Secret Store & Port Installation¶
Linux host Port: measured customer path
Use chart 1.0.359, operator v0.13.209,
wrapper/init v0.2.207, Port v0.4.133 and released
CLI v0.19.176.
The proven path is Linux host Port + customer relay + US cluster + EU store.
Install the cluster release in cloudtaser-system. Hosted enrollment is
not currently available.
Managed S3 proxy and Volume Shield are unsupported here; DB proxy has not been
shown to work. Use one wrapped container and set cloudtaser.io/containers
(default first container). Host Port broker CA rotation has no supported runbook.
GKE COS 6.12.105+ passed delivery. Stock Ubuntu 24.04 GCE booted unsupported
7.0.0-1014-gcp: check node uname -r, not just the LTS distribution name.
Issued store tokens can outlive a deleted Pod until TTL, up to 15 minutes.
No-resources delivery passed on chart 1.0.359 with operator policies
off; enforcing policies/outages were tested on 1.0.358. Skip 1.0.357 and 1.0.358.
The operator adds 64Mi to a manifest memory limit, covering the 42 MB tmpfs;
the OOM case was manifest 1Mi → effective 65Mi. Keep the effective budget well
above the measured 67–69 MB floor plus app headroom. See the full procedure for
measurements and sizing.
Follow the EU OpenBao, Port and beacon procedure from the beginning. It covers a fresh EU VM through a protected application, rotation, outages and uninstall. OpenBao and Port remain in the EU; both Port and the target broker connect outbound to the tenant-enrolled beacon.
| Order | Customer action | Procedure |
|---|---|---|
| 1 | Obtain the release set, qualified cluster and self-hosted relay | Prerequisites and handoffs |
| 2 | Render/review/run the OpenBao bootstrap and signed Port binary installer | EU host installation |
| 3 | Complete private tenant issuance to source and relay | Tenant enrollment |
| 4 | Approve exact cluster, namespace, SA and data path | Authority setup |
| 5 | Admit the non-root Port process and its finite AppRole login | Host launch |
| 6 | Apply the production cluster profile and deliver the private introduction | Cluster introduction |
| 7 | Verify exact secret delivery, rotation and recovery through the app | Application, operations |
Linux host (systemd): managed authority required¶
source install --type linux --managed-authority generates the fresh OpenBao
installer. source install port --type linux --dry-run generates a signed binary
installer; it does not start Port. source host-launch prepare creates a public
host approval and source host-launch supervises one finite admitted process.
The initial root-only census and private pipe input are required; do not replace
them with a static VAULT_TOKEN systemd unit or general legacy source configure.
The procedure explicitly separates token/share custody from public approvals.
CLI-managed Kubernetes deployment¶
This page's runnable path installs Port on the EU Linux VM. The separate
target install --install-port --port-authority-instance composition installs a
Port in Kubernetes. It is not yet supported on this release: neither the Port
nor OpenBao Kubernetes chart was run on this customer path. source install
port defaults to --type kubernetes; use explicit --type linux here.
Do not add Kubernetes-Port flags to this external-VM install.
See Supported Paths.
Verify and maintain¶
A binary install or open beacon TCP connection is not an application receipt. Verify through the app's own status/digest endpoint, using its qualified runtime and exact namespace/SA. No protected-container exec is required. Plan finite Port-session renewal, source unseal custody and replaced-operator reintroduction. Use the rotation/outage steps and uninstall steps.