Environment Variables Reference¶
Authorised application boundary
Authorised application code is trusted. An authorised app can send out a secret it has copied or encoded. Current content checks do not provide a general guarantee against this disclosure or a malicious authorised app. Memory-read tests and a Ready agent do not prove copied/encoded-secret exfiltration prevention. Enforced NetworkPolicy can restrict destinations, but allowed traffic remains a channel. See Security Model.
This reference combines source-derived defaults with inventories of literal environment reads in the published components. Inventories include compatibility and internal inputs; they identify consumers and do not promise that every name is a supported production override. Effective defaults and validation belong to the owning configuration path.
In Kubernetes, the operator's mutating webhook sets wrapper environment variables automatically based on pod annotations or a CloudTaserConfig CR. Manual configuration is only needed for systemd services, standalone testing, or non-Kubernetes environments.
Wrapper (cloudtaser-wrapper)¶
The wrapper runs as PID 1 in injected pods. It authenticates to the secret store, fetches secrets, and fork+execs the original application.
Secret Store Connection¶
Canonical env-var names are CLOUDTASER_SECRETSTORE_*
Phase 1 of annotation and environment compatibility added CLOUDTASER_SECRETSTORE_* as aliases for the cloudtaser-specific variables listed here. The VAULT_* names that match the upstream OpenBao/HashiCorp Vault SDK (VAULT_ADDR, VAULT_TOKEN, VAULT_SKIP_VERIFY, etc.) are kept because they're the canonical SDK env vars - renaming them would break compatibility with upstream tooling.
| Variable | Required | Default | Description |
|---|---|---|---|
VAULT_ADDR |
Yes | -- | Secret store server address (e.g., https://vault.eu.example.com:8200). Must include scheme and port. Kept as VAULT_ADDR to stay SDK-compatible with OpenBao/HashiCorp Vault tooling. |
VAULT_TOKEN |
Conditional | -- | Static secret-store token. Required when auth method is token. For Kubernetes deployments, the wrapper obtains a token automatically via Kubernetes auth. SDK-compatible name. |
VAULT_AUTH_METHOD |
No | kubernetes |
Auth method: kubernetes or token. Setting VAULT_TOKEN implicitly sets this to token. SDK-compatible name. |
CLOUDTASER_SECRETSTORE_AUTH_ROLE |
Conditional | -- | Kubernetes auth role name registered in the secret store. Required when auth method is kubernetes. Legacy aliases: CLOUDTASER_VAULT_AUTH_ROLE, VAULT_AUTH_ROLE. |
CLOUDTASER_SECRETSTORE_AUTH_PATH |
No | kubernetes |
Secret-store auth mount path (e.g., kubernetes mounts at auth/kubernetes). Legacy aliases: CLOUDTASER_VAULT_AUTH_PATH, VAULT_AUTH_MOUNT_PATH. |
CLOUDTASER_SECRETSTORE_NAMESPACE |
No | -- | Secret-store namespace assigned to this cluster (e.g., cloudtaser/abcd1234). Set by the CLI during target install. Legacy alias: CLOUDTASER_VAULT_NAMESPACE. |
VAULT_SKIP_VERIFY |
No | false |
Disable TLS certificate verification. Development only. SDK-compatible name. |
Secret Configuration¶
| Variable | Required | Default | Description |
|---|---|---|---|
CLOUDTASER_SECRET_PATHS |
Yes | -- | Comma-separated KV v2 paths to fetch from the secret store (e.g., secret/data/myapp/db,secret/data/myapp/api). |
CLOUDTASER_ENV_MAP |
Yes | -- | Secret-store field-to-env-var mappings. Format: field1=VAR1,field2=VAR2;field3=VAR3. Semicolons separate groups corresponding to each secret path. Commas separate individual mappings within a group. |
Process Wrapping¶
| Variable | Required | Default | Description |
|---|---|---|---|
CLOUDTASER_ORIGINAL_CMD |
Yes | -- | The original application entrypoint (e.g., /usr/bin/node). Set automatically by the webhook from the container image's ENTRYPOINT/CMD. |
CLOUDTASER_ORIGINAL_ARGS |
No | -- | Arguments for the original command. Accepts a JSON array (["server.js","--port","8080"]) or whitespace-separated string. |
Secret Delivery Mode¶
| Variable | Required | Default | Description |
|---|---|---|---|
CLOUDTASER_KEEP_SECRETS_IN_ENV |
No | false |
When true, secret values remain as real entries in the child's exec-time environ. Every fork+exec descendant inherits the plaintext. Works with all runtimes including environ-snapshot runtimes (CPython, bash, Perl). |
CLOUDTASER_ENV_SNAPSHOT_MODE |
No | Derived when unset | Accepted explicit values: "strip", "strict". Recognised snapshot runtimes auto-select strip when the dynamic glibc interposer is available. Strip controls hooked libc exec calls; raw syscalls bypass these hooks. |
Rotation¶
| Variable | Required | Default | Description |
|---|---|---|---|
CLOUDTASER_ROTATION |
No | restart |
How the wrapper handles secret changes during lease renewal. Values: restart (terminate and re-launch child with new secrets), sighup (send SIGHUP to child), none (fetch once, no rotation). |
CLOUDTASER_RENEWAL_INTERVAL |
No | 30s |
How often the wrapper checks and renews secret-store leases. Uses Go duration format (e.g., 30s, 5m, 1h). |
eBPF Integration¶
| Variable | Required | Default | Description |
|---|---|---|---|
CLOUDTASER_EBPF_AGENT_ADDR |
No | -- | eBPF agent address. Accepts only a Unix socket (unix:///var/run/cloudtaser/agent.sock); TCP addresses are rejected. Set automatically by the webhook when cloudtaser.io/ebpf: "true". |
CLOUDTASER_POD_UID |
No | -- | Kubernetes pod UID for eBPF cgroup identification. Set automatically by the webhook via the downward API. |
The retired node-IP TCP fallback only logs a warning and leaves eBPF integration disabled. Use the injected Unix socket address and verify agent readiness.
Health Server¶
| Variable | Required | Default | Description |
|---|---|---|---|
CLOUDTASER_HEALTH_ADDR |
No | :8199 |
Listen address for the wrapper's health/unseal HTTP server. Endpoints: GET /healthz (liveness), GET /readyz (readiness), POST /v1/unseal (sealed mode token delivery). |
Memory Protection¶
| Variable | Required | Default | Description |
|---|---|---|---|
CLOUDTASER_REQUIRE_MLOCK |
No | true |
Exit if mlock fails. The operator injects and locks this setting. |
CLOUDTASER_REQUIRE_MEMFD_SECRET |
No | true |
Exit if memfd_secret is unavailable. Requires a qualifying Linux kernel; the operator injects and locks this setting. |
Defaults above are inferred from the wrapper configuration, and enforced by operator injection.
Broker TLS (Platform Integration)¶
| Variable | Required | Default | Description |
|---|---|---|---|
CLOUDTASER_BROKER_TLS_CERT |
No | -- | TLS certificate for the health/unseal server -- either an inline PEM block or a filesystem path. When set with CLOUDTASER_BROKER_TLS_KEY, the server uses TLS instead of plain HTTP. |
CLOUDTASER_BROKER_TLS_KEY |
No | -- | TLS private key for the health/unseal server -- either an inline PEM block or a filesystem path. |
CLOUDTASER_BROKER_TLS_CA |
No | -- | CA certificate for mutual TLS client verification on the /v1/unseal endpoint -- either an inline PEM block or a filesystem path. |
eBPF Agent (cloudtaser-ebpf)¶
The eBPF agent runs as a DaemonSet on every node. It monitors and enforces kernel-level secret protection.
