cloudtaser-cli target rotate

Performs a rolling restart of workloads annotated with secretstore.cloudtaser.io/inject: "true" to pick up new secrets from OpenBao. This is equivalent to kubectl rollout restart but scoped to CloudTaser-protected workloads.

The deprecated cloudtaser.io/inject annotation remains readable for backward compatibility; new workloads should use secretstore.cloudtaser.io/inject.

The restart is triggered by patching the pod template with a cloudtaser.io/restartedAt annotation, causing a new rollout.

Usage

cloudtaser-cli target rotate [flags]

Examples

# Rotate all protected workloads in a namespace
  cloudtaser-cli target rotate -n production

  # Rotate a specific workload
  cloudtaser-cli target rotate -n production -w deployment/api-server

  # Dry run -- show what would be restarted
  cloudtaser-cli target rotate -n production --dry-run

Flags

Flag	Type	Default	Required	Description
--dry-run	bool	false	no	show what would be rotated without performing the restart
--help, -h	bool	false	no	help for rotate
--kubeconfig	string	(empty)	no	path to kubeconfig file
--namespace, -n	string	(empty)	yes	namespace (required)
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)
--workload, -w	string	(empty)	no	specific workload to rotate (format: kind/name, e.g. deployment/api-server)

All commands