cloudtaser-cli source register

Advanced/bulk command for pre-registering Kubernetes cluster fingerprints in the secret store and generating CloudTaser Port certificates for those fingerprints.

The ctb1 simple-connect P2P flow is unavailable in this CLI release because no verified CloudTaser Port chart is published. For a complete supported Kubernetes deployment, run:

curl -fsSL https://docs.cloudtaser.io/install.sh | bash -s -- --full

If source register is invoked with a ctb1 --beacon-token and no explicit secretstore flags, it reports that the P2P flow is unavailable and does not read or use a Vault/OpenBao token.

Use source register when an administrator intentionally wants to pre-stage or bulk-register fingerprints before targets connect. Registration is one-time use — after the cluster initializes, the fingerprint cannot be reused (re-run register to re-initialize).

By default, secrets are stored in the root namespace. Use --vault-namespace to opt in to per-cluster namespace isolation (cloudtaser/). Namespace isolation requires OpenBao Enterprise or a compatible build.

Usage

cloudtaser-cli source register [flags]

Examples

# Advanced/bulk model: run on the secretstore VM itself. Vault is at
  # the local k3s port-forward, no public DNS, no provisioner token
  # leaving the host. Token is read from /etc/cloudtaser/admin.token
  # unless --secretstore-token-file points elsewhere.
  cloudtaser-cli source register \
    --fingerprint 0ad50c05-1153-4508-9237-4cb2912e2c23

  # Override the secret store address (e.g. legacy direct mode against a
  # remotely-reachable vault HTTPS endpoint).
  cloudtaser-cli source register \
    --fingerprint 0ad50c05-1153-4508-9237-4cb2912e2c23 \
    --secretstore-address https://vault.eu.example.com \
    --secretstore-token-file /etc/cloudtaser/admin.token

Flags

Flag	Type	Default	Required	Description
--beacon-address	string	beacon.cloudtaser.io:443	no	beacon server address
--beacon-auth-key	string	(empty)	no	beacon shared HMAC auth key (advanced/manual registration)
--beacon-token	string	(empty)	no	opaque ctb1 beacon token from 'cloudtaser-cli beacon install' (advanced registration convenience; bearer credential, prefer --beacon-token-file)
--beacon-token-file	string	(empty)	no	path to a file containing the ctb1 beacon token, or '-' for stdin
--fingerprint	string	(empty)	yes	cluster fingerprint from 'target fingerprint' (required)
--help, -h	bool	false	no	help for register
--kubeconfig	string	(empty)	no	path to kubeconfig (used with --secretstore-k8s-namespace; respects KUBECONFIG env by default)
--operator-token-out	string	./cloudtaser-operator-token.txt	no	path for verbose per-cluster operator token output (0600)
--rotate-salt	bool	false	no	rotate the per-cluster beacon salt to a fresh random value (info_hash will change; operator re-derives on next reconcile)
--salt-overlap	duration	24h0m0s	no	bounded overlap window for accepting the previous beacon salt during --rotate-salt
--secretstore-address	string	http://127.0.0.1:8200	no	secret store address (defaults to http://127.0.0.1:8200 — the local OpenBao systemd service on the secretstore VM. This listener binds 127.0.0.1 with tls_disable=true by design. Override with https:// for non-loopback production targets; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-allow-insecure	bool	false	no	allow explicitly requested insecure secret store TLS options (development only)
--secretstore-k8s-namespace	string	(empty)	no	Kubernetes namespace containing the secret store service
--secretstore-k8s-service	string	openbao	no	Kubernetes service name for the secret store
--secretstore-namespace	string	(empty)	no	secret store enterprise namespace
--secretstore-skip-verify	bool	false	no	skip secret store TLS certificate verification (requires --secretstore-allow-insecure; development only)
--secretstore-token	string	(empty)	no	secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure)
--secretstore-token-file	string	(empty)	no	path to a file containing the secret store token, or '-' to read it from stdin
--show-operator-token	bool	false	no	print raw per-cluster operator token in verbose output (unsafe)
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--verbose	bool	false	no	show progress lines, vault paths, info hashes, scoped policy, operator token, and alternative helm command
--workload-cidrs	string	(empty)	no	optional explicit child-token source CIDRs; ineffective behind shared NAT; does not stop node root
--yes, -y	bool	false	no	assume yes on interactive prompts (required for non-interactive --rotate-salt)

All commands