| Variable | Required | Default | Description |
|---|---|---|---|
EBPF_OBJECT_PATH |
No | /opt/cloudtaser/secret_monitor.o |
Path to the compiled BPF object file. |
ENFORCE_MODE |
No | true |
Enforce configured vectors where available (synchronous deny or reactive SIGKILL). This does not prevent authorised copied/encoded-secret disclosure in general. |
LOG_ALL |
No | false |
When true, logs all monitored syscall events, not just violations. Useful for debugging but generates high log volume. |
REACTIVE_KILL |
No | Same as ENFORCE_MODE |
When true, SIGKILLs processes that attempt to exfiltrate secrets when synchronous kprobe enforcement is not available (requires kernel CONFIG_BPF_KPROBE_OVERRIDE). |
GLOBAL_PRIVESC_DETECT |
No | true |
When true, detects kernel module loading and eBPF program loading from ALL PIDs, not just monitored ones. |
GRPC_LISTEN_ADDR |
No | `` (empty; Unix socket only) | TCP requires explicit TLS credentials; gRPC server address for receiving PID registrations from wrapper instances. |
PLATFORM_ENDPOINT |
No | -- | cloudtaser Platform gRPC/HTTP endpoint for sending audit events. |
NODE_NAME |
No | -- | Kubernetes node name (set via downward API). |
HEALTH_LISTEN_ADDR |
No | 0.0.0.0:19099 |
HTTP health check server address. |
Secret Store Bootstrap (cloudtaser-cli source install + cloudtaser-cli source configure)¶
These environment variables configure the cloudtaser-cli source install + cloudtaser-cli source configure command. All can be overridden by CLI flags (flags take precedence).
| Variable | Required | Default | Description |
|---|---|---|---|
OPENBAO_ADDR |
Yes | -- | Secret store service URL (e.g., https://openbao.vault.svc:8200). See the note on http:// vs https:// in the CLI reference Commands section. |
OPENBAO_NAMESPACE |
Yes | -- | Kubernetes namespace where the secret store is deployed. |
OPENBAO_RELEASE_NAME |
Yes | -- | Helm release name, used for per-pod DNS resolution (e.g., openbao). |
BOOTSTRAP_SHAMIR_SHARES |
No | 5 |
Number of Shamir secret shares for OpenBao initialization. |
BOOTSTRAP_SHAMIR_THRESHOLD |
No | 3 |
Minimum number of shares required to unseal. |
BOOTSTRAP_KV_PATH |
No | secret |
KV v2 engine mount path. |
BOOTSTRAP_AUTH_PATH |
No | kubernetes |
Kubernetes auth method mount path. |
BOOTSTRAP_POLICY_NAME |
No | cloudtaser |
Secret-store policy name created during bootstrap (backend: OpenBao/HashiCorp Vault). |
BOOTSTRAP_ROLE_NAME |
No | cloudtaser |
Secret-store role name created during bootstrap. |
BOOTSTRAP_OUTPUT_SECRET |
No | cloudtaser-openbao-init |
Kubernetes Secret name where init output (unseal keys + root token) is stored. |
BOOTSTRAP_ROLE_BOUND_SA_NAMES |
No | * |
Service account names allowed to authenticate via the created role. |
BOOTSTRAP_ROLE_BOUND_SA_NAMESPACES |
No | * |
Namespaces whose service accounts can authenticate via the created role. |
BOOTSTRAP_ROLE_TTL |
No | 1h |
Token TTL for the created role. |
Operator (cloudtaser-operator)¶
The operator reads its configuration from Helm values, command-line flags, and the Kubernetes API (annotations and CRDs). It also reads environment inputs directly and projects wrapper environment variables onto injected pods. The generated inventory below records literal environment reads and helper arguments at the published release. It includes compatibility and diagnostic inputs; their presence is not a recommendation to override security policy. Effective defaults and validation belong to the owning configuration path.
The environment variables the operator injects into pods are:
| Injected Variable | Source |
|---|---|
CLOUDTASER_ORIGINAL_CMD |
Resolved from pod spec command or container image ENTRYPOINT |
CLOUDTASER_ORIGINAL_ARGS |
Resolved from pod spec args or container image CMD (JSON array) |
VAULT_ADDR |
cloudtaser.io/secretstore-address annotation (legacy alias: cloudtaser.io/vault-address) or CloudTaserConfig |
VAULT_AUTH_METHOD |
cloudtaser.io/secretstore-auth-method annotation (legacy alias: cloudtaser.io/vault-auth-method, default: kubernetes) |
CLOUDTASER_SECRETSTORE_AUTH_ROLE |
cloudtaser.io/secretstore-role annotation (legacy alias: cloudtaser.io/vault-role) or CloudTaserConfig. The wrapper also reads legacy role aliases. |
CLOUDTASER_SECRETSTORE_AUTH_PATH |
cloudtaser.io/secretstore-auth-path annotation (legacy alias: cloudtaser.io/vault-auth-path) or CloudTaserConfig. The wrapper also reads legacy auth-path aliases. |
CLOUDTASER_SECRET_PATHS |
secretstore.cloudtaser.io/secret-paths annotation or CloudTaserConfig |
CLOUDTASER_ENV_MAP |
secretstore.cloudtaser.io/env-map annotation or CloudTaserConfig |
CLOUDTASER_ROTATION |
cloudtaser.io/rotation annotation (default: restart) |
VAULT_SKIP_VERIFY |
cloudtaser.io/secretstore-tls-skip-verify or cloudtaser.io/secretstore-skip-verify annotation (legacy aliases: the vault-* spellings) |
CLOUDTASER_EBPF_AGENT_ADDR |
Set to unix:///var/run/cloudtaser/agent.sock when cloudtaser.io/ebpf: "true" |
CLOUDTASER_POD_UID |
Set from downward API metadata.uid when eBPF is enabled |
Wrapper auth paths are mount names; the operator separately defaults to auth/kubernetes.
The unprefixed interval and health names are deprecated aliases; use the prefixed inputs above.
Operator environment read inventory¶
| Input name | Consumer (inferred from published source) |
|---|---|
CLOUDTASER_ALLOW_LEGACY_SECRET_PROXY |
main.go (envOrDefault) |
CLOUDTASER_ALLOW_LEGACY_UNSEAL |
main.go (envOrDefault) |
CLOUDTASER_ALLOW_UNTRUSTED_REGISTRIES |
main.go (Getenv) |
CLOUDTASER_APPARMOR_PROFILE |
main.go (envOrDefault) |
CLOUDTASER_ATTESTATION_ENABLED |
main.go (Getenv) |
CLOUDTASER_ATTESTATION_INTERVAL |
main.go (envDurationOrDefault) |
CLOUDTASER_AUTH_TOKEN_LOOPBACK_PORT |
main.go (envIntOrDefault) |
CLOUDTASER_BEACON_ADDRESS |
main.go (Getenv) |
CLOUDTASER_BEACON_ALLOW_INSECURE |
main.go (envOrDefault) |
CLOUDTASER_BEACON_AUTH_KEY |
main.go (Getenv) |
CLOUDTASER_BEACON_AUTH_KEY_FILE |
main.go (Getenv) |
CLOUDTASER_BEACON_AUTH_KEY_OVERLAP_UNTIL |
main.go (Getenv) |
CLOUDTASER_BEACON_CA |
main.go (Getenv) |
CLOUDTASER_BEACON_INFO_HASH |
main.go (Getenv) |
CLOUDTASER_BEACON_INIT_SALT |
internal/broker/beacon.go (Getenv); main.go (Getenv) |
CLOUDTASER_BEACON_INIT_SALT_OVERLAP_UNTIL |
internal/broker/beacon.go (Getenv); main.go (Getenv) |
CLOUDTASER_BEACON_INSECURE_SKIP_VERIFY |
main.go (Getenv) |
CLOUDTASER_BEACON_MAX_CONSECUTIVE_FAILURES |
internal/broker/beacon.go (Getenv) |
