cloudtaser-cli source host-launch-managed¶
Authenticate the host with its GCE platform identity, obtain a scoped secret-store token, clone the active catalog into an expiring launch role, and spawn the standard host-launch supervisor as a child process.
This command is the "live management parent" that Guard() requires. Each launch is bounded to the template interval (<= 24h) and ends at ExpiresAt; systemd Restart=always is the re-launch mechanism. Every launch consumes a fresh launch ID, a fresh platform identity token, and a fresh secret-store session. There is no in-process retry.
The default command lifetime is 24h, with a reserved cleanup window. An explicit --timeout or CLOUDTASER_TIMEOUT must be at least 2m and at most 24h. This command must be MainPID of cloudtaser-host-launch.service. A Port unit still running with this service's bindings makes it exit 0 without launching: that exit lets systemd retire the old Port through BindsTo, and the next restart launches a fresh one. An unmanaged or stranded Port unit refuses before acquiring source credentials.
The approval file is written to /run/cloudtaser/host-launch-approvals/ (tmpfs, root-owned 0700) and removed after the child exits.
Usage¶
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--help, -h |
bool | false |
no | help for host-launch-managed |
--template |
string | (empty) |
yes | absolute path to the host approval template JSON |
--timeout |
duration | 24h0m0s |
no | maximum managed lifetime including cleanup (default 24h; also CLOUDTASER_TIMEOUT) |