mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
0ebffbd529
- Fix 381 files where branding script corrupted variable names (e.g. isHanzo KMSTemplate -> isKmsTemplate) - Rebrand from "Hanzo KMS" to just "KMS" for white-label support (allows Lux KMS, Hanzo KMS, etc. via configuration) - 856 files, purely string replacements, no logic changes
362 lines
8.4 KiB
Plaintext
362 lines
8.4 KiB
Plaintext
---
|
|
title: "kms dynamic-secrets"
|
|
description: "Perform dynamic secret operations directly with the CLI"
|
|
---
|
|
|
|
```
|
|
kms dynamic-secrets
|
|
```
|
|
|
|
## Description
|
|
|
|
Dynamic secrets are unique secrets generated on demand based on the provided configuration settings. For more details, refer to [dynamics secrets section](/documentation/platform/dynamic-secrets/overview).
|
|
|
|
This command enables you to perform list, lease, renew lease, and revoke lease operations on dynamic secrets within your KMS project.
|
|
|
|
### Sub-commands
|
|
|
|
<Accordion title="kms dynamic-secrets">
|
|
Use this command to print out all of the dynamic secrets in your project.
|
|
|
|
```bash
|
|
$ kms dynamic-secrets
|
|
```
|
|
|
|
### Environment variables
|
|
|
|
<Accordion title="KMS_TOKEN">
|
|
Used to fetch dynamic secrets via a [machine identity](/documentation/platform/identities/machine-identities) instead of logged-in credentials. Simply, export this variable in the terminal before running this command.
|
|
|
|
```bash
|
|
# Example
|
|
export KMS_TOKEN=$(hanzo-kms login --method=universal-auth --client-id=<identity-client-id> --client-secret=<identity-client-secret> --silent --plain) # --plain flag will output only the token, so it can be fed to an environment variable. --silent will disable any update messages.
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="KMS_DISABLE_UPDATE_CHECK">
|
|
Used to disable the check for new CLI versions. This can improve the time it takes to run this command. Recommended for production environments.
|
|
|
|
To use, simply export this variable in the terminal before running this command.
|
|
|
|
```bash
|
|
# Example
|
|
export KMS_DISABLE_UPDATE_CHECK=true
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
### Flags
|
|
|
|
<Accordion title="--projectId">
|
|
The project ID to fetch dynamic secrets from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets --projectId=<project-id>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--project-slug">
|
|
The project slug to fetch dynamic secrets from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets --project-slug=<project-slug>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--token">
|
|
The authenticated token to fetch dynamic secrets from. This is required when using a machine identity to authenticate.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets --token=<token>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--env">
|
|
Used to select the environment name on which actions should be taken. Default
|
|
value: `dev`
|
|
</Accordion>
|
|
|
|
<Accordion title="--path">
|
|
Use to select the project folder on which dynamic secrets will be accessed.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets --path="/" --env=dev
|
|
```
|
|
|
|
</Accordion>
|
|
</Accordion>
|
|
<Accordion title="kms dynamic-secrets lease create">
|
|
This command is used to create a new lease for a dynamic secret.
|
|
|
|
```bash
|
|
$ kms dynamic-secrets lease create <dynamic-secret-name>
|
|
```
|
|
|
|
### Flags
|
|
|
|
<Accordion title="--env">
|
|
Used to select the environment name on which actions should be taken. Default
|
|
value: `dev`
|
|
</Accordion>
|
|
|
|
<Accordion title="--plain">
|
|
The `--plain` flag will output dynamic secret lease credentials values without formatting, one per line.
|
|
Default value: `false`
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease create dynamic-secret-postgres --plain
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--path">
|
|
The `--path` flag indicates which project folder dynamic secrets will be injected from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease create <dynamic-secret-name> --path="/" --env=dev
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--projectId">
|
|
The project ID of the dynamic secrets to lease from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease create <dynamic-secret-name> --projectId=<project-id>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--project-slug">
|
|
The project slug of the dynamic secrets to lease from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease create <dynamic-secret-name> --project-slug=<project-slug>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--token">
|
|
The authenticated token to create dynamic secret leases. This is required when using a machine identity to authenticate.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease create <dynamic-secret-name> --token=<token>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--ttl">
|
|
The lease lifetime. If not provided, the default TTL of the dynamic secret root credential will be used.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease create <dynamic-secret-name> --ttl=<ttl>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
### Provider-specific flags
|
|
|
|
The following flags are specific to certain providers or integrations:
|
|
|
|
<Accordion title="Kubernetes">
|
|
<Accordion title="--kubernetes-namespace">
|
|
The namespace to create the lease in. Only used for Kubernetes dynamic secrets.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease create <dynamic-secret-name> --kubernetes-namespace=<namespace>
|
|
```
|
|
|
|
</Accordion>
|
|
</Accordion>
|
|
|
|
</Accordion>
|
|
<Accordion title="kms dynamic-secrets lease list">
|
|
This command is used to list leases for a dynamic secret.
