cloudtaser-cli target install¶
Deploys the CloudTaser operator, mutating webhook, and optional eBPF/proxy components into a Kubernetes cluster.
Default behaviour installs the operator, wrapper, and eBPF daemonset with no Secretstore credentials required. A CloudTaser Secretstore (OpenBao or HashiCorp Vault) holds protected state; in relay mode the operator and wrapper reach it through the source-side Port without direct cloud-network access.
Managed Port customer install: --install-port requires --port-values with reviewed public site network inputs and installs the signed cloudtaser-port chart before the operator in deploy mode. Requires an initialized/unsealed HTTPS source, active approved authority. With --source-introduction, public --port-values selects native projected-token renewal. Without it, requires a pre-enrolled cluster and private --operator-introduction-file carrying the complete atomic v2 introduction (including authority). It never uses legacy ctb1 auto-registration or puts credentials in Helm values. Both charts and the operator/Port/Wire cohort are fixed in the release pins. Port Pod replacement requires finite administrator rebootstrap. Only the legacy profile requires operator reactivation; native source introduction renews itself.
Connection modes:
deploy (default) Chart-only deployment. Renders and applies the Helm
chart. No Secretstore writes or credentials are
required. The port must already be configured by
an administrator.
p2p Full bootstrap for administrators. Generates port
mTLS certs in memory, stores port-side certs in the
Secretstore, deploys the operator, then injects
broker-side certs into operator memory via
the operator broker init path. The normal ctb1 flow uses
--beacon-token-file and lets the port mint its operator
credential. --secretstore-address plus a token is the
advanced/manual path for an existing Secretstore.
direct In-cluster/direct Secretstore access. Pods reach an
existing Secretstore through Kubernetes auth on the pod
network. Use this to replace a Vault Agent Injector
workflow. Direct mode requires --secretstore-address and
selects the vault backend with reverse-connect and the
beacon off. The operator NetworkPolicy egress to the store
is derived from an IP-literal address; a hostname address
also needs --set networkPolicy.vaultCIDR=
Beacon TLS trust modes: 1. A ctb1 token supplies a verified SPKI pin for simple-connect. 2. --beacon-ca supplies an explicitly trusted private CA bundle. 3. --beacon-trust-system-roots verifies a public ACME certificate with OS roots. Trust on first use is a separate first-observation/confirmation workflow and is not performed by this command.
Deployment modes: Default Apply rendered manifests directly to the cluster. --dry-run Render the chart and print YAML to stdout. --source-introduction Enroll with the approved source, install public introduction values, and verify native operational readiness (opt-in; no CLI keeper). Uses a prepared co-located Port listener, or --install-port --port-values to install it from the fixed cohort. Source authority/material and Port TLS provisioning remain prerequisites. No private complete introduction/reactivation is used when --source-introduction is selected.
--helm-install Do a proper Helm release install.
Usage¶
Examples¶
# Install with no Secretstore credentials (default — Port is pre-provisioned)
cloudtaser-cli target install
# Trust mode 1: simple-connect ctb1 token with an SPKI pin (normal path)
cloudtaser-cli target install --beacon-token-file ./beacon.token
# Advanced/manual P2P bootstrap against an existing Secretstore
cloudtaser-cli target install --mode p2p \
--secretstore-address=https://openbao.openbao.svc:8200 \
--secretstore-token-file /etc/cloudtaser/admin.token
# Advanced/manual P2P bootstrap with a custom beacon server
cloudtaser-cli target install --mode p2p \
--secretstore-address=https://openbao.openbao.svc:8200 \
--secretstore-token-file /etc/cloudtaser/admin.token \
--beacon-address=beacon.internal.example.com:443
# Trust mode 2: explicitly supplied private beacon CA bundle
cloudtaser-cli target install --mode p2p \
--secretstore-address=https://openbao.openbao.svc:8200 \
--secretstore-token-file /etc/cloudtaser/admin.token \
--beacon-address=beacon.example.com:443 \
--beacon-ca=/tmp/beacon-ca.crt
# Trust mode 3: public ACME beacon certificate verified by OS roots
cloudtaser-cli target install --mode p2p \
--beacon-token-file ./beacon.token \
--beacon-trust-system-roots
# In-cluster/direct Secretstore access (replace a Vault Agent Injector workflow)
cloudtaser-cli target install --mode direct \
--secretstore-address=https://openbao.openbao.svc:8200 \
--set networkPolicy.vaultCIDR=10.42.0.0/16
