d8 stronghold

The d8 stronghold command of Deckhouse CLI is the Stronghold client. Its subcommands and flags match the HashiCorp Vault CLI. For details, refer to HashiCorp Vault compatibility.

In a standalone installation, the same subcommands are available through the stronghold executable:

# The command format in Deckhouse Platform (DP).
d8 stronghold <COMMAND> [flags] [arguments]
# The command format in Linux.
stronghold <COMMAND> [flags] [arguments]

To get help for any subcommand, use the -help flag, for example d8 stronghold kv put -help.

Connecting to the server

Environment variables

The client also reads variables that set connection parameters. Before the client starts, every STRONGHOLD_* variable is copied to the matching VAULT_* variable, so all variables below can be set with either prefix. If both are set, STRONGHOLD_* takes effect.

In DP, you can get the Stronghold server address from the Ingress object:

export STRONGHOLD_ADDR=https://$(d8 k -n d8-stronghold get ing stronghold -o json | jq -r '.spec.rules[0].host')

Common flags

Flags for connecting to the server:

Server and status

d8 stronghold status

operator

Cluster maintenance commands. They require a privileged token or unseal keys.

The operator seal command seals the server, and operator rotate rotates the storage encryption key. For details, refer to Key management.

d8 stronghold operator raft snapshot save stronghold-$(date +%F_%H-%M).snap

Authentication

d8 stronghold login -method=oidc -path=oidc_deckhouse -no-print

token

d8 stronghold token create -policy=myapp-read -period=24h

policy

d8 stronghold policy write myapp-read - <<'POLICY'
path "secret/data/myapp/*" {
  capabilities = ["read"]
}
POLICY

secrets

d8 stronghold secrets enable -path=secret -version=2 kv

kv

d8 stronghold kv put -mount=secret myapp/db password=s3cr3t
d8 stronghold kv get -mount=secret -field=password myapp/db

Generic commands

These commands work with any API path: secrets engines, auth methods, and the sys/ system backend.

d8 stronghold write -f transit/keys/orders/rotate
d8 stronghold read -address="${SECONDARY_ADDR}" sys/replication/dr/status
d8 stronghold path-help pki

lease

d8 stronghold lease revoke -prefix database/creds/myapp/

audit

Audit is available in all Stronghold editions.

d8 stronghold audit enable file file_path=/var/log/stronghold_audit.log

namespace

Namespaces are available in Stronghold EE.

d8 stronghold namespace create team-a

plugin

d8 stronghold plugin register -sha256="${PLUGIN_SHA}" secret my-custom-plugin