Skip to content

cloudtaser-cli source install

Installs and bootstraps a secret store (OpenBao or HashiCorp Vault) for CloudTaser sovereign secret injection. Supports these deployment targets:

--type docker Generate docker-compose.yaml and bootstrap. --type linux Generate an OpenBao setup script for a Linux host. --type system Generate a systemd setup script with wrapper + eBPF. --type k8s REFUSED — would store keys in K8s Secrets.

For a complete Kubernetes deployment, run the supported Helm installer directly:

curl -fsSL https://docs.cloudtaser.io/install.sh | bash -s -- --full

The 'source install bao' subcommand deploys OpenBao only and is not a prerequisite for that installer. The default 'source install port' route requires a verified Port chart. For a Linux host, generate the public binary installer:

cloudtaser-cli source install port --type=linux --dry-run > install-port.sh

This does not configure or launch Port. Follow docs/eu-port-beacon-customer.md for the separate authority and host-launch steps.

HashiCorp Vault Kubernetes deployment is not provided by this CLI; use --existing-vault for a customer-managed instance.

--existing-vault Skip deployment entirely and connect to an existing Vault/OpenBao instance. Requires --secretstore-address and --secretstore-token-file or SECRETSTORE_TOKEN. Use '-' as the token file to read stdin. Non-dry-run also requires --port-credentials-out. When set, --type is ignored. Validates connectivity, then configures policies, KV engine, K8s auth method, and port AppRole.

Docker and existing-instance flows support OpenBao and HashiCorp Vault. The backend selector is validated before changes are made and selects matching images, configuration, token environment, and CLI commands.

Unseal key storage (varies by type): source install bao No CLI-side storage. The command does not initialize, unseal, or configure its OpenBao-only deployment. --type=docker Persisted to /etc/cloudtaser/openbao-init.json (mode 0600) or ~/.cloudtaser/openbao-init.json as fallback. WARNING: any user with host filesystem access can read this file. Back up offline and delete after handoff. --type=linux No CLI-side storage. The generated script handles init; capture keys from the script's stdout. --type=system Same as linux — no CLI-side storage. --type=k8s REFUSED: would store unseal keys and root token in a Kubernetes Secret, which is cluster-recoverable (any cluster admin with K8s API access can read it). This violates CloudTaser's zero-K8s-Secrets posture.

For a fresh managed Port store, use --type linux --managed-authority, then source authority prepare/render/provision/activate. Do not run the legacy source configure policy setup on that store. Other install paths use source configure to set up policies, roles and auth.

Configuration flags override their environment defaults. Existing-store admin tokens use the shared resolution order: deprecated argv token, SECRETSTORE_TOKEN (then VAULT_TOKEN), token file/stdin/inherited FD, then standard host token files.

Environment variables: SECRETSTORE_TOKEN Admin token for --existing-vault (legacy: VAULT_TOKEN) OPENBAO_ADDR Secret store service URL OPENBAO_NAMESPACE K8s namespace where secret store is deployed OPENBAO_RELEASE_NAME Helm release name (for per-pod DNS) BOOTSTRAP_SHAMIR_SHARES Number of Shamir shares (default 5) BOOTSTRAP_SHAMIR_THRESHOLD Unseal threshold (default 3)

Usage

cloudtaser-cli source install [flags]

Examples

# Install HashiCorp Vault with the matching image and vault CLI
  cloudtaser-cli source install \
    --type docker \
    --backend vault \
    --release-name vault

  # Install with a custom container image
  cloudtaser-cli source install \
    --type docker \
    --backend vault \
    --image hashicorp/vault \
    --tag 1.17 \
    --release-name vault

  # Deploy TLS-secured OpenBao on Kubernetes (site API and DNS inputs required)
  cloudtaser-cli source install bao --kubernetes-api-cidrs=10.96.0.1/32,10.0.0.2/32 --kubernetes-api-ports=443,6443 --dns-cidrs=169.254.20.10/32,10.96.0.10/32

  # Preview rendered YAML without applying
  cloudtaser-cli source install bao --dry-run --kubernetes-api-cidrs=10.96.0.1/32,10.0.0.2/32 --kubernetes-api-ports=443,6443 --kube-dns-pods-only

  # Deploy OpenBao on Linux (generates setup script)
  cloudtaser-cli source install --type=linux --secretstore-address=0.0.0.0:8200

  # Install as systemd service
  cloudtaser-cli source install --type=systemd \
    --service=myapp \
    --secretstore-address=https://vault.eu.example.com \
    --vault-role=myapp \
    --secrets=secret/data/myapp/db,secret/data/myapp/api

      # Connect to an existing customer-managed Vault (skip deployment)
      cloudtaser-cli source install --existing-vault \
        --secretstore-address https://vault.eu.example.com:8200 \
        --secretstore-token-file /etc/cloudtaser/admin.token \
        --port-credentials-out /run/user/1000/cloudtaser-port-credentials.json

      # Dry-run: preview what configure steps would run against existing vault
      cloudtaser-cli source install --existing-vault \
        --secretstore-address https://vault.eu.example.com:8200 \
        --secretstore-token-file /etc/cloudtaser/admin.token \
        --dry-run