CLOUDTASER_BEACON_PREVIOUS_AUTH_KEY_FILE |
main.go (Getenv) |
CLOUDTASER_BEACON_PREVIOUS_INIT_SALT |
internal/broker/beacon.go (Getenv); main.go (Getenv) |
CLOUDTASER_BEACON_SPKI_PIN |
main.go (Getenv) |
CLOUDTASER_BEACON_TRUST_SYSTEM_ROOTS |
main.go (Getenv) |
CLOUDTASER_BROKER_ADDR |
main.go (envOrDefault) |
CLOUDTASER_BROKER_ALLOW_HTTP |
main.go (envOrDefault) |
CLOUDTASER_BROKER_TLS_CA_BUNDLE |
main.go (envOrDefault) |
CLOUDTASER_BROKER_TLS_ENABLED |
main.go (envOrDefault) |
CLOUDTASER_CLUSTER_ID |
main.go (Getenv) |
CLOUDTASER_COSIGN_ENFORCED |
main.go (envOrDefault) |
CLOUDTASER_COSIGN_KEY |
main.go (Getenv) |
CLOUDTASER_COSIGN_KEY_SECRET |
main.go (Getenv) |
CLOUDTASER_DANGEROUS_CAPABILITIES_DENY |
main.go (envOrDefault) |
CLOUDTASER_DBPROXY |
internal/webhook/sidecar_injector.go (proxyP2PEnvVars) |
CLOUDTASER_DBPROXY_IMAGE |
main.go (Getenv) |
CLOUDTASER_DBPROXY_IMAGE_PULL_POLICY |
main.go (envOrDefault) |
CLOUDTASER_DEMO_SIGNING_ENABLED |
main.go (Getenv) |
CLOUDTASER_DIGEST_NEGATIVE_TTL_SECONDS |
internal/registry/registry.go (envDuration) |
CLOUDTASER_DIGEST_POSITIVE_TTL_SECONDS |
internal/registry/registry.go (envDuration) |
CLOUDTASER_DIGEST_TIMEOUT_SECONDS |
internal/registry/registry.go (envDuration) |
CLOUDTASER_EBPF_AGENT_SA |
main.go (envOrDefault) |
CLOUDTASER_EBPF_ALLOW_INSECURE_HTTP |
main.go (Getenv) |
CLOUDTASER_EBPF_ALLOW_INSECURE_TLS |
main.go (envOrDefault) |
CLOUDTASER_EBPF_ALLOW_NAMESPACE_OPT_OUT |
main.go (Getenv) |
CLOUDTASER_EBPF_DAEMONSET_NAME |
main.go (envOrDefault) |
CLOUDTASER_EBPF_HEALTH_ADDR |
main.go (envOrDefault) |
CLOUDTASER_ENABLE_EBPF_GATE |
main.go (envOrDefault) |
CLOUDTASER_ENABLE_NETWORK_POLICY |
main.go (Getenv) |
CLOUDTASER_ENABLE_REVERSE_CONNECT |
main.go (envOrDefault) |
CLOUDTASER_HEALTH_CA_FILE |
main.go (Getenv) |
CLOUDTASER_HEALTH_ISSUER_TLS_CA_FILE |
main.go (Getenv) |
CLOUDTASER_HEALTH_ISSUER_URL |
main.go (Getenv) |
CLOUDTASER_INIT_IMAGE |
main.go (Getenv) |
CLOUDTASER_INJECT_RUNTIME_DEFAULT_SECCOMP |
main.go (envOrDefault) |
CLOUDTASER_METRICS_ENABLED |
config.go (envOrDefault) |
CLOUDTASER_OPERATOR_BROKER_AUTH_TOKEN |
secrets_setup.go (LookupEnv) |
CLOUDTASER_OPERATOR_NAMESPACE |
main.go (envOrDefault) |
CLOUDTASER_OPERATOR_POD_UID |
main.go (Getenv) |
CLOUDTASER_OPERATOR_REPLICAS |
main.go (envIntOrDefault) |
CLOUDTASER_OPERATOR_SA_NAME |
main.go (envOrDefault) |
CLOUDTASER_OPERATOR_SECRET_STORE |
main.go (envOrDefault) |
CLOUDTASER_OPERATOR_STORE_EGRESS |
internal/controller/networkpolicy_controller.go (Getenv); main.go (Getenv) |
CLOUDTASER_PORT_ADDR |
main.go (envOrDefault) |
CLOUDTASER_PORT_CA_CERT |
main.go (Getenv) |
CLOUDTASER_PORT_HEALTH_ADDR |
main.go (Getenv) |
CLOUDTASER_PORT_SELF_BOOTSTRAP |
main.go (envOrDefault) |
CLOUDTASER_PORT_TLS_CERT |
main.go (Getenv) |
CLOUDTASER_PORT_TLS_KEY |
main.go (Getenv) |
CLOUDTASER_POSTURE_CONFIG_FILE |
posture_startup.go (Getenv) |
CLOUDTASER_REQUIRE_ADMIN_ENROLLMENT |
main.go (Getenv) |
CLOUDTASER_REQUIRE_EBPF_AGENT_ON_CREATE |
main.go (envOrDefault) |
CLOUDTASER_RUNTIME_SOCKET_DENY_PATHS |
main.go (envOrDefault) |
CLOUDTASER_S3PROXY |
internal/webhook/sidecar_injector.go (proxyP2PEnvVars) |
CLOUDTASER_S3PROXY_IMAGE |
main.go (Getenv) |
CLOUDTASER_S3PROXY_IMAGE_PULL_POLICY |
main.go (envOrDefault) |
CLOUDTASER_SECCOMP_PROFILE |
main.go (Getenv) |
CLOUDTASER_SECRETSTORE_AUTH_PATH |
main.go (envFirstOrDefault) |
CLOUDTASER_SECRETSTORE_AUTH_ROLE |
main.go (envFirstOrDefault) |
CLOUDTASER_SECRETSTORE_DEFAULT_BACKEND |
main.go (envFirst) |
CLOUDTASER_SECRETSTORE_KV_MOUNT |
main.go (envFirstOrDefault) |
CLOUDTASER_SECRETSTORE_NAMESPACE |
main.go (envFirst) |
CLOUDTASER_SECRETSTORE_PORT_ADDR |
main.go (envFirst) |
CLOUDTASER_SECRETSTORE_SAAS_ADDR |
main.go (envFirst) |
CLOUDTASER_STRICT_BPF_LOADERS |
main.go (Getenv) |
CLOUDTASER_STRICT_BPF_LOAD_MODE |
main.go (LookupEnv) |
CLOUDTASER_VAULT_AUTH_PATH |
main.go (envFirstOrDefault) |
CLOUDTASER_VAULT_AUTH_ROLE |
main.go (envFirstOrDefault) |
CLOUDTASER_VAULT_DEFAULT_BACKEND |
main.go (envFirst) |
CLOUDTASER_VAULT_KV_MOUNT |
main.go (envFirstOrDefault) |
CLOUDTASER_VAULT_NAMESPACE |
main.go (envFirst) |
CLOUDTASER_VAULT_PORT_ADDR |
main.go (envFirst) |
CLOUDTASER_VAULT_SAAS_ADDR |
main.go (envFirst) |
CLOUDTASER_VERIFY_COSIGN_SIGNATURES |
main.go (envOrDefault) |
CLOUDTASER_VS_FDPASS_AUTH_DERIVE_SUPPORTED |
internal/webhook/sidecar_injector.go (Getenv) |
CLOUDTASER_VS_FRESHNESS |
internal/webhook/sidecar_injector.go (Getenv) |
CLOUDTASER_VS_FRESHNESS_TIMEOUT |
internal/webhook/sidecar_injector.go (Getenv) |
CLOUDTASER_VS_NONCE_BUDGET |
internal/webhook/sidecar_injector.go (Getenv) |
CLOUDTASER_VS_NONCE_LEASE_SIZE |
internal/webhook/sidecar_injector.go (Getenv) |
CLOUDTASER_VS_NONCE_LEASE_TIMEOUT |
internal/webhook/sidecar_injector.go (Getenv) |
CLOUDTASER_VS_SIDECAR_IMAGE |
internal/webhook/sidecar_injector.go (Getenv) |
CLOUDTASER_WRAPPER_INIT_IMAGE_PULL_POLICY |
main.go (envOrDefault) |
CLOUDTASER_WRAPPER_METRICS_ADDR |
main.go (envOrDefault) |
CLOUDTASER_WRAPPER_METRICS_ENABLED |
main.go (envOrDefault) |
HOSTNAME |
main.go (Getenv) |
KUBERNETES_SERVICE_HOST |
internal/webhook/wrapper_oidc.go (Getenv) |
KUBERNETES_SERVICE_PORT |
internal/webhook/wrapper_oidc.go (Getenv) |
NODE_NAME |
internal/healthcsi/provider.go (Getenv) |
POD_NAME |
main.go (envOrDefault) |
VAULT_ADDR |
main.go (Getenv) |
VAULT_AUTH_PATH |
main.go (envFirstOrDefault) |
VAULT_AUTH_ROLE |
main.go (envFirstOrDefault) |
VAULT_CACERT |
internal/controller/vault_health.go (Getenv); internal/vault/client.go (Getenv); main.go (Getenv) |
VAULT_KV_MOUNT |
main.go (envFirstOrDefault) |
Operator flags¶
| Input name | Consumer (inferred from published source) |
|---|---|
--admission-ha |
main.go (flag) |
--allow-legacy-secret-proxy |
main.go (flag) |
--allow-legacy-unseal |
main.go (flag) |
--allow-untrusted-registries |
main.go (flag) |
--apparmor-profile |
main.go (flag) |
--attestation-enabled |
main.go (flag) |
--attestation-interval |
main.go (flag) |
--auth-token-loopback-port |
main.go (flag) |
--beacon-address |
main.go (flag) |
--beacon-allow-insecure |
main.go (flag) |
--beacon-auth-key-file |
main.go (flag) |
--beacon-auth-key-overlap-until |
main.go (flag) |
--beacon-ca |
main.go (flag) |
--beacon-info-hash |
main.go (flag) |
--beacon-insecure-skip-verify |
main.go (flag) |
--beacon-runtime-config-file |
main.go (flag) |
--beacon-spki-pin |
main.go (flag) |
