cloudtaser-cli source install bao¶
Deploys OpenBao on Kubernetes through the canonical CloudTaser chart.
The signed default chart uses a TLS 1.3 listener with barrier-backed PKI. Only public certificates enter Kubernetes ConfigMaps; private keys never enter Kubernetes Secrets or Helm values. Explicit API Service and endpoint CIDRs/ports are required so NetworkPolicy remains enforced, including after Service DNAT.
This command only deploys the chart — it does NOT initialize, unseal, or configure the secret store. The P2P Port path is not available in this CLI release because it has no verified Port chart. This OpenBao-only command is not a prerequisite for the currently supported complete Kubernetes deployment. Run the full installer directly instead:
curl -fsSL https://docs.cloudtaser.io/install.sh | bash -s -- --full
For the separate OpenBao-only lifecycle: install, administrator init/unseal, then source provision-bao-tls using verified bootstrap trust and an administrator token supplied through stdin. Verify each served listener rotates to PKI trust.
For a single-node install (default), use --replicas=1 (standalone mode). For HA with Raft, use --replicas=3 or higher (odd numbers only; 2 is refused).
Use --dry-run to render the Helm values and manifests without deploying.
Usage¶
Examples¶
# Replace these with your API Service and endpoint addresses/ports
cloudtaser-cli source install bao --kubernetes-api-cidrs=10.96.0.1/32,10.0.0.2/32 --kubernetes-api-ports=443,6443
# Deploy 3-node HA with Raft
cloudtaser-cli source install bao --replicas=3 --kubernetes-api-cidrs=10.96.0.1/32,10.0.0.2/32 --kubernetes-api-ports=443,6443
# Preview what would be deployed
cloudtaser-cli source install bao --dry-run --kubernetes-api-cidrs=10.96.0.1/32,10.0.0.2/32 --kubernetes-api-ports=443,6443
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--backend |
string | openbao |
no | secret-store implementation (source install bao supports openbao) |
--chart |
string | (empty) |
no | override chart reference (default: cloudtaser-openbao) |
--chart-repo |
string | (empty) |
no | override chart repository URL |
--chart-version |
string | (empty) |
no | override chart version |
--dry-run |
bool | false |
no | render YAML only, do not deploy |
--help, -h |
bool | false |
no | help for bao |
--kubeconfig |
string | (empty) |
no | path to kubeconfig file |
--kubernetes-api-cidrs |
stringSlice | [] |
no | explicit Kubernetes API Service and control-plane endpoint CIDRs (required; no default route) |
--kubernetes-api-ports |
intSlice | [] |
no | explicit Kubernetes API Service and endpoint TCP ports (required; include post-DNAT endpoint port) |
--namespace, -n |
string | openbao |
no | K8s namespace |
--no-tls |
bool | false |
no | deprecated and refused: OpenBao listener TLS is mandatory |
--release-name |
string | openbao |
no | Helm release name |
--replicas |
int | 1 |
no | number of replicas (1=standalone, 3+=HA with Raft; 2 is refused) |
--set |
stringSlice | [] |
no | override Helm chart values (key=value) |
--values, -f |
stringSlice | [] |
no | path to Helm values file (repeatable) |