cargoship vault keygen

Generates an age key pair, or prints the public key of one you already hold

Synopsis

Generates an age key pair in the format age-keygen writes, so that the age distribution is not a prerequisite for encrypting a configuration with age, and the file stays readable by ‘age –decrypt’ and anything else that speaks the format. The identity – the private key, AGE-SECRET-KEY-1… – goes to –output, or to stdout when that is omitted; the recipient – the public key, age1… – goes to stderr, so that the file holds the private key alone and the public key can be copied straight into a recipients file. With –public-key it generates nothing and instead prints the public keys held in IDENTITY_FILE, or in stdin when no file is given, which is how a recipient is recovered from a private key you still have. A key pair is not registered anywhere: pass the public key to ‘cargoship vault encrypt’ as –age-recipient, and the file back as –age-identity-file to read those values again.

cargoship vault keygen [IDENTITY_FILE] [flags]

Examples

# Generate a key pair, writing the private key to a file and printing the public key
$ cargoship vault keygen --output ~/.age/cargoship.key

# The same, redirecting instead, which leaves the file mode up to your shell
$ cargoship vault keygen > ~/.age/cargoship.key

# Recover the public key from an identity file you still hold
$ cargoship vault keygen --public-key ~/.age/cargoship.key

# Encrypt a configuration to the key that was just generated, and read it back
$ cargoship vault encrypt-file ./cluster.yaml --age-recipient age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p
$ cargoship vault decrypt-file ./cluster.yaml --age-identity-file ~/.age/cargoship.key

Options

  -h, --help            help for keygen
  -o, --output string   Path to write the generated identity to, created with mode 0600. An existing file is never overwritten, because anything encrypted to the key it holds would become unreadable. Omit it to write to stdout instead.
  -y, --public-key      Print the public keys held in IDENTITY_FILE instead of generating a key pair. Reads stdin when no file is given. This reads age identity files; the public key of an SSH key is in the ".pub" file beside it.

Options inherited from parent commands

      --log-file            Always write a full-verbosity debug log to a file, regardless of --log-level.
  -L, --log-format string   Select a logging format. Defaults to 'console'. Valid options are: 'console', 'json', 'dev'. (default "console")
  -l, --log-level string    Log level when running cargoship. Valid options are: warn, info, debug, trace (default "info")
      --no-color            Disable terminal color codes in logging and stdout prints.

SEE ALSO

• cargoship vault - Encrypts and decrypts cluster configuration values with Ansible Vault or age