|
|
|
|
```bash
|
|
$ kms dynamic-secrets lease list <dynamic-secret-name>
|
|
```
|
|
|
|
### Flags
|
|
|
|
<Accordion title="--env">
|
|
Used to select the environment name on which actions should be taken. Default
|
|
value: `dev`
|
|
</Accordion>
|
|
|
|
<Accordion title="--path">
|
|
The `--path` flag indicates which project folder dynamic secrets will be injected from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease list <dynamic-secret-name> --path="/" --env=dev
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--projectId">
|
|
The project ID of the dynamic secrets to list leases from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease list <dynamic-secret-name> --projectId=<project-id>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--project-slug">
|
|
The project slug of the dynamic secrets to list leases from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease list <dynamic-secret-name> --project-slug=<project-slug>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--token">
|
|
The authenticated token to list dynamic secret leases. This is required when using a machine identity to authenticate.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease list <dynamic-secret-name> --token=<token>
|
|
```
|
|
|
|
</Accordion>
|
|
</Accordion>
|
|
|
|
<Accordion title="kms dynamic-secrets lease renew">
|
|
This command is used to renew a lease before it expires.
|
|
|
|
```bash
|
|
$ kms dynamic-secrets lease renew <lease-id>
|
|
```
|
|
|
|
### Flags
|
|
|
|
<Accordion title="--env">
|
|
Used to select the environment name on which actions should be taken. Default
|
|
value: `dev`
|
|
</Accordion>
|
|
|
|
<Accordion title="--path">
|
|
The `--path` flag indicates which project folder dynamic secrets will be renewed from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease renew <lease-id> --path="/" --env=dev
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--projectId">
|
|
The project ID of the dynamic secret to lease from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease renew <lease-id> --projectId=<project-id>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--project-slug">
|
|
The project slug of the dynamic secret to lease from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease renew <lease-id> --project-slug=<project-slug>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--token">
|
|
The authenticated token to create dynamic secret leases. This is required when using a machine identity to authenticate.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease renew <lease-id> --token=<token>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--ttl">
|
|
The lease lifetime. If not provided, the default TTL of the dynamic secret root credential will be used.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease renew <lease-id> --ttl=<ttl>
|
|
```
|
|
|
|
</Accordion>
|
|
</Accordion>
|
|
|
|
<Accordion title="kms dynamic-secrets lease delete">
|
|
This command is used to delete a lease.
|
|
|
|
```bash
|
|
$ kms dynamic-secrets lease delete <lease-id>
|
|
```
|
|
|
|
### Flags
|
|
|
|
<Accordion title="--env">
|
|
Used to select the environment name on which actions should be taken. Default
|
|
value: `dev`
|
|
</Accordion>
|
|
|
|
<Accordion title="--path">
|
|
The `--path` flag indicates which project folder dynamic secrets will be deleted from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease delete <lease-id> --path="/" --env=dev
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--projectId">
|
|
The project ID of the dynamic secret to delete lease from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease delete <lease-id> --projectId=<project-id>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--project-slug">
|
|
The project slug of the dynamic secret to delete lease from.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease delete <lease-id> --project-slug=<project-slug>
|
|
```
|
|
|
|
</Accordion>
|
|
|
|
<Accordion title="--token">
|
|
The authenticated token to delete dynamic secret leases. This is required when using a machine identity to authenticate.
|
|
|
|
```bash
|
|
# Example
|
|
kms dynamic-secrets lease delete <lease-id> --token=<token>
|
|
```
|
|
|
|
</Accordion>
|
|
</Accordion>
|