cloudtaser-cli target validate

Performs live validation checks against the Kubernetes cluster and the OpenBao instance to verify that CloudTaser is correctly deployed and configured.

Checks performed: - Kubernetes cluster connectivity - CloudTaser operator deployment - Mutating webhook configuration - OpenBao health and seal status - Kubernetes auth method in OpenBao (if token provided) - Count of protected workloads - Count of unprotected workloads referencing K8s Secrets - eBPF daemonset status

Usage

cloudtaser-cli target validate [flags]

Examples

# Basic validation (P2P beacon mode)
  cloudtaser-cli target validate

  # Validate a specific namespace
  cloudtaser-cli target validate -n production

  # Legacy direct-vault: pass --secretstore-address (and optionally --secretstore-token)
  # to additionally check secret store health and auth methods.
  cloudtaser-cli target validate --secretstore-address https://vault.eu.example.com --secretstore-token-file /path/to/token

Flags

Flag	Type	Default	Required	Description
--help, -h	bool	false	no	help for validate
--kubeconfig	string	(empty)	no	path to kubeconfig file
--namespace, -n	string	(empty)	no	namespace to check (default: all namespaces)
--secretstore-address	string	(empty)	no	secret store address (optional, only used in legacy direct-vault mode; env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-token	string	(empty)	no	secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure)
--secretstore-token-file	string	(empty)	no	path to a file containing the secret store token, or '-' to read it from stdin
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)

All commands