oz0 secret export-to-sealed
Replace the tenant's secret store references with sealed secrets, so a store can be taken away.
For: Operators and developers looking up a command.
Replace the tenant's secret store references with sealed secrets, so a store can be taken away.
An edge reads each reference (of one store with --store) from its store, seals the value to the cluster's secrets key and replaces the reference with it, if the secret still holds that reference. Each is audited (secret.exported) without its value; the reference is kept for 24 hours, so "oz0 secret rollback" brings it back. --dry-run reads each one and says what would happen. The CLI's context must reach an edge that runs the stores.
Usage
oz0 secret export-to-sealed [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--dry-run | bool | read each reference and say what would happen, changing nothing | |
--json | bool | print JSON instead of a table | |
--store | string | only the references into this store |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
--tenant | string | default | tenant |
See all oz0 commands and the global flags.