cloudtaser-cli source session-authority¶
Verify a public prepared-session catalog against live Kubernetes UIDs and active source workload authority. Install fresh exact migrate/cleanup AppRoles, permanently reserve each cluster/namespace, and send response-wrapped one-use SecretIDs to a private inherited pipe. Nonrenewable batch capabilities last at most 120 seconds and are confined to exact approved records. Every policy grant also expires at the catalog's absolute deadline. Preparation requires qualified OpenBao 2.6.4 with inline SecretID expiration enforcement. No runtime issuer, root-token fallback, credential file, environment or standard output is used.
Partial or unknown preparation permanently spends the namespaces. The receiving supervisor must verify exactly one frame per catalog operation before admission; EOF or a producer error is not a completed ceremony. Bootstrap frames must stay in protected memory. A restart requires fresh administrator preparation.
Usage¶
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--admin-token-fd |
int | -1 |
no | private inherited administrator token input pipe, descriptor3 or higher |
--catalog-file |
string | (empty) |
no | public administrator-approved prepared-session catalog |
--credentials-fd |
int | -1 |
no | private inherited wrapped bootstrap output pipe, descriptor3 or higher |
--help, -h |
bool | false |
no | help for session-authority |
--kubeconfig |
string | (empty) |
no | authenticated cluster context used to verify actual prepared UIDs |
--secretstore-ca-file |
string | (empty) |
no | public CA bundle bound by every descriptor |
--timeout |
duration | 20m0s |
no | maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env) |