--beacon-trust-system-roots |
main.go (flag) |
--broker-allow-http |
main.go (flag) |
--broker-bind-address |
main.go (flag) |
--broker-ca-file |
internal/healthcsi/provider.go (flag) |
--broker-tls-ca-bundle |
main.go (flag) |
--broker-tls-enabled |
main.go (flag) |
--broker-url |
internal/healthcsi/provider.go (flag) |
--cert-dir |
main.go (flag) |
--cluster-id |
main.go (flag) |
--cosign-enforced |
main.go (flag) |
--cosign-key |
main.go (flag) |
--cosign-key-secret |
main.go (flag) |
--dangerous-capabilities-deny |
main.go (flag) |
--db-proxy-image |
main.go (flag) |
--db-proxy-image-pull-policy |
main.go (flag) |
--demo-signing-enabled |
main.go (flag) |
--drain-self |
main.go (flag) |
--ebpf-agent-service-account |
main.go (flag) |
--ebpf-allow-insecure-http |
main.go (flag) |
--ebpf-allow-insecure-tls |
main.go (flag) |
--ebpf-allow-namespace-opt-out |
main.go (flag) |
--ebpf-daemonset-name |
main.go (flag) |
--ebpf-health-addr |
main.go (flag) |
--enable-ebpf-gate |
main.go (flag) |
--enable-network-policy |
main.go (flag) |
--enable-reverse-connect |
main.go (flag) |
--fingerprint-interval |
main.go (flag) |
--health-ca-file |
internal/healthcsi/provider.go (flag) |
--health-probe-bind-address |
main.go (flag) |
--init-image |
main.go (flag) |
--inject-runtime-default-seccomp |
main.go (flag) |
--leader-elect |
main.go (flag) |
--metrics-addr |
config.go (flag) |
--metrics-bind-address |
config.go (flag) |
--metrics-enabled |
config.go (flag) |
--node |
internal/healthcsi/provider.go (flag) |
--operator-introduction-config |
main.go (flag) |
--operator-introduction-transition |
main.go (flag) |
--operator-namespace |
main.go (flag) |
--operator-replicas |
main.go (flag) |
--operator-sa-name |
main.go (flag) |
--pod-token-ttl-seconds |
main.go (flag) |
--port-bind-address |
main.go (flag) |
--port-ca-cert |
main.go (flag) |
--port-health-addr |
main.go (flag) |
--port-self-bootstrap |
main.go (flag) |
--port-tls-cert |
main.go (flag) |
--port-tls-key |
main.go (flag) |
--previous-beacon-auth-key-file |
main.go (flag) |
--require-admin-enrollment |
main.go (flag) |
--require-ebpf-agent-on-create |
main.go (flag) |
--runtime-socket-deny-paths |
main.go (flag) |
--s3-proxy-image |
main.go (flag) |
--s3-proxy-image-pull-policy |
main.go (flag) |
--seccomp-localhost-profile |
main.go (flag) |
--secret-backend |
main.go (flag) |
--socket |
internal/healthcsi/provider.go (flag) |
--vault-address |
main.go (flag) |
--vault-auth-path |
main.go (flag) |
--vault-auth-role |
main.go (flag) |
--vault-default-backend |
main.go (flag) |
--vault-kv-mount |
main.go (flag) |
--vault-namespace |
main.go (flag) |
--vault-port-address |
main.go (flag) |
--vault-saas-address |
main.go (flag) |
--verify-cosign-signatures |
main.go (flag) |
--version |
main.go (flag) |
--webhook-config-name |
main.go (flag) |
--webhook-port |
main.go (flag) |
--wrapper-init-image-pull-policy |
main.go (flag) |
--wrapper-metrics-addr |
main.go (flag) |
--wrapper-metrics-enabled |
main.go (flag) |
Wrapper environment read inventory¶
The generated inventory includes subsystem inputs, compatibility aliases and internal handshakes read by the published wrapper. A read name alone does not establish a supported deployment setting. The operator locks security-sensitive injected inputs; application authors must not use these names to weaken protection.
Broker delivery requires CLOUDTASER_BROKER_ADDR and encrypted-envelope identity, including CLOUDTASER_CLUSTER_FINGERPRINT, CLOUDTASER_SECRET_ENVELOPE_TOKEN_PATH and the projected pod identity. CLOUDTASER_UNSEAL_CLIENT_CA is the preferred unseal-listener trust input; the published parser can use a valid CLOUDTASER_BROKER_CA_PEM fallback. These are separate identity and TLS contracts. Use the operator projection on Kubernetes.
| Input name | Consumer (inferred from published source) |
|---|---|
CLOUDTASER_AUDIT_LOG |
internal/audit/audit.go (Getenv) |
CLOUDTASER_BROKER_ADDR |
internal/config/config.go (Getenv); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_BROKER_ALLOW_HTTP |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_BROKER_CA_FILE |
internal/config/config.go (Getenv); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_BROKER_CA_PEM |
internal/config/config.go (Getenv); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_BROKER_SERVER_NAME |
internal/config/config.go (Getenv); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_BROKER_TLS_CA |
internal/config/config.go (Getenv) |
CLOUDTASER_BROKER_TLS_CA_BUNDLE |
internal/config/config.go (Getenv); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_BROKER_TLS_CERT |
internal/config/config.go (Getenv) |
CLOUDTASER_BROKER_TLS_KEY |
internal/config/config.go (Getenv) |
CLOUDTASER_CLUSTER_FINGERPRINT |
internal/config/config.go (Getenv); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_CONFIDENTIAL_VM |
internal/score/score.go (Getenv) |
CLOUDTASER_CONSUMER |
internal/config/config.go (Getenv) |
CLOUDTASER_CORRELATION_ID |
cmd/wrapper/main.go (Getenv); internal/config/config.go (Getenv); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_EBPF_AGENT_ADDR |
cmd/volume-shield-sidecar/main.go (Getenv); internal/config/config.go (Getenv) |
CLOUDTASER_EBPF_ALLOW_INSECURE_HTTP |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_EBPF_ATTESTATION_HMAC_KEY |
internal/config/config.go (Getenv) |
CLOUDTASER_EBPF_ENROLLMENT_SKIP |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_EBPF_ENROLLMENT_TIMEOUT |
internal/config/config.go (Getenv) |
CLOUDTASER_EBPF_HEALTH_PORT |
internal/config/config.go (Getenv) |
CLOUDTASER_EBPF_MODE |
cmd/volume-shield-sidecar/main.go (Getenv); internal/config/config.go (Getenv) |
CLOUDTASER_EBPF_NODE_IP |
cmd/wrapper/main.go (Getenv); internal/config/config.go (Getenv) |
CLOUDTASER_ENV_ALLOWLIST |
internal/config/config.go (Getenv) |
CLOUDTASER_ENV_MAP |
internal/config/config.go (Getenv) |
CLOUDTASER_ENV_SNAPSHOT_MODE |
internal/config/config.go (Getenv) |
CLOUDTASER_ENV_SNAPSHOT_STRIP |
interposer/libcloudtaser.c (real_getenv) |
CLOUDTASER_EXEC_ACK_FD |
internal/exec/env_exec_linux.go (Getenv) |
CLOUDTASER_EXEC_TABLE_FD |
internal/exec/env_exec_linux.go (Getenv) |
CLOUDTASER_EXPECTED_OPERATOR_SA |
cmd/wrapper/main.go (Getenv); internal/health/unseal_auth_common.go (Getenv) |
CLOUDTASER_HEALTH_ADDR |
internal/config/config.go (envWithDeprecatedFallback) |
CLOUDTASER_JWKS_CACHE_TTL_SECONDS |