# Use Helm release management
cloudtaser-cli target install --helm-install
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--accept-commodity-compute |
bool | false |
no | accept deployment on commodity (non-confidential) compute without the interactive prompt (shorthand for --sovereignty-substrate=commodity) |
--allow-privileged-ebpf |
bool | false |
no | explicitly accept privileged/root host access for the eBPF fallback when the kernel requires it |
--allow-unscoped-privileged-ebpf |
bool | false |
no | separately accept running the privileged eBPF fallback on every schedulable node without an explicit node selector |
--api-server-cidr |
string | (empty) |
no | explicit Kubernetes API-server CIDR override (default: derive one exact endpoint from the live cluster; install fails if it cannot be derived safely) |
--beacon-address |
string | beacon.cloudtaser.io:443 |
no | beacon server address for beacon mode |
--beacon-allow-insecure |
bool | false |
no | confirm intentional beacon TLS verification bypass (required with --beacon-insecure-skip-verify) |
--beacon-auth-key |
string | (empty) |
no | beacon HMAC auth key for advanced/manual P2P mode; skips the Secretstore read at cloudtaser/data/system/beacon-auth-key |
--beacon-auth-key-file |
string | (empty) |
no | path to a file containing the beacon HMAC auth key for advanced/manual P2P mode, or '-' for stdin |
--beacon-auth-key-overlap-until |
string | (empty) |
no | RFC3339 deadline until which --previous-beacon-auth-key-secret may be used for ctb1 auto-register rendezvous |
--beacon-ca |
string | (empty) |
no | path to an explicitly trusted private CA bundle for beacon TLS (ctb1 SPKI pinning and public-CA OS roots are separate verified trust modes) |
--beacon-init-salt |
string | (empty) |
no | hex-encoded per-cluster beacon init salt for advanced/manual P2P mode; passed to Helm as operator.broker.beacon.initSalt so the operator uses HMAC-SHA256 for beacon pairing instead of the legacy unsalted hash |
--beacon-init-salt-file |
string | (empty) |
no | path to a file containing the hex-encoded per-cluster beacon init salt for advanced/manual P2P mode, or '-' for stdin |
--beacon-insecure-skip-verify |
bool | false |
no | DANGEROUS: skip TLS certificate verification for the beacon connection (requires --beacon-allow-insecure; development only; use a ctb1 SPKI pin, a private --beacon-ca bundle, or verified public OS roots) |
--beacon-spki-fingerprint |
string | (empty) |
no | exact verified Beacon SPKI SHA-256 for managed Port installation |
--beacon-token |
string | (empty) |
no | opaque ctb1 beacon token from 'cloudtaser-cli beacon install' (bearer credential; prefer --beacon-token-file) |
--beacon-token-file |
string | (empty) |
no | path to a file containing the ctb1 beacon token, or '-' for stdin |
--beacon-trust-system-roots |
bool | false |
no | verify a public ACME-issued beacon certificate with the OS root store (ctb1 tokens instead verify their SPKI pin; --beacon-ca supplies a private CA bundle) |
--broker-allow-insecure |
bool | false |
no | allow plain HTTP to the operator broker when no TLS CA is discoverable (development only; not safe for production) |
--broker-ca |
string | (empty) |
no | path to PEM CA bundle used to verify the operator broker TLS cert (default: auto-fetch from the cloudtaser-operator-broker-ca ConfigMap or legacy cloudtaser-operator-broker-tls Secret; fails if neither is available unless --broker-allow-insecure is set) |
--chart |
string | (empty) |
no | override chart name or reference (default: cloudtaser, resolved from --chart-repo) |
--chart-repo |
string | (empty) |
no | override Helm repository URL (default: https://charts.cloudtaser.io) |
--chart-version |
string | 1.0.359 |
no | reviewed CloudTaser chart version to install (requires >= 1.0.355; explicit override allowed; never resolves mutable latest) |
--dry-run |
bool | false |
no | render YAML to stdout without applying |
--enable-db-proxy |
bool | false |
no | enable DB proxy injection support |
--enable-ebpf |
bool | true |
no | enable eBPF daemonset |
--enable-s3-proxy |
bool | false |
no | enable S3 proxy injection support |
--enable-volume-shield |
bool | false |
no | enable Volume Shield PVC encryption support |
--enrollment-id |
string | (empty) |
no | approved source introduction enrollment ID |
--fingerprint |
string | (empty) |
no | cluster fingerprint for Secretstore path operations and beacon pairing (default: kube-system UID; must match operator.fingerprint.clusterID in Helm values) |
--helm-install |
bool | false |
no | use Helm release management instead of server-side apply (stores release metadata in the cluster) |
--help, -h |
bool | false |
no | help for install |
--install-port |
