cloudtaser-cli target site-inputs¶
Discover public API/Service/backend addresses, image registries, node probe sources, namespace PSA labels, CNI/DNS and installed seccomp-path hints. Check necessary admission-setup RBAC using non-persistent authorization reviews. No Secrets, exec, probe pods, cluster changes or kubeconfig persistence.
Output is a JSON report with candidates, actionable UNKNOWN/FAIL findings and a review_template. Save and edit review_template as a JSON object for --inputs. Supply actual source/beacon coordinates, bounded CIDRs and site evidence for kubelet root, CNI enforcement, pre/post-DNAT, DNS and admission approval. Discovery never approves candidates or turns a CNI name into filtering proof.
With --reviewed, require all inputs and observations to validate, then create site-values.yaml beside --platform-overlay without replacing any existing file. Apply the platform file followed by this snippet with the same Helm namespace. Reviewed dns_cidrs and webhook_ingress_cidrs are copied to the matched chart's networkPolicy.dnsCIDRs and networkPolicy.webhookIngressCIDRs. Webhook sources need an explicit site review; API egress CIDRs are not substituted. See docs/site-inputs.md. Reviews bind the selected context/API endpoint and live kube-system Namespace UID. Use --direct-source for discovery without a beacon; its review_template records direct_source=true. This mode validates only and refuses --reviewed emission. Exit 0: validated inputs (and snippet if --reviewed); 1: observed FAIL; 2: UNKNOWN; 4: invalid input/usage. This command does not certify a supported installation.
Usage¶
Examples¶
cloudtaser-cli target site-inputs --namespace payments --source-address https://bao.example:8200 --beacon-address relay.example > discovery.json
# Save discovery.json's review_template as inputs.json; fill and review it.
cloudtaser-cli target site-inputs --inputs inputs.json
cloudtaser-cli target site-inputs --inputs inputs.json --reviewed --platform-overlay ./values-k3s.yaml
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--agent-namespace |
string | cloudtaser-system |
no | actual Helm installation namespace |
--beacon-address |
string | (empty) |
no | bare beacon IP/hostname |
--chart-version |
string | 1.0.359 |
no | exact target chart version; overlay must have matching sibling Chart.yaml, values.yaml and values.schema.json |
--cluster-timeout |
duration | 1m0s |
no | deadline for all API and DNS observations |
--context |
string | (empty) |
no | kubeconfig context (default current context) |
--direct-source |
bool | false |
no | validate a direct-source profile with no beacon; no values emission |
--help, -h |
bool | false |
no | help for site-inputs |
--inputs |
string | (empty) |
no | strict JSON object from the report's reviewed review_template |
--kubeconfig |
string | (empty) |
no | path to kubeconfig |
--namespace, -n |
stringArray | [] |
no | explicit workload namespace (repeatable) |
--platform-overlay |
string | (empty) |
no | path to values-gke-cos.yaml or values-k3s.yaml |
--reviewed |
bool | false |
no | confirm review of supplied inputs against this target; emit site-values.yaml when validation passes |
--source-address |
string | (empty) |
no | public HTTPS secret-store endpoint; no credentials |
--system-namespace |
string | kube-system |
no | system namespace to inspect for CNI/DNS |
--timeout |
duration | 20m0s |
no | maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env) |