internal/health/oidc_verify.go (Getenv) |
CLOUDTASER_KEEP_SECRETS_IN_ENV |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_LEGACY_SECRET_PROXY |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_MAX_RENEWAL_FAILURE_DURATION |
internal/config/config.go (Getenv) |
CLOUDTASER_METRICS_ADDR |
internal/config/config.go (Getenv) |
CLOUDTASER_METRICS_ALLOW_EXTERNAL |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_METRICS_ENABLED |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_NATIVE_SECRET_FD |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_NODE_NAME |
cmd/volume-shield-broker/main.go (Getenv) |
CLOUDTASER_ORIGINAL_ARGS |
internal/config/config.go (Getenv) |
CLOUDTASER_ORIGINAL_CMD |
internal/config/config.go (Getenv) |
CLOUDTASER_POD_NAME |
internal/config/config.go (Getenv); internal/volumeshield/broker_client.go (Getenv); internal/volumeshield/dek_fetcher.go (Getenv) |
CLOUDTASER_POD_NAMESPACE |
cmd/volume-shield-sidecar/main.go (Getenv); internal/config/config.go (Getenv); internal/volumeshield/broker_client.go (Getenv) |
CLOUDTASER_POD_UID |
cmd/volume-shield-sidecar/main.go (Getenv); internal/config/config.go (Getenv); internal/volumeshield/broker_client.go (Getenv); internal/volumeshield/dek_fetcher.go (Getenv); internal/volumeshield/fdpass_auth.go (Getenv) |
CLOUDTASER_READY_PROBE |
internal/health/ready_probe.go (getenv) |
CLOUDTASER_REEXEC_SCRUB |
cmd/wrapper/main.go (Getenv); internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_REEXEC_SCRUBBED |
internal/config/config.go (Getenv); internal/env/scrub.go (Getenv) |
CLOUDTASER_RENEWAL_INTERVAL |
internal/config/config.go (envWithDeprecatedFallback) |
CLOUDTASER_REQUIRE_MEMFD_SECRET |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_REQUIRE_MLOCK |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_REVOCATION_CHECK_INTERVAL |
internal/config/config.go (Getenv) |
CLOUDTASER_REVOCATION_GRACE |
internal/config/config.go (Getenv) |
CLOUDTASER_ROTATION |
internal/config/config.go (Getenv) |
CLOUDTASER_RUNTIME_POLICY |
interposer/libcloudtaser.c (real_getenv) |
CLOUDTASER_SECRETSTORE_AUTH_PATH |
internal/config/config.go (Getenv) |
CLOUDTASER_SECRETSTORE_AUTH_ROLE |
internal/config/config.go (Getenv) |
CLOUDTASER_SECRETSTORE_NAMESPACE |
internal/config/config.go (Getenv); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_SECRET_ALLOWLIST |
internal/config/config.go (Getenv) |
CLOUDTASER_SECRET_BACKEND |
internal/config/config.go (Getenv) |
CLOUDTASER_SECRET_ENVELOPE_TOKEN_PATH |
internal/broker/envelope.go (Getenv); internal/config/config.go (Getenv); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_SECRET_FD |
interposer/libcloudtaser.c (real_getenv) |
CLOUDTASER_SECRET_FETCH_TIMEOUT |
internal/config/config.go (Getenv) |
CLOUDTASER_SECRET_FETCH_TOKEN_PATH |
internal/broker/client.go (Getenv); internal/keyfetch/keyfetch.go (Getenv); internal/vault/client.go (Getenv); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_SECRET_FETCH_TRANSIENT_TIMEOUT |
internal/config/config.go (Getenv) |
CLOUDTASER_SECRET_PATHS |
internal/config/config.go (Getenv) |
CLOUDTASER_TOKEN_FD |
internal/config/config.go (Getenv) |
CLOUDTASER_UNSEAL_CLIENT_CA |
internal/config/config.go (Getenv) |
CLOUDTASER_UNSEAL_TOKEN_PATH |
internal/broker/register.go (Getenv) |
CLOUDTASER_VAULT_ALLOW_HTTP |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_VAULT_ALLOW_INSECURE |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool); internal/volumeshield/vault_dek_fetcher.go (Getenv) |
CLOUDTASER_VAULT_AUTH_PATH |
internal/config/config.go (Getenv) |
CLOUDTASER_VAULT_AUTH_ROLE |
internal/config/config.go (Getenv) |
CLOUDTASER_VAULT_NAMESPACE |
internal/config/config.go (Getenv); internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_VOLUME_SHIELD_ENABLED |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool); internal/volumeshield/manager.go (Getenv) |
CLOUDTASER_VOLUME_SHIELD_MOUNTS |
cmd/volume-shield-sidecar/main.go (Getenv); internal/volumeshield/manager.go (Getenv) |
CLOUDTASER_VS_BROKER_HEALTH_ADDR |
cmd/volume-shield-broker/main.go (Getenv) |
CLOUDTASER_VS_BROKER_MODE |
cmd/volume-shield-broker/main.go (Getenv); internal/volumeshield/broker_client.go (Getenv) |
CLOUDTASER_VS_BROKER_SOCK |
cmd/volume-shield-broker/main.go (Getenv); cmd/wrapper/main.go (Getenv) |
CLOUDTASER_VS_DEK_BACKEND |
internal/volumeshield/env_dek_fetcher.go (Getenv) |
CLOUDTASER_VS_DEK_PROVISION_ENDPOINT |
internal/volumeshield/dek_provision.go (Getenv) |
CLOUDTASER_VS_DEK_PROVISION_TIMEOUT |
internal/volumeshield/dek_provision.go (Getenv) |
CLOUDTASER_VS_DEK_PROVISION_TOKEN_AUDIENCE |
internal/volumeshield/dek_provision.go (Getenv) |
CLOUDTASER_VS_DEK_PROVISION_TOKEN_FILE |
internal/volumeshield/dek_provision.go (Getenv) |
CLOUDTASER_VS_FDPASS_AUTH_DERIVE |
internal/volumeshield/fdpass_auth.go (Getenv) |
CLOUDTASER_VS_FDPASS_AUTH_KEY |
internal/volumeshield/fdpass_auth.go (Getenv) |
CLOUDTASER_VS_FDPASS_AUTH_KEY_FILE |
internal/volumeshield/fdpass_auth.go (Getenv) |
CLOUDTASER_VS_FDPASS_AUTH_TOKEN_FILE |
internal/volumeshield/fdpass_auth.go (Getenv) |
CLOUDTASER_VS_FRESHNESS |
internal/volumeshield/config.go (Getenv); internal/volumeshield/freshness.go (Getenv) |
CLOUDTASER_VS_FRESHNESS_TIMEOUT |
internal/volumeshield/freshness.go (Getenv) |
CLOUDTASER_VS_GENERATION_INTERVAL |
internal/volumeshield/volume_generation.go (Getenv) |
CLOUDTASER_VS_HEALTH_PORT |
cmd/volume-shield-sidecar/main.go (Getenv) |
CLOUDTASER_VS_MOUNT_PATH |
cmd/volume-shield-sidecar/main.go (Getenv) |
CLOUDTASER_VS_NONCE_BUDGET |
internal/volumeshield/nonce_budget.go (Getenv) |
CLOUDTASER_VS_NONCE_LEASE_SIZE |
internal/volumeshield/nonce_budget.go (Getenv) |
CLOUDTASER_VS_NONCE_LEASE_TIMEOUT |
internal/volumeshield/nonce_budget.go (Getenv) |
CLOUDTASER_VS_PVC_UID |
cmd/volume-shield-sidecar/main.go (Getenv) |
CLOUDTASER_VS_RAW_PATH |
cmd/volume-shield-sidecar/main.go (Getenv) |
CLOUDTASER_VS_SIDECAR_SOCK |
cmd/volume-shield-broker/main.go (Getenv); cmd/volume-shield-sidecar/main.go (Getenv) |
CLOUDTASER_VS_STRICT_MODE |
internal/volumeshield/config.go (Getenv); internal/volumeshield/daemon.go (Getenv) |
CLOUDTASER_VS_TRUSTED_STATE_TOKEN_AUDIENCE |
internal/volumeshield/broker_trusted_state.go (Getenv) |
CLOUDTASER_WATCHDOG_ENABLED |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool) |
CLOUDTASER_WATCHDOG_INTERVAL |
internal/config/config.go (Getenv) |
CLOUDTASER_WATCHDOG_THRESHOLD |
