cloudtaser-cli target protect

Scans the cluster for resources managed by the specified secret management solution and generates a shell script that migrates workloads to CloudTaser sovereign secret injection.

The generated script: 1. Patches CloudTaser annotations onto consuming workload pod templates 2. Waits for the resulting workload rollouts to become ready 3. Deletes the old secret management resources

With --auto, the migration is executed directly: 1. Scans for migration items 2. Reads K8s Secret values into memory 3. Writes secrets to OpenBao KV v2 4. Verifies each write with a read-back 5. Wipes secret values from memory

With --plan, uses a MigrationPlan YAML file to apply CloudTaser annotations to workloads in one update, removing only mapped secretKeyRef inputs, then verifies the complete new injected Ready rollout before recording migrated. Source Secrets are retained for separate reviewed retirement; application-level consumption must also be checked through the application. Supports interactive mode (--interactive) where each workload is presented for approval, and auto-approve mode (--yes) for CI/automation.

Supported sources: eso External Secrets Operator sealed-secrets Bitnami Sealed Secrets sops SOPS-encrypted K8s Secrets

Review the generated script carefully before executing (or use --auto --dry-run to preview).

Usage

cloudtaser-cli target protect [flags]

Examples

# Generate ESO protection plan for all namespaces
  cloudtaser-cli target protect --from=eso

  # Generate Sealed Secrets protection plan
  cloudtaser-cli target protect --from=sealed-secrets

  # Generate SOPS protection plan for a specific namespace
  cloudtaser-cli target protect --from=sops -n production

  # Save protection plan to a file
  cloudtaser-cli target protect --from=eso > protection-plan.sh

  # Auto-protect: scan, read secrets, write to secret store (dry-run)
  cloudtaser-cli target protect --from=eso --auto --secretstore-address=https://vault.eu.example.com --secretstore-token-file /path/to/token --dry-run

  # Auto-protect: execute for real
  cloudtaser-cli target protect --from=eso --auto --secretstore-address=https://vault.eu.example.com --secretstore-token-file /path/to/token

  # Force overwrite existing secret store secrets
  cloudtaser-cli target protect --from=eso --auto --secretstore-address=https://vault.eu.example.com --secretstore-token-file /path/to/token --force

  # Interactive migration from a plan file
  cloudtaser-cli target protect --plan plan.yaml --secretstore-address=https://vault.eu.example.com --interactive

  # Auto-approve all workloads in a plan file (CI mode)
  cloudtaser-cli target protect --plan plan.yaml --secretstore-address=https://vault.eu.example.com --yes

Flags

Flag	Type	Default	Required	Description
--auto	bool	false	no	execute migration directly (scan, read, write to secret store, verify)
--dry-run	bool	false	no	Show what would happen without executing
--force	bool	false	no	overwrite existing secrets in the secret store
--from	string	(empty)	no	source to migrate from (supported: eso, sealed-secrets, sops)
--help, -h	bool	false	no	help for protect
--interactive	bool	false	no	prompt for each workload (requires --plan)
--kubeconfig	string	(empty)	no	path to kubeconfig file
--kv-mount	string	secret	no	KV v2 mount path
--namespace, -n	string	(empty)	no	namespace to scan (default: all namespaces)
--plan	string	(empty)	no	path to a MigrationPlan YAML file
--rollout-timeout	duration	5m0s	no	maximum verification wait per plan workload; refused/stale/uninjected rollouts stay pending
--secretstore-address	string	(empty)	no	secret store address (required for --auto or --plan; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-token	string	(empty)	no	secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure)
--secretstore-token-file	string	(empty)	no	path to a file containing the secret store token, or '-' to read it from stdin
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--yes, -y	bool	false	no	auto-approve all workloads (requires --plan)

All commands