Skip to main content

furyctl create secrets

Creates the random secrets that the configuration file of a cluster needs.

Synopsis​

Creates the random secrets that the configuration file of a cluster needs. For example, Pomerium needs four secrets when the authentication provider type is "sso".

furyctl writes one file for each secret, in a folder with the name of the component. The configuration file reads the value of each file with the {file://<path>} notation. The command prints the fields to add to the configuration file.

With no argument, furyctl creates the secrets of the components that the configuration file uses. When there is no configuration file, furyctl creates the secrets of every component. You can name the components to create only some of them, for example "furyctl create secrets pomerium keepalived".

The components are: pomerium, gangplank, basic-auth, minio-logging, minio-monitoring, minio-tracing, keepalived, keepalived-controlplane, etcd-encryption, haproxy-stats.

On the OnPremises and Immutable kinds furyctl also asks whether the cluster encrypts the secrets of etcd at rest. It writes that configuration only after an answer of "yes", or when you name the component. It asks nothing with the --no-tty flag.

A file that is already there keeps its value: furyctl never writes a secret twice. Thus you can run the command again after you add a module to the configuration file.

furyctl creates only the secrets that your cluster can hold. The kind of the cluster and the version of the distribution decide them, thus an older version gets fewer secrets.

Usage​

furyctl create secrets [COMPONENT...] [flags]

Examples​

  furyctl create secrets                            Create the secrets that furyctl.yaml needs
  furyctl create secrets pomerium                   Create only the secrets of Pomerium
  furyctl create secrets --path ./mysecrets         Write the files in another folder
  furyctl create secrets --update-config            Also write the references in furyctl.yaml
  furyctl create secrets --config mycluster.yaml    Read another configuration file

Options​

  -c, --config string            Path to the configuration file (default "furyctl.yaml")
      --distro-location string   Location where to download the schemas of the distribution from. furyctl reads the schema of the cluster to know which fields the cluster has. It can either be a local path (eg: /path/to/distribution) or a remote URL (eg: git::git@github.com:sighupio/distribution?depth=1&ref=BRANCH_NAME). Any format supported by hashicorp/go-getter can be used
  -h, --help                     help for secrets
  -p, --path string              path where to save the created secrets. furyctl creates one subfolder for each component (default "./secrets")
      --update-config            write the reference to each file in the configuration file. furyctl edits only the lines of those fields, thus the comments and the format of the rest of the file do not change. A field that already holds another value does not change

Options inherited from parent commands​

  -D, --debug                       Enables furyctl debug output. This will greatly increase the verbosity. Debug logs and additional logs are also always written to the log file. See the --log flag.
  -g, --git-protocol git-protocol   Download repositories using the given protocol. Use when SSH traffic is being blocked or when SSH client has not been configured
                                    set the GITHUB_TOKEN environment variable with your token to use authentication while downloading, for example for private repositories. 
                                    Options are: ssh, https (default https)
  -H, --https                       DEPRECATED: by default furyctl uses https protocol to download repositories. See --git-protocol flag (default true)
  -l, --log string                  Path to a file or folder where to write logs to. Set to 'stdout' write to standard output. Target path will be created if it does not exists. Path is relative to --workdir. Default is '<outdir>/.furyctl/furyctl.<timestamp>-<random number>.log'
  -T, --no-tty                      Disable TTY making furyctl's output more friendly to non-interactive shells by disabling animations and colors
  -o, --outdir string               Path where to create the ".furyctl" data directory. Default is the user's home. Path is relative to --workdir
  -w, --workdir string              Switch to a different working directory before executing the given subcommand. NOTE: this will affect all the paths passed, including other flags like outdir and log, for example

See Also​

  • furyctl create - Create a cluster, a sample configuration file, the secrets of a cluster, or a PKI