internal/config/config.go (Getenv) |
CLOUDTASER_WRAPPER_LOG_LEVEL |
cmd/wrapper/main.go (Getenv) |
CT_TEST_TIMEOUT_SCALE |
internal/testtimeout/timeout.go (LookupEnv) |
HEALTH_ADDR |
internal/config/config.go (envWithDeprecatedFallback) |
KUBERNETES_SERVICE_HOST |
internal/health/oidc_verify.go (Getenv) |
KUBERNETES_SERVICE_PORT |
internal/health/oidc_verify.go (Getenv) |
POD_IP |
internal/health/ephemeral_cert.go (Getenv) |
RENEWAL_INTERVAL |
internal/config/config.go (envWithDeprecatedFallback) |
VAULT_ADDR |
internal/config/config.go (Getenv); internal/volumeshield/vault_dek_fetcher.go (Getenv) |
VAULT_AUTH_METHOD |
internal/config/config.go (Getenv) |
VAULT_AUTH_MOUNT_PATH |
internal/config/config.go (Getenv) |
VAULT_AUTH_ROLE |
internal/config/config.go (Getenv) |
VAULT_CACERT |
internal/config/config.go (Getenv); internal/volumeshield/vault_dek_fetcher.go (Getenv) |
VAULT_CAPATH |
internal/config/config.go (Getenv); internal/volumeshield/vault_dek_fetcher.go (Getenv) |
VAULT_K8S_ROLE |
internal/volumeshield/vault_dek_fetcher.go (Getenv) |
VAULT_SA_TOKEN_PATH |
internal/volumeshield/vault_dek_fetcher.go (Getenv) |
VAULT_SKIP_VERIFY |
internal/config/config.go (Getenv); internal/config/config.go (parseEnvBool); internal/volumeshield/vault_dek_fetcher.go (Getenv) |
VAULT_TOKEN |
cmd/wrapper/main.go (Getenv); internal/config/config.go (Getenv) |
Agent and Port environment read inventories¶
These tables list names read by published code, including compatibility and diagnostic inputs. They do not qualify security relaxations. Retain strict enforcement and TLS settings. REQUIRE_LSM_OR_FAIL and STRICT_BPF_LOAD_MODE are agent startup gates; verify the active node enforcement path rather than inferring protection from a configured flag.
Agent¶
| Input name | Consumer (inferred from published source) |
|---|---|
AGENT_POD_UID |
internal/config/config.go (envOrFallback) |
ALLOW_DEBUGGER |
internal/config/config.go (envBoolFallback) |
ALLOW_DISABLED_ENFORCEMENT |
internal/config/config.go (envBoolFallback) |
ALLOW_INSECURE_AUDIT |
internal/config/config.go (envBoolFallback) |
AUDIT_BATCH_SIZE |
internal/config/config.go (envIntFallback) |
AUDIT_FLUSH_INTERVAL |
internal/config/config.go (envDurationFallback) |
BPF_PIN_DIR |
internal/config/config.go (envOrFallback) |
BROKER_CA_PATH |
internal/config/config.go (envGetFallback) |
BROKER_TOKEN_PATH |
internal/config/config.go (envOrFallback) |
BROKER_URL |
internal/config/config.go (envGetFallback) |
CGROUP_ENFORCE |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_AGENT_POD_UID |
internal/config/config.go (envOrFallback) |
CLOUDTASER_ALLOW_DEBUGGER |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_ALLOW_DISABLED_ENFORCEMENT |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_ALLOW_INSECURE_AUDIT |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_AUDIT_BATCH_SIZE |
internal/config/config.go (envIntFallback) |
CLOUDTASER_AUDIT_FLUSH_INTERVAL |
internal/config/config.go (envDurationFallback) |
CLOUDTASER_BPF_PIN_DIR |
internal/config/config.go (envOrFallback) |
CLOUDTASER_BROKER_CA_PATH |
internal/config/config.go (envGetFallback) |
CLOUDTASER_BROKER_TOKEN_PATH |
internal/config/config.go (envOrFallback) |
CLOUDTASER_BROKER_URL |
internal/config/config.go (envGetFallback) |
CLOUDTASER_CGROUP_ENFORCE |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_CONNECT_ALLOWLIST_ENFORCE |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_EBPF_ATTESTATION_HMAC_KEY |
internal/config/config.go (envGetFallback) |
CLOUDTASER_EBPF_MWH_NAME |
internal/tamper/detector.go (Getenv); internal/tamper/watcher.go (Getenv) |
CLOUDTASER_EBPF_OBJECT_PATH |
internal/config/config.go (envOrFallback) |
CLOUDTASER_EBPF_RINGBUF_SIZE |
internal/config/config.go (envIntFallback) |
CLOUDTASER_ENFORCEMENT_PROFILE |
internal/config/config.go (envOrFallback) |
CLOUDTASER_ENFORCE_MODE |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_EVENT_STREAM_LISTEN_ADDR |
internal/config/config.go (envOrFallback) |
CLOUDTASER_EVENT_STREAM_TLS_CERT_PATH |
internal/config/config.go (envOrFallback) |
CLOUDTASER_EVENT_STREAM_TLS_CLIENT_CA_PATH |
internal/config/config.go (envOrFallback) |
CLOUDTASER_EVENT_STREAM_TLS_KEY_PATH |
internal/config/config.go (envOrFallback) |
CLOUDTASER_FAIL_CLOSED_ON_ENFORCEMENT_GAP |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_FIM_ENABLED |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_FIM_PATHS |
internal/config/config.go (envGetFallback) |
CLOUDTASER_GLOBAL_PRIVESC_DETECT |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_GRPC_INSECURE_DEV_NO_PEER_AUTH |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_GRPC_LISTEN_ADDR |
internal/config/config.go (envOrFallback) |
CLOUDTASER_GRPC_TLS_CERT_PATH |
internal/config/config.go (envOrFallback) |
CLOUDTASER_GRPC_TLS_CLIENT_CA_PATH |
internal/config/config.go (envOrFallback) |
CLOUDTASER_GRPC_TLS_KEY_PATH |
internal/config/config.go (envOrFallback) |
CLOUDTASER_HEALTH_LISTEN_ADDR |
internal/config/config.go (envOrFallback) |
CLOUDTASER_KERNEL_SIDE_KILL |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_LOG_ALL |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_MONITORED_PIDS_MAP_SIZE |
internal/config/config.go (envIntFallback) |
CLOUDTASER_NODE_NAME |
internal/config/config.go (envOrFallback) |
CLOUDTASER_PLATFORM_CA_PATH |
internal/config/config.go (envOrFallback) |
CLOUDTASER_PLATFORM_ENDPOINT |
internal/config/config.go (envOrFallback) |
CLOUDTASER_REACTIVE_KILL |
internal/config/config.go (envBoolFallback); internal/config/config.go (envGetFallback) |
CLOUDTASER_REQUIRE_FULL_ENFORCEMENT |
internal/config/config.go (envBoolWithDeprecatedFallback) |
CLOUDTASER_REQUIRE_LSM_OR_FAIL |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_SECCOMP_DEPLOY |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_SECCOMP_HOST_DIR |
internal/config/config.go (envOrFallback) |
CLOUDTASER_SECCOMP_SOURCE_PATH |
internal/config/config.go (envOrFallback) |
CLOUDTASER_SENSITIVE_LISTEN_ADDR |
internal/config/config.go (envOrFallback) |
CLOUDTASER_STRICT_BPF_ENUM |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_STRICT_BPF_LOAD |
internal/config/config.go (envBoolFallback); internal/config/config.go (lookupEnvFallback) |
CLOUDTASER_STRICT_BPF_LOADERS |
internal/config/config.go (envGetFallback) |
CLOUDTASER_STRICT_BPF_LOAD_MODE |
internal/config/config.go (lookupEnvFallback) |
CLOUDTASER_VS_PROTECTED_PATHS |
