cloudtaser-cli target discover

Scans Deployments, StatefulSets, and DaemonSets in the target namespace(s) for secret references (env secretKeyRef, envFrom secretRef, secret injector annotations). Generates SecretMapping CRD YAML for each workload that can be piped to kubectl apply.

When --output-plan is provided, generates a MigrationPlan YAML file instead of SecretMapping CRDs. The plan file groups workloads by namespace as tenants and maps K8s secret references to suggested secret store paths.

Workloads already annotated with secretstore.cloudtaser.io/inject: "true" (or the deprecated cloudtaser.io/inject form) are skipped. System namespaces (kube-system, kube-public, kube-node-lease) are excluded.

Usage

cloudtaser-cli target discover [flags]

Examples

# Discover across all namespaces
  cloudtaser-cli target discover --secretstore-address https://vault.eu.example.com --secretstore-role my-app

  # Discover in a specific namespace and apply
  cloudtaser-cli target discover -n production --secretstore-address https://vault.eu.example.com --secretstore-role my-app | kubectl apply -f -

  # Discover with a custom kubeconfig
  cloudtaser-cli target discover --kubeconfig ~/.kube/staging --secretstore-address https://vault.eu.example.com --secretstore-role my-app

  # Generate a migration plan file
  cloudtaser-cli target discover --kubeconfig target.kubeconfig -o plan.yaml

  # Preview image entrypoint rewrites while discovering workloads
  cloudtaser-cli target discover -n production --show-entrypoints --secretstore-address https://vault.eu.example.com --secretstore-role my-app

Flags

Flag	Type	Default	Required	Description
--help, -h	bool	false	no	help for discover
--kubeconfig	string	(empty)	no	path to kubeconfig file
--kv-mount	string	secret	no	KV v2 mount path
--namespace, -n	string	(empty)	no	namespace to scan (default: all namespaces)
--output-plan, -o	string	(empty)	no	write a MigrationPlan YAML to the given path instead of SecretMapping CRDs
--secretstore-address	string	(empty)	no	secret store address for generated SecretMapping CRDs (env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-role	string	(empty)	no	secret store role for generated SecretMapping CRDs
--show-entrypoints	bool	false	no	preview image entrypoint rewrites for discovered workloads
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)

All commands