cargoship vault

Encrypts and decrypts cluster configuration values with Ansible Vault or age

Synopsis

Groups the commands that read and write encrypted values for a cluster configuration, in either of the two formats cargoship supports: Ansible Vault, keyed by a shared password given via –vault-password-file or the CARGOSHIP_VAULT_PASSWORD environment variable, and age, keyed by public keys given via –age-recipient and read back with –age-identity-file. Cargoship decrypts a registry’s user/pass/token and tls.ca fields at apply time. Which format a value is in is read from the value itself, so one configuration can hold both, and moving between them is ‘cargoship vault rekey’. The group is still called vault because renaming it would break every script that calls it.

Options

  -h, --help   help for vault

Options inherited from parent commands

      --log-file            Always write a full-verbosity debug log to a file, regardless of --log-level.
  -L, --log-format string   Select a logging format. Defaults to 'console'. Valid options are: 'console', 'json', 'dev'. (default "console")
  -l, --log-level string    Log level when running cargoship. Valid options are: warn, info, debug, trace (default "info")
      --no-color            Disable terminal color codes in logging and stdout prints.

SEE ALSO

• cargoship - CLI for cargoship installs
• cargoship vault decrypt - Decrypts an Ansible Vault or age value, printing the plaintext
• cargoship vault decrypt-file - Decrypts every registry credential in a config file, in place
• cargoship vault decrypt-path - Decrypts the values a config file holds at one or more YAML paths, in place
• cargoship vault encrypt - Encrypts a value with Ansible Vault or age, for use in a registry’s user/pass/token fields
• cargoship vault encrypt-file - Encrypts every registry credential in a config file, in place
• cargoship vault encrypt-path - Encrypts the values a config file already holds at one or more YAML paths, in place
• cargoship vault keygen - Generates an age key pair, or prints the public key of one you already hold
• cargoship vault rekey - Re-wraps every encrypted registry credential in a config file, optionally under a new key