Aparência
finnest secrets
Rotate runtime secrets and manage persisted regulated material.
Rotate runtime secrets and manage persisted regulated material (Open Finance & Open Insurance). write validates and persists regulated material in the operator-local store (directory/file mode 0700/0600); the CLI seeds the cloud vault during deploy. This is not a direct cloud-vault write. Active automation compatibility overrides remain visible through config sources.
Grupo: Operação · Nível: avançado
Comando avançado
Use este comando quando a documentação de operação ou o suporte Finnest indicar.
Uso
bash
finnest secrets <subcomando> [opções]Exemplos
bash
finnest secrets rotate jwt-signing-key --cloud=aws --environment=prod --yes
finnest secrets write brcac-tls-cert-pem --file ./brcac.crt --environment=sandbox --yes
finnest secrets write brcac-tls-cert-pem --file ./brcac.crt --pair-file ./brcac.key --environment=prod --yes
printf %s https://directory.opin.example | finnest secrets write provider-dcr-opin-issuer --stdin --yes
finnest secrets remove brcac-tls-cert-pem --environment=sandbox --yes
finnest secrets list --scope regulatory --cloud=azure --environment=sandboxOpções
--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--cloud <cloud>— Target cloud for setup, deploy, and diagnostics.--environment <environment>— Target environment: sandbox or prod.--yes— Approve