Flags

Flag Type Default Required Description
--allow-plaintext-vault bool false no allow plain HTTP vault address (NOT for production; vault traffic including tokens sent in cleartext)
--backend string openbao no secret store backend: openbao or vault
--chart string (empty) no override chart name or reference (default: cloudtaser, resolved from --chart-repo)
--chart-repo string (empty) no override Helm repository URL (default: https://charts.cloudtaser.io)
--chart-version string (empty) no chart version to pull
--dry-run bool false no print what would be done without making changes
--ebpf-version string (empty) no cloudtaser-ebpf agent release (default: reviewed CLI pin v0.13.168; an override must be a signed release >= v0.13.122; never resolved from mutable latest)
--existing-vault bool false no skip deployment and connect to an existing Vault/OpenBao instance. Requires --secretstore-address, an admin token (--secretstore-token-file or SECRETSTORE_TOKEN), and (outside dry-run) --port-credentials-out. When set, --type is ignored and the command proceeds directly to configure (policies, KV engine, K8s auth)
--helm-install bool true no use Helm release management (default true; set to false for server-side apply without Helm tracking)
--help, -h bool false no help for install
--image string (empty) no custom container image override (e.g., hashicorp/vault)
--kube-endpoint string (empty) no externally reachable HTTPS Kubernetes API endpoint for Vault TokenReview (default: selected kubeconfig cluster endpoint)
--kubeconfig string (empty) no path to kubeconfig file
--kv-mount string secret no KV v2 engine mount path
--managed-authority bool false no fresh Linux managed Port store (OpenBao 2.6.4, authority mounts and AppRole; no legacy policy)
--namespace, -n string (empty) no K8s namespace where secret store is deployed (env: OPENBAO_NAMESPACE)
--no-tls bool false no disable TLS in generated config (development only; applies to linux method — production installs MUST have TLS. For docker method, --no-tls is the default and this flag is a no-op; use --tls to opt in to TLS)
--output-secret string (empty) no K8s secret name for init output (default "cloudtaser-openbao-init", env: BOOTSTRAP_OUTPUT_SECRET)
--port-credentials-out string (empty) no path for Port AppRole credentials JSON (required with --existing-vault; created mode 0600; raw credentials are never printed)
--release-name string (empty) no Helm release name for per-pod DNS (env: OPENBAO_RELEASE_NAME)
--replicas int 1 no number of secret-store replicas (1 or >=3; 2 is refused; >1 requires --type=k8s or --type=docker)
--secrets string (empty) no comma-separated secret store paths (required for --type=system)
--secretstore-address string (empty) no secret store address (env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-auth-path string kubernetes no Kubernetes auth method mount path
--secretstore-ca-file string (empty) no path to a PEM CA certificate used to verify the secret store TLS endpoint
--secretstore-role string (empty) no secret store Kubernetes authentication role
--secretstore-server-name string (empty) no secret store server name
--secretstore-substrate string (empty) no sovereignty substrate recorded for the secret store
--secretstore-token string (empty) no root/admin token (DEPRECATED for argv use; prefer --secretstore-token-file or SECRETSTORE_TOKEN)
--secretstore-token-file string (empty) no admin token file path (including /dev/fd/N), or '-' for stdin (with --existing-vault)
--service string (empty) no systemd service name to protect (required for --type=systemd)
--set stringSlice [] no override individual Helm values (key=value, repeatable)
--shamir-shares int 0 no number of Shamir shares (default 5, env: BOOTSTRAP_SHAMIR_SHARES)
--shamir-threshold int 0 no unseal threshold (default 3, env: BOOTSTRAP_SHAMIR_THRESHOLD)
--sovereignty-substrate string (empty) no declare substrate explicitly (values: commodity, confidential, sovereign). Silences the hyperscaler-endpoint advisory banner. Also available via CLOUDTASER_SECRETSTORE_SUBSTRATE env var.
--tag string (empty) no custom image tag override (e.g., 1.17)
--timeout duration 20m0s no maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--tls bool false no enable TLS in generated config (docker method only; requires paired --tls-cert-file and --tls-key-file). For linux method, TLS is on by default and this flag is ignored
--tls-cert-file string (empty) no path to TLS certificate file (linux method, or docker method with --tls)
--tls-client-ca-file string (empty) no path to client CA certificate for mutual TLS (linux method)
--tls-key-file string (empty) no path to TLS private key file (linux method, or docker method with --tls)
--token-reviewer-ttl duration 2160h0m0s no --existing-vault: lifetime of the token reviewer token the store uses for workload logins (minimum 24h; renew by rerunning from where the admin token lives)
--type string (empty) no deployment type: linux, systemd, or docker (for K8s, use 'source install bao')
--values, -f stringSlice [] no path to Helm values file (repeatable)
--wrapper-version string (empty) no cloudtaser-wrapper release (default: reviewed CLI pin v0.2.209; an override must be a signed release >= v0.2.180; never resolved from mutable latest)

Subcommands

All commands