cloudtaser-cli source install port¶
Configures the secret store for CloudTaser and deploys CloudTaser Port connecting it to a beacon relay.
For an outbound-only EU Linux host, generate a signed-binary installer:
cloudtaser-cli source install port --type=linux --dry-run > install-port.sh
Review/run that script on the EU host, then prepare the public authority with 'source authority prepare' and public host approval with 'source host-launch prepare'. Host credentials enter only the existing administrator pipe. The Kubernetes chart path below is a separate deployment type, not a host installer.
For a complete supported Kubernetes deployment, run the full installer:
curl -fsSL https://docs.cloudtaser.io/install.sh | bash -s -- --full
The 'source install bao' command deploys OpenBao only. It does not initialize, unseal, or configure OpenBao and is not a prerequisite for the full installer.
Usage¶
Examples¶
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--authority-instance |
string | (empty) |
no | active administrator-approved source authority instance (managed enrollment) |
--beacon-address |
string | (empty) |
no | beacon relay address (host:port). Overrides the address inside --beacon-token when both are set. |
--beacon-spki-fingerprint |
string | (empty) |
no | lowercase SHA-256 Beacon TLS SPKI pin for managed enrollment |
--beacon-token |
string | (empty) |
no | opaque ctb1 beacon token from 'cloudtaser-cli beacon install' (bearer credential; prefer --beacon-token-file) |
--beacon-token-file |
string | (empty) |
no | path to a file containing the ctb1 beacon token, or '-' for stdin |
--dry-run |
bool | false |
no | render installer (Linux) or YAML (Kubernetes), do not deploy |
--executable |
string | /usr/local/libexec/cloudtaser-port |
no | absolute Port binary path for the Linux host install script |
--force |
bool | false |
no | allow unsafe init secret printing when stderr is not a TTY |
--help, -h |
bool | false |
no | help for port |
--init-out |
string | ./cloudtaser-init.json |
no | path for OpenBao init output JSON (0600; used for initialization and interrupted-install recovery; pass explicitly for external endpoints) |
--kubeconfig |
string | (empty) |
no | path to kubeconfig file |
--kv-mount |
string | secret |
no | KV v2 engine mount path |
--namespace, -n |
string | openbao |
no | K8s namespace for the CloudTaser Port deployment |
--port-chart |
string | (empty) |
no | override the Port Helm chart with an OCI reference (oci://...) or local path (development/self-hosted scenarios only) |
--port-chart-version |
string | (empty) |
no | chart version for a local --port-chart path (development/self-hosted scenarios only) |
--port-credentials-in |
string | (empty) |
no | absolute path to an exact cloudtaser.port-approle-bootstrap/v1 handoff (imports once; raw fields are never printed) |
--port-version |
string | (empty) |
no | exact managed cohort Port version for --type=linux; another version is refused |
--secretstore-address |
string | (empty) |
no | secret store address (auto-discovered if empty; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR) |
--secretstore-auth-path |
string | kubernetes |
no | Kubernetes auth method mount path |
--secretstore-ca-file |
string | (empty) |
no | path to a PEM CA certificate used to verify the secret store TLS endpoint |
--secretstore-k8s-namespace |
string | openbao |
no | K8s namespace of the secret store (for auto-discovery) |
--secretstore-token |
string | (empty) |
no | secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure) |
--secretstore-token-file |
string | (empty) |
no | path to a file containing the secret store token, or '-' to read it from stdin |
--shamir-shares |
int | 5 |
no | Shamir key shares (only used if the secret store is fresh) |
--shamir-threshold |
int | 3 |
no | Shamir unseal threshold (only used if the secret store is fresh) |
--show-init-secrets |
bool | false |
no | print raw OpenBao root token and unseal keys to stderr (unsafe; TTY only unless --force) |
--type |
string | kubernetes |
no | Port deployment type: linux (signed binary install script) or kubernetes (verified chart) |
--vault-release |
string | openbao |
no | OpenBao Helm release name (for auto-discovery; legacy flag name) |
--yes, -y |
bool | false |
no | assume yes for interactive prompts |