internal/config/config.go (envGetFallback) |
CLOUDTASER_VS_RAW_PATH_GUARD_ENABLED |
internal/config/config.go (envBoolFallback) |
CLOUDTASER_WARN_ON_ENFORCEMENT_GAPS |
internal/config/config.go (envBoolWithDeprecatedFallback) |
CLOUDTASER_WRAPPER_HEALTH_PORT |
internal/config/config.go (envIntFallback) |
CONNECT_ALLOWLIST_ENFORCE |
internal/config/config.go (envBoolFallback) |
EBPF_ATTESTATION_HMAC_KEY |
internal/config/config.go (envGetFallback) |
EBPF_OBJECT_PATH |
internal/config/config.go (envOrFallback) |
EBPF_RINGBUF_SIZE |
internal/config/config.go (envIntFallback) |
ENFORCEMENT_PROFILE |
internal/config/config.go (envOrFallback) |
ENFORCE_MODE |
internal/config/config.go (envBoolFallback) |
EVENT_STREAM_LISTEN_ADDR |
internal/config/config.go (envOrFallback) |
EVENT_STREAM_TLS_CERT_PATH |
internal/config/config.go (envOrFallback) |
EVENT_STREAM_TLS_CLIENT_CA_PATH |
internal/config/config.go (envOrFallback) |
EVENT_STREAM_TLS_KEY_PATH |
internal/config/config.go (envOrFallback) |
FAIL_CLOSED_ON_ENFORCEMENT_GAP |
internal/config/config.go (envBoolFallback) |
FIM_ENABLED |
internal/config/config.go (envBoolFallback) |
FIM_PATHS |
internal/config/config.go (envGetFallback) |
GLOBAL_PRIVESC_DETECT |
internal/config/config.go (envBoolFallback) |
GRPC_INSECURE_DEV_NO_PEER_AUTH |
internal/config/config.go (envBoolFallback) |
GRPC_LISTEN_ADDR |
internal/config/config.go (envOrFallback) |
GRPC_TLS_CERT_PATH |
internal/config/config.go (envOrFallback) |
GRPC_TLS_CLIENT_CA_PATH |
internal/config/config.go (envOrFallback) |
GRPC_TLS_KEY_PATH |
internal/config/config.go (envOrFallback) |
HEALTH_LISTEN_ADDR |
internal/config/config.go (envOrFallback) |
KERNEL_SIDE_KILL |
internal/config/config.go (envBoolFallback) |
KUBERNETES_SERVICE_HOST |
internal/config/config.go (Getenv) |
LOG_ALL |
internal/config/config.go (envBoolFallback) |
MONITORED_PIDS_MAP_SIZE |
internal/config/config.go (envIntFallback) |
NODE_NAME |
internal/config/config.go (envOrFallback) |
PLATFORM_CA_PATH |
internal/config/config.go (envOrFallback) |
PLATFORM_ENDPOINT |
internal/config/config.go (envOrFallback) |
POD_NAMESPACE |
cmd/ebpf-agent/main.go (Getenv); internal/agent/vsbroker.go (Getenv) |
REACTIVE_KILL |
internal/config/config.go (envBoolFallback); internal/config/config.go (envGetFallback) |
REQUIRE_FULL_ENFORCEMENT |
internal/config/config.go (envBoolWithDeprecatedFallback) |
REQUIRE_LSM_OR_FAIL |
internal/config/config.go (envBoolFallback) |
SECCOMP_DEPLOY |
internal/config/config.go (envBoolFallback) |
SECCOMP_HOST_DIR |
internal/config/config.go (envOrFallback) |
SECCOMP_SOURCE_PATH |
internal/config/config.go (envOrFallback) |
SENSITIVE_LISTEN_ADDR |
internal/config/config.go (envOrFallback) |
STRICT_BPF_ENUM |
internal/config/config.go (envBoolFallback) |
STRICT_BPF_LOAD |
internal/config/config.go (envBoolFallback); internal/config/config.go (lookupEnvFallback) |
STRICT_BPF_LOADERS |
internal/config/config.go (envGetFallback) |
STRICT_BPF_LOAD_MODE |
internal/config/config.go (lookupEnvFallback) |
VS_PROTECTED_PATHS |
internal/config/config.go (envGetFallback) |
VS_RAW_PATH_GUARD_ENABLED |
internal/config/config.go (envBoolFallback) |
WARN_ON_ENFORCEMENT_GAPS |
internal/config/config.go (envBoolWithDeprecatedFallback) |
WRAPPER_HEALTH_PORT |
internal/config/config.go (envIntFallback) |
Port¶
| Input name | Consumer (inferred from published source) |
|---|---|
BOOTSTRAP_AUTH_PATH |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
BOOTSTRAP_INSECURE_SKIP_VAULT_TLS |
cmd/cloudtaser-bootstrap/main.go (envOrDefaultBool) |
BOOTSTRAP_KEY_OUTPUT_FILE |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
BOOTSTRAP_KV_PATH |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
BOOTSTRAP_POD_READY_POLL |
cmd/cloudtaser-bootstrap/main.go (envOrDefaultDuration) |
BOOTSTRAP_POD_READY_TIMEOUT |
cmd/cloudtaser-bootstrap/main.go (envOrDefaultDuration) |
BOOTSTRAP_POLICY_NAME |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
BOOTSTRAP_PREFLIGHT_ONLY |
cmd/cloudtaser-bootstrap/main.go (envOrDefaultBool) |
BOOTSTRAP_PREFLIGHT_TIMEOUT |
cmd/cloudtaser-bootstrap/main.go (envOrDefaultDuration) |
BOOTSTRAP_ROLE_BOUND_SA_NAMES |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
BOOTSTRAP_ROLE_BOUND_SA_NAMESPACES |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
BOOTSTRAP_ROLE_NAME |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
BOOTSTRAP_ROLE_TTL |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
BOOTSTRAP_SHAMIR_SHARES |
cmd/cloudtaser-bootstrap/main.go (envOrDefaultInt) |
BOOTSTRAP_SHAMIR_THRESHOLD |
cmd/cloudtaser-bootstrap/main.go (envOrDefaultInt) |
BOOTSTRAP_SKIP_PREFLIGHT |
cmd/cloudtaser-bootstrap/main.go (envOrDefaultBool) |
BOOTSTRAP_UNSEAL_MODE |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
BOOTSTRAP_VS_BROKER_POLICY_NAME |
cmd/cloudtaser-bootstrap/main.go (Getenv) |
BOOTSTRAP_VS_BROKER_ROLE_NAME |
cmd/cloudtaser-bootstrap/main.go (Getenv) |
BOOTSTRAP_VS_BROKER_ROLE_TTL |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
BOOTSTRAP_VS_BROKER_SA_NAME |
cmd/cloudtaser-bootstrap/main.go (Getenv) |
BOOTSTRAP_VS_BROKER_SA_NAMESPACE |
cmd/cloudtaser-bootstrap/main.go (Getenv) |
BOOTSTRAP_WORKLOADS |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
CLOUDTASER_POD_UID |
cmd/cloudtaser-port/bootstrap_linux.go (Getenv); cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv) |
CLOUDTASER_PORT_ADMIN_TOKEN_SINGLE_USE |
cmd/cloudtaser-port/main.go (portEnvBool) |
CLOUDTASER_PORT_ADMIN_TOKEN_TTL |
cmd/cloudtaser-port/main.go (portEnvOrDefault) |
CLOUDTASER_PORT_ADMIN_WIPE_TOKEN |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_ADMIN_WIPE_TOKEN_FILE |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_AUTHORITY_CATALOG_SHA256 |
cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv) |
CLOUDTASER_PORT_AUTHORITY_GENERATION |
cmd/cloudtaser-port/bootstrap_linux.go (Getenv); cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv) |
CLOUDTASER_PORT_AUTHORITY_INSTANCE |
cmd/cloudtaser-port/bootstrap_linux.go (Getenv); cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv); cmd/cloudtaser-port/main.go (portEnvOrDefault) |
CLOUDTASER_PORT_AUTH_MODE |
cmd/cloudtaser-port/main.go (portEnvOrDefault) |
CLOUDTASER_PORT_AUTO_CONNECT |
cmd/cloudtaser-port/main.go (portEnvBool) |
CLOUDTASER_PORT_AUTO_REGISTER |
cmd/cloudtaser-port/main.go (portEnvBool) |
CLOUDTASER_PORT_AUTO_REGISTER_MAX_CLUSTERS |
