cloudtaser-cli target migrate

Reads Kubernetes Secret values and writes them to the EU-hosted secret store through the operator's admin proxy by default. With --mode=direct, or when --secretstore-address is configured, the CLI writes to the secret store directly.

The command discovers K8s Secrets in the target namespace, reads their values, and writes each one to a secret store KV v2 path. Optionally deletes the original K8s Secrets after successful migration.

The default p2p mode requires the CloudTaser operator to be running with an active port connection. Direct mode does not require a port connection.

Usage

cloudtaser-cli target migrate [flags]

Examples

# Migrate all secrets in the default namespace
  cloudtaser-cli target migrate -n default --secretstore-token-file /path/to/token

  # Migrate specific secrets with a custom secret store path prefix
  cloudtaser-cli target migrate -n default --secrets postgres-credentials \
    --secretstore-token-file /path/to/token --secretstore-path-prefix secret/data/myapp

  # Migrate and delete originals (non-interactive)
  cloudtaser-cli target migrate -n default --secretstore-token-file /path/to/token \
    --delete-secrets --yes

  # Use a manually port-forwarded broker
  cloudtaser-cli target migrate -n default --secretstore-token-file /path/to/token \
    --broker-address http://localhost:8199

  # Write directly to a reachable secret store (no port required)
  cloudtaser-cli target migrate -n default --mode direct \
    --secretstore-address https://openbao.example.com:8200 \
    --secretstore-token-file /path/to/token

  # Dry-run: exercise TLS + port-forward + port reachability checks
  # without writing to the secret store or deleting the K8s Secret.
  cloudtaser-cli target migrate -n default --secretstore-token-file /path/to/token --dry-run

Flags

Flag	Type	Default	Required	Description
--broker-address	string	(empty)	no	broker HTTP address (default: auto port-forward to operator)
--broker-allow-insecure	bool	false	no	allow plain HTTP to the operator broker when no TLS CA is discoverable (development only; not safe for production)
--broker-ca	string	(empty)	no	path to PEM CA bundle used to verify the operator broker TLS cert (default: auto-fetch from the cloudtaser-operator-broker-ca ConfigMap or legacy cloudtaser-operator-broker-tls Secret; fails if neither is available unless --broker-allow-insecure is set)
--create-only	bool	false	no	require a new destination record (KV v2 CAS=0); refuse overwrites
--delete-secrets	bool	false	no	delete K8s Secrets after successful migration
--dry-run	bool	false	no	exercise the selected transport's connectivity and TLS path without writing to the secret store or deleting K8s Secrets
--help, -h	bool	false	no	help for migrate
--kubeconfig	string	(empty)	no	path to kubeconfig file
--mode	string	p2p	no	migration transport: "p2p" (operator admin proxy) or "direct" (reachable secret store)
--namespace, -n	string	(empty)	yes	namespace to migrate secrets from (required)
--operator-namespace	string	cloudtaser-system	no	namespace where the operator is installed
--prepared-session-file	string	(empty)	no	public administrator-prepared session descriptor (requires explicit direct TLS, CA and stdin token)
--revoke-token-after	bool	false	no	revoke the supplied migration credential after use (raw-token modes; cleanup failure is an error)
--secrets	string	(empty)	no	comma-separated K8s Secret names to migrate (default: all user secrets)
--secretstore-address	string	(empty)	no	secret store address (selects direct mode; required with --mode=direct; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-allow-insecure	bool	false	no	allow explicitly requested insecure secret store TLS options (development only)
--secretstore-ca-file	string	(empty)	no	public CA bundle bound by the prepared session descriptor
--secretstore-namespace	string	(empty)	no	secret store enterprise namespace
--secretstore-path-prefix	string	(empty)	no	secret store KV v2 path prefix
--secretstore-skip-verify	bool	false	no	skip secret store TLS certificate verification (requires --secretstore-allow-insecure; development only)
--secretstore-token	string	(empty)	no	secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure)
--secretstore-token-file	string	(empty)	no	path to a file containing the secret store token, or '-' to read it from stdin
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--token-hint-check	bool	true	no	check whether the vault token appears to be a root token and warn if so (disable with --token-hint-check=false)
--verify	bool	true	no	read back secrets from secret store to verify migration
--yes, -y	bool	false	no	skip confirmation prompts

All commands