cloudtaser-cli target audit

Scans all Deployments, StatefulSets, and DaemonSets in the cluster to produce a compliance audit report. Identifies protected workloads (CloudTaser-injected), unprotected workloads (using K8s Secrets directly), orphaned secrets in etcd, and eBPF runtime enforcement coverage.

System namespaces (kube-system, kube-public, kube-node-lease) are excluded.

Usage

cloudtaser-cli target audit [flags]

Examples

# Full audit report (P2P beacon mode — no secret store address needed)
  cloudtaser-cli target audit

  # Audit a specific namespace
  cloudtaser-cli target audit -n production

  # JSON output for programmatic consumption
  cloudtaser-cli target audit -o json

  # Save audit report to file
  cloudtaser-cli target audit > audit-report.txt

  # Legacy direct-vault mode — pass --secretstore-address only when the report
  # needs to record the secret store endpoint as metadata.
  cloudtaser-cli target audit --secretstore-address https://vault.eu.example.com

Flags

Flag	Type	Default	Required	Description
--help, -h	bool	false	no	help for audit
--kubeconfig	string	(empty)	no	path to kubeconfig file
--namespace, -n	string	(empty)	no	namespace to scan (default: all namespaces)
--output, -o	string	text	no	output format: text or json
--secretstore-address	string	(empty)	no	secret store address (optional, only used as report metadata in legacy direct-vault mode; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)

All commands