cloudtaser-cli target connect¶
Extracts Kubernetes cluster details from the current kubeconfig and configures an external OpenBao instance with Kubernetes auth so that pods in the cluster can authenticate and retrieve secrets.
This command: 1. Reads the target API endpoint and CA 2. In direct mode, creates a token reviewer ServiceAccount allowed only to create TokenReviews and issues it a bounded token that OpenBao uses to review workload logins (no Kubernetes Secret is created) 3. Enables and configures the Kubernetes auth backend in OpenBao 4. Creates an OpenBao role (and optionally a policy) for pod authentication
The direct-mode reviewer token expires after --token-reviewer-ttl (90 days by default); 'target status' shows the days left. Renew it with a scheduled run of this command from wherever the secret store admin token lives, outside the cluster. Deleting or recreating the reviewer ServiceAccount revokes its tokens. An OpenBao running inside the target cluster can instead review with its own ServiceAccount token (kubernetes_host https://kubernetes.default.svc, no token_reviewer_jwt; that ServiceAccount needs system:auth-delegator) and needs no reviewer.
In beacon mode (default), both the port and broker connect through a beacon relay server, so neither side needs to be directly reachable by the other. The beacon uses an info hash derived from the CA certificate to match peers.
In reverse mode (--mode reverse), it additionally generates mTLS certificates for the port connection, stores them in the secret store, and fetches the cluster JWKS. The reverse-connect architecture lets the EU secret store dial OUT to the cluster broker, so the secret store does not need to be network-reachable from pods.
An active managed authority source refuses this legacy setup in every mode. Use source authority maintenance for managed trust updates.
Use --mode direct for the legacy behavior where pods connect to the secret store directly.
Usage¶
Examples¶
# Connect infrastructure with defaults (no app role enrolled)
cloudtaser-cli target connect \
--secretstore-address https://vault.eu.example.com \
--secretstore-token-file /etc/cloudtaser/admin.token
# Beacon mode with custom beacon server
cloudtaser-cli target connect \
--secretstore-address https://vault.eu.example.com \
--secretstore-token-file /etc/cloudtaser/admin.token \
--beacon-address beacon.internal.example.com:443
# Reverse mode — vault dials out to cluster broker
cloudtaser-cli target connect \
--secretstore-address https://vault.eu.example.com \
--secretstore-token-file /etc/cloudtaser/admin.token \
--mode reverse
# Reverse mode with explicit port endpoint
cloudtaser-cli target connect \
--secretstore-address https://vault.eu.example.com \
--secretstore-token-file /etc/cloudtaser/admin.token \
--mode reverse \
--port-endpoint broker.k8s.example.com:8443
# Save port config to a file for the secret-store-side port process
cloudtaser-cli target connect \
--secretstore-address https://vault.eu.example.com \
--secretstore-token-file /etc/cloudtaser/admin.token \
--mode reverse \
--output-port-config port.json
# Direct mode (legacy — secret store must be reachable from pods)
cloudtaser-cli target connect \
--secretstore-address https://vault.eu.example.com \
--secretstore-token-file /etc/cloudtaser/admin.token \
--mode direct
# Connect with specific namespaces and secret paths
cloudtaser-cli target connect \
--secretstore-address https://vault.eu.example.com \
--secretstore-token-file /etc/cloudtaser/admin.token \
--secret-paths "secret/data/myapp/config" --namespaces myapp --service-accounts myapp
# Dry-run to see what would be created
cloudtaser-cli target connect \
--secretstore-address https://vault.eu.example.com \
--secretstore-token-file /etc/cloudtaser/admin.token \
--dry-run
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--beacon-address |
string | (empty) |
no | beacon server address for beacon mode (default: beacon.cloudtaser.io:443). Overrides the address inside --beacon-token when both are set. |
--beacon-token |
string | (empty) |
no | opaque ctb1 beacon token from 'cloudtaser-cli beacon install' (bearer credential; prefer --beacon-token-file) |
--beacon-token-file |
string | (empty) |
no | path to a file containing the ctb1 beacon token, or '-' for stdin |
--dry-run |
bool | false |
no | print what would be done without making changes |
--fingerprint |
string | (empty) |
no | cluster fingerprint for storage (default: kube-system UID) |
--help, -h |
bool | false |
no | help for connect |
--kube-endpoint |
string | (empty) |
no | override K8s API endpoint URL (default: from kubeconfig) |
--kv-mount |
string | secret |
no | KV v2 mount path |
--mode |
string | p2p |
no | connection mode: "p2p" (default), "reverse", or "direct" |
--namespaces |
string | (empty) |
no | one enrolled app namespace; requires --service-accounts (no wildcard) |
--output-port-config |
string | (empty) |
no | write port configuration to this file |
--port-endpoint |
string | (empty) |
no | external address where the port will connect (e.g. broker LB IP/DNS) |
--replace-app-policy |
bool | false |
no | explicitly replace existing app grants even when no secret paths are declared (maintenance window) |
--replace-app-role |
bool | false |
no | explicitly replace existing app role bindings (maintenance acknowledgement affecting all consumers) |
--retire-legacy-reviewer |
bool | false |
no | retire the inspected legacy reviewer after verified direct-mode login; namespace comes from its sole binding subject |
--role-max-ttl |
string | 24h |
no | maximum workload login token lifetime (at most 24h) |
--role-ttl |
string | 1h |
no | workload login token TTL (1m <= role-ttl <= role-max-ttl) |
--secret-paths |
string | (empty) |
no | comma-separated OpenBao KV v2 paths for the policy |
--secretstore-address |
string | (empty) |
no | secret store address (required; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR) |
--secretstore-allow-insecure |
bool | false |
no | allow explicitly requested insecure secret store TLS options (development only) |
--secretstore-auth-path |
string | kubernetes |
no | OpenBao auth method mount path |
--secretstore-role |
string | cloudtaser |
no | secret store Kubernetes authentication role |
--secretstore-skip-verify |
bool | false |
no | skip secret store TLS certificate verification (requires --secretstore-allow-insecure; development only) |
--secretstore-token |
string | (empty) |
no | secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure) |
--secretstore-token-file |
string | (empty) |
no | path to a file containing the secret store token, or '-' to read it from stdin |
--service-accounts |
string | (empty) |
no | one explicit app ServiceAccount; required with --secret-paths (no wildcard/shared identities) |
--timeout |
duration | 20m0s |
no | maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env) |
--token-reviewer-ttl |
duration | 2160h0m0s |
no | requested lifetime of the direct-mode token reviewer token (minimum 24h; rerun connect before it expires) |
--workload-cidrs |
string | (empty) |
no | optional explicit app-token source CIDRs; ineffective behind shared NAT; does not stop node root |