Skip to content

cloudtaser-cli target revoke

Revokes CloudTaser operator vault tokens for one enrolled cluster or all enrolled clusters through the target operator's admin proxy relay. The CLI does not connect to vault directly; vault API calls flow through: CLI -> operator broker -> beacon -> port -> vault.

The command reads persisted port enrollment accessors from cloudtaser/data/port/enrolled/ and revokes each selected token accessor. Beacon de-registration is reported as unsupported because the current admin proxy and beacon APIs expose no explicit de-registration operation.

Usage

cloudtaser-cli target revoke [flags]

Examples

# Revoke one enrolled cluster token.
  cloudtaser-cli target revoke --fingerprint 0ad50c05-1153-4508-9237-4cb2912e2c23

  # Revoke all enrolled cluster tokens, with interactive confirmation.
  cloudtaser-cli target revoke --all

  # Revoke all enrolled cluster tokens non-interactively.
  cloudtaser-cli target revoke --all --yes

Flags

Flag Type Default Required Description
--all bool false no revoke all enrolled cluster tokens
--broker-address string (empty) no operator broker address (default: auto port-forward)
--broker-allow-insecure bool false no allow plain HTTP to the operator broker when no TLS CA is discoverable (development only)
--broker-ca string (empty) no path to PEM CA bundle used to verify the operator broker TLS cert (default: auto-fetch)
--fingerprint string (empty) no cluster fingerprint to revoke
--help, -h bool false no help for revoke
--kubeconfig string (empty) no path to kubeconfig file
--operator-namespace string cloudtaser-system no namespace where the CloudTaser operator is installed
--secretstore-namespace string (empty) no secret store enterprise namespace
--secretstore-token string (empty) no secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure)
--secretstore-token-file string (empty) no path to a file containing the secret store token, or '-' to read it from stdin
--timeout duration 20m0s no maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--yes, -y bool false no skip interactive confirmation for --all

All commands