, beacon salt, and beacon config at cloudtaser/data/clusters//* AND purges the corresponding KV v2 metadata so all prior versions are permanently removed. Earlier versions of this command only deleted the 'registered' + 'initialized' markers, leaving the key material in vault indefinitely.

--soft mode pass --soft to preserve the infrastructure keys that are immutable after initial provisioning (port-ca, port-broker-cert, port-client-cert, beacon-salt, beacon-config). Only the registration markers (registered, initialized) are deleted. The per-cluster vault policy and any active tokens are still revoked. Use this for demo reset or re-registration workflows where the operator pod retains its original CLOUDTASER_BEACON_INIT_SALT env var — a new random salt would break beacon pairing on re-register.

Usage

cloudtaser-cli source deregister [flags]

Examples

# Deregister a single cluster.
  cloudtaser-cli source deregister \
    --fingerprint 0ad50c05-1153-4508-9237-4cb2912e2c23

  # Deregister all registered clusters (e.g. demo reset).
  cloudtaser-cli source deregister --all

  # Soft deregister: preserve beacon-salt and port certs, only clear
  # registration markers. Use when the operator pod keeps its original salt.
  cloudtaser-cli source deregister \
    --fingerprint 0ad50c05-1153-4508-9237-4cb2912e2c23 \
    --soft

  # Soft deregister all clusters (demo reset without salt rotation).
  cloudtaser-cli source deregister --all --soft

  # Legacy direct: against a remotely-reachable vault HTTPS endpoint.
  cloudtaser-cli source deregister \
    --fingerprint 0ad50c05-1153-4508-9237-4cb2912e2c23 \
    --secretstore-address https://vault.eu.example.com \
    --secretstore-token-file /etc/cloudtaser/admin.token

Flags

Flag	Type	Default	Required	Description
--all	bool	false	no	deregister all registered clusters
--fingerprint	string	(empty)	no	cluster fingerprint to remove
--help, -h	bool	false	no	help for deregister
--secretstore-address	string	http://127.0.0.1:8200	no	secret store address (defaults to http://127.0.0.1:8200 — the local OpenBao systemd service on the secretstore VM. This listener binds 127.0.0.1 with tls_disable=true by design. Override with https:// for non-loopback production targets; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-allow-insecure	bool	false	no	allow explicitly requested insecure secret store TLS options (development only)
--secretstore-skip-verify	bool	false	no	skip secret store TLS certificate verification (requires --secretstore-allow-insecure; development only)
--secretstore-token	string	(empty)	no	secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure)
--secretstore-token-file	string	(empty)	no	path to a file containing the secret store token, or '-' to read it from stdin
--soft	bool	false	no	preserve infrastructure keys (port certs, beacon salt) during deregister — only remove registration markers. Use for demo reset or re-registration workflows where the operator retains the original salt.
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)

All commands