cmd/cloudtaser-port/main.go (portEnvOrDefaultInt) |
CLOUDTASER_PORT_AUTO_REGISTER_RATE_LIMIT_PER_MINUTE |
cmd/cloudtaser-port/main.go (portEnvOrDefaultInt) |
CLOUDTASER_PORT_BEACON_ADDRESS |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_BEACON_AUTH_KEY |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_BEACON_AUTH_KEY_FILE |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_BEACON_AUTH_KEY_OVERLAP_UNTIL |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_BEACON_CA |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_BEACON_INFO_HASH |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_BEACON_INSECURE_SKIP_VERIFY |
cmd/cloudtaser-port/main.go (portEnvBool) |
CLOUDTASER_PORT_BEACON_SPKI_FINGERPRINT |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_BEACON_TENANT_FROM_SECRETSTORE |
cmd/cloudtaser-port/main.go (portEnvBool) |
CLOUDTASER_PORT_BEACON_TENANT_ID |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_BOOTSTRAP_ID |
cmd/cloudtaser-port/bootstrap_linux.go (Getenv); cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv) |
CLOUDTASER_PORT_BROKER_ADDR |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_CERT_RELOAD_INTERVAL |
cmd/cloudtaser-port/main.go (portEnvOrDefaultInt) |
CLOUDTASER_PORT_CONCURRENT_INIT_GRACE_PERIOD |
cmd/cloudtaser-port/main.go (portEnvOrDefaultDuration) |
CLOUDTASER_PORT_COOLDOWN_STATE_PATH |
cmd/cloudtaser-port/main.go (portEnvOrDefault) |
CLOUDTASER_PORT_ENROLL_ADMIN_TOKEN |
cmd/cloudtaser-port/main.go (portEnvBoolOrDefault) |
CLOUDTASER_PORT_FINGERPRINT_SWEEP_INTERVAL |
cmd/cloudtaser-port/main.go (portEnvOrDefaultDuration) |
CLOUDTASER_PORT_HEALTH_ADDR |
cmd/cloudtaser-port/main.go (portEnvOrDefault) |
CLOUDTASER_PORT_HOST_ROLE |
cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv) |
CLOUDTASER_PORT_HOST_UID |
cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv) |
CLOUDTASER_PORT_HOST_UNIT |
cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv) |
CLOUDTASER_PORT_INIT_LISTENER_AUTO_PRUNE |
cmd/cloudtaser-port/main.go (portEnvBoolOrDefault) |
CLOUDTASER_PORT_INIT_LISTENER_CONCURRENCY |
cmd/cloudtaser-port/main.go (portEnvOrDefaultInt) |
CLOUDTASER_PORT_INIT_LISTENER_POLL_INTERVAL |
cmd/cloudtaser-port/main.go (portEnvOrDefaultDuration) |
CLOUDTASER_PORT_INIT_LISTENER_STALE_TTL |
cmd/cloudtaser-port/main.go (portEnvOrDefaultDuration) |
CLOUDTASER_PORT_INIT_LISTENER_TIMEOUT |
cmd/cloudtaser-port/main.go (portEnvOrDefaultInt) |
CLOUDTASER_PORT_LOG_LEVEL |
cmd/cloudtaser-port/main.go (portEnvOrDefault) |
CLOUDTASER_PORT_METRICS_ADDR |
cmd/cloudtaser-port/main.go (portEnvOrDefault) |
CLOUDTASER_PORT_METRICS_ENABLED |
cmd/cloudtaser-port/main.go (portEnvBool) |
CLOUDTASER_PORT_OPERATOR_POLICY |
cmd/cloudtaser-port/main.go (portEnvOrDefault) |
CLOUDTASER_PORT_PREVIOUS_BEACON_AUTH_KEY |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_PREVIOUS_BEACON_AUTH_KEY_FILE |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_REQUEST_HANDLER_CONCURRENCY |
cmd/cloudtaser-port/main.go (portEnvOrDefaultInt) |
CLOUDTASER_PORT_SAAS_ADDR |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_TLS_CA |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_TLS_CERT |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_TLS_KEY |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_TRUST_JWT |
cmd/cloudtaser-port/main.go (portEnvBool) |
CLOUDTASER_PORT_TRUST_JWT_AUDIENCE |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_TRUST_JWT_ISSUER |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_TRUST_JWT_JWKS |
cmd/cloudtaser-port/main.go (portEnv) |
CLOUDTASER_PORT_VAULT_CA_SHA256 |
cmd/cloudtaser-port/bootstrap_linux.go (Getenv); cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv) |
CLOUDTASER_VAULT_APPROLE_ROLE_ID |
cmd/cloudtaser-port/bootstrap_linux.go (Getenv); cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv); cmd/cloudtaser-port/main.go (Getenv) |
CLOUDTASER_VAULT_APPROLE_SECRET_ID_FILE |
cmd/cloudtaser-port/check_config.go (Getenv); cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv); cmd/cloudtaser-port/main.go (Getenv) |
CLOUDTASER_VAULT_WRAPPED_TOKEN |
cmd/cloudtaser-port/main.go (Getenv) |
ENROLL_ALLOW_UNAUTHENTICATED |
cmd/cloudtaser-enroll/main.go (envOrDefaultBool) |
ENROLL_BEACON_ADDRESS |
cmd/cloudtaser-enroll/main.go (envOrDefault) |
ENROLL_CLI_PATH |
cmd/cloudtaser-enroll/main.go (envOrDefault) |
ENROLL_LISTEN_ADDR |
cmd/cloudtaser-enroll/main.go (envOrDefault) |
ENROLL_RATE_LIMIT_GLOBAL |
cmd/cloudtaser-enroll/main.go (envOrDefaultInt) |
ENROLL_RATE_LIMIT_PER_IP |
cmd/cloudtaser-enroll/main.go (envOrDefaultInt) |
ENROLL_REQUEST_TOKEN |
cmd/cloudtaser-enroll/main.go (envOrDefault) |
ENROLL_REQUEST_TOKEN_FILE |
cmd/cloudtaser-enroll/main.go (envOrDefault) |
ENROLL_TLS_CERT |
cmd/cloudtaser-enroll/main.go (envOrDefault) |
ENROLL_TLS_KEY |
cmd/cloudtaser-enroll/main.go (envOrDefault) |
ENROLL_VAULT_ADDR |
cmd/cloudtaser-enroll/main.go (envOrDefault) |
ENROLL_VAULT_CA_CERT |
cmd/cloudtaser-enroll/main.go (envOrDefault) |
KUBERNETES_SERVICE_HOST |
internal/portbootstrap/preflight.go (Getenv) |
KUBERNETES_SERVICE_PORT |
internal/portbootstrap/preflight.go (Getenv) |
OPENBAO_ADDR |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
OPENBAO_NAMESPACE |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
OPENBAO_RELEASE_NAME |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
OPENBAO_REPLICAS |
cmd/cloudtaser-bootstrap/main.go (envOrDefaultInt) |
OPERATOR_ENABLE_TOKEN_CREATE |
cmd/cloudtaser-bootstrap/main.go (envOrDefaultBool) |
OPERATOR_POLICY_NAME |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
OPERATOR_ROLE_MAX_TTL |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
OPERATOR_ROLE_NAME |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
OPERATOR_ROLE_TTL |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
OPERATOR_SA_NAME |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
OPERATOR_SA_NAMESPACE |
cmd/cloudtaser-bootstrap/main.go (envOrDefault) |
VAULT_ADDR |
cmd/cloudtaser-port/bootstrap_linux.go (Getenv); cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv); cmd/cloudtaser-port/main.go (envOrDefault) |
VAULT_CACERT |
cmd/cloudtaser-bootstrap/main.go (envOrDefault); cmd/cloudtaser-port/bootstrap_linux.go (Getenv); cmd/cloudtaser-port/host_bootstrap_linux.go (Getenv); cmd/cloudtaser-port/main.go (Getenv) |
VAULT_SKIP_VERIFY |
cmd/cloudtaser-port/main.go (Getenv) |
VAULT_TOKEN |
cmd/cloudtaser-port/main.go (Getenv) |