cloudtaser-cli target activate-beacon-auth

Delivers a ctb1 beacon HMAC authentication key to every non-ready operator replica through the Kubernetes port-forward subresource. The key is carried only in the tunneled request body — it is never logged, placed in a URL or header, or written to any Kubernetes API object (Secret, ConfigMap, Helm release state, etcd).

This is the standalone equivalent of the runtime beacon auth injection that "target install" performs automatically. Managed installs must use --operator-introduction-file with the complete registered v2 bundle and authority; a bare beacon key cannot reactivate them. Use it when the operator was deployed via plain Helm (not the CLI target install path) and the chart has runtimeAuthKey.enabled=true set.

Prerequisites: - The operator Deployment must include the beacon-auth-key-receiver sidecar container (helm value: operator.broker.beacon.runtimeAuthKey.enabled=true). - At least one operator pod must be Running with the receiver container active.

The preferred key transport is --beacon-auth-key-file with stdin ("-") to keep the key out of the process argument list (visible via ps).

Usage

cloudtaser-cli target activate-beacon-auth [flags]

Examples

# Preferred: read key from stdin (key stays out of process args)
  echo "$BEACON_AUTH_KEY" | cloudtaser-cli target activate-beacon-auth --beacon-auth-key-file -

  # Read key from a file
  cloudtaser-cli target activate-beacon-auth --beacon-auth-key-file /path/to/key

  # Inline key (discouraged — visible in process args)
  cloudtaser-cli target activate-beacon-auth --beacon-auth-key "$BEACON_AUTH_KEY"

  # With explicit namespace and wait for pod readiness
  cloudtaser-cli target activate-beacon-auth --beacon-auth-key-file - \
    --namespace cloudtaser-system --wait

Flags

Flag	Type	Default	Required	Description
--beacon-auth-key	string	(empty)	no	beacon HMAC auth key (base64, 32 bytes decoded); discouraged — visible in process args via ps; prefer --beacon-auth-key-file
--beacon-auth-key-file	string	(empty)	no	path to a file containing the beacon HMAC auth key, or '-' for stdin (preferred)
--dry-run	bool	false	no	validate public managed introduction arguments without reading credentials or contacting source/cluster
--help, -h	bool	false	no	help for activate-beacon-auth
--kubeconfig	string	(empty)	no	path to kubeconfig file
--namespace, -n	string	cloudtaser-system	no	namespace where the operator is installed
--operator-introduction-file	string	(empty)	no	private complete registered v2 introduction for managed operator reactivation; mutually exclusive with legacy key inputs
--secretstore-address	string	(empty)	no	verified source origin for managed introduction readback
--secretstore-ca-file	string	(empty)	no	verified source CA PEM (managed mode)
--secretstore-token-file	string	(empty)	no	explicit private source credential file or '-' for stdin (managed mode)
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--wait	bool	false	no	wait for operator pods to become Ready after injection

All commands