cloudtaser-cli target fingerprint clear-latch

Recovers from a latched cluster-fingerprint mismatch. A latched operator denies every protected pod until it restarts; 'target status' shows the latch.

The command captures the live cluster identity, reads the fingerprint stored in the secret store and compares them. It restarts the operator only when they match, so every restarted pod verifies the same record again at startup and latches again on any real mismatch.

When only the stored API endpoint or serving certificate differs (for example a record written with a workstation kubeconfig address instead of the in-cluster endpoint), --re-register replaces the record with the live identity first. It refuses when the kube-system UID or the cluster CA differs: that is the repointing the check exists to catch.

The latch state is read from operator logs. When they no longer show it (for example after log rotation), 'target status' reports Unknown; --restart then restarts the operator whenever the record matches, whatever the logs say.

Usage

cloudtaser-cli target fingerprint clear-latch [flags]

Examples

# Show what differs, restart only if the record already matches
  cloudtaser-cli target fingerprint clear-latch \
    --secretstore-address https://vault.eu.example.com \
    --secretstore-token-file /etc/cloudtaser/admin.token

  # Replace a stale endpoint record for the same cluster, then restart
  cloudtaser-cli target fingerprint clear-latch --re-register \
    --secretstore-address https://vault.eu.example.com \
    --secretstore-token-file /etc/cloudtaser/admin.token

Flags

Flag	Type	Default	Required	Description
--fingerprint	string	(empty)	no	cluster fingerprint the record is stored under (default: kube-system UID)
--help, -h	bool	false	no	help for clear-latch
--kubeconfig	string	(empty)	no	path to kubeconfig file
--namespace, -n	string	cloudtaser-system	no	operator namespace
--re-register	bool	false	no	replace a stored record whose endpoint or serving certificate differs, when the kube-system UID and CA match
--restart	bool	false	no	restart the operator once the record matches, even when its logs do not show a latch
--secretstore-address	string	(empty)	no	secret store address (required; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-allow-insecure	bool	false	no	allow explicitly requested insecure secret store TLS options (development only)
--secretstore-skip-verify	bool	false	no	skip secret store TLS verification (requires --secretstore-allow-insecure; development only)
--secretstore-token-file	string	(empty)	no	path to a file containing the secret store token, or '-' for stdin (or SECRETSTORE_TOKEN)
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)

All commands