bool | false |
no | install the pinned managed Port chart before the operator (deploy mode; native renewal with --source-introduction, otherwise private v2 introduction) |
--instance |
string | (empty) |
no | approved source authority instance for --source-introduction |
--introduction-egress-cidr |
string | (empty) |
no | scoped Port introduction endpoint CIDR |
--introduction-port |
int | 8444 |
no | Port introduction TCP port |
--introduction-timeout |
duration | 5m0s |
no | budget for native operator operational readiness |
--introduction-url |
string | (empty) |
no | co-located Port HTTPS /v1/operator-introduction endpoint |
--kubeconfig |
string | (empty) |
no | path to kubeconfig file (probes ~/.kube/config first, then /etc/rancher/k3s/k3s.yaml and /etc/rancher/rke2/rke2.yaml when absent) |
--mode |
string | deploy |
no | connection mode: "deploy" (default, chart only), "p2p" (full bootstrap, admin only), or "direct" (in-cluster/direct Secretstore access) |
--namespace, -n |
string | (empty) |
no | Kubernetes namespace (default: cloudtaser-system) |
--operator-introduction-file |
string | (empty) |
no | legacy managed profile only: private complete registered v2 introduction (requires --install-port; forbidden with --source-introduction) |
--platform-token-file |
string | (empty) |
no | path to a mode-0600 file containing the CloudTaser platform bearer token, or '-' for stdin |
--port-authority-instance |
string | (empty) |
no | administrator-approved active Port authority instance |
--port-ca-configmap |
string | (empty) |
no | Port-owned public CA ConfigMap (ca.crt) |
--port-namespace |
string | cloudtaser-vault |
no | existing hardened namespace for the managed Port |
--port-pki-approval |
string | (empty) |
no | public approval used by source prepare port-introduction-pki |
--port-pki-journal |
string | (empty) |
no | ready public source PKI preparation journal (read-only) |
--port-secretstore-ca-file |
string | (empty) |
no | exact approved PEM CA for the Port's HTTPS Secretstore |
--port-values |
string | (empty) |
no | public scoped Port trust/network values; RAM-key source introduction requires matching public PKI preparation |
--previous-beacon-auth-key-secret |
string | (empty) |
no | pre-existing Kubernetes Secret containing the previous beacon HMAC auth key for bounded ctb1 auto-register rotation overlap |
--previous-beacon-auth-key-secret-key |
string | auth.key |
no | key inside --previous-beacon-auth-key-secret containing the previous beacon HMAC auth key |
--release-name |
string | (empty) |
no | Helm release name (default: cloudtaser) |
--saas-addr |
string | (empty) |
no | CloudTaser platform API address; when set and --mode is not given, query the registered cluster topology to suggest the matching mode |
--secretstore-address |
string | (empty) |
no | Secretstore address (required for direct mode; optional advanced/manual P2P path; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR) |
--secretstore-allow-insecure |
bool | false |
no | allow explicitly requested insecure Secretstore TLS options (development only) |
--secretstore-auth-method |
string | kubernetes |
no | Secretstore authentication method |
--secretstore-auth-path |
string | kubernetes |
no | Secretstore authentication mount path |
--secretstore-ca-file |
string | (empty) |
no | public CA for source introduction enrollment administration |
--secretstore-namespace |
string | (empty) |
no | Secretstore enterprise namespace |
--secretstore-skip-verify |
bool | false |
no | skip Secretstore TLS certificate verification (requires --secretstore-allow-insecure; development only) |
--secretstore-token |
string | (empty) |
no | Secretstore token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure) |
--secretstore-token-file |
string | (empty) |
no | path to a file containing the Secretstore token, or '-' to read it from stdin |
--set |
stringSlice | [] |
no | override individual Helm values (key=value, repeatable) |
--source-introduction |
bool | false |
no | enroll, install CSI-free source introduction and verify operational readiness (opt-in; no CLI keeper) |
--sovereignty-substrate |
string | (empty) |
no | declare substrate explicitly (values: commodity, confidential, sovereign). Silences the node-substrate + hyperscaler-endpoint advisory banners. Also available via CLOUDTASER_SOVEREIGNTY_SUBSTRATE / CLOUDTASER_SECRETSTORE_SUBSTRATE env vars. |
--timeout |
duration | 20m0s |
no | maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env) |
--values, -f |
stringSlice | [] |
no | path to Helm values file (repeatable) |
--yes, -y |
bool | false |
no | assume yes on routine interactive prompts (does not approve privileged eBPF; use the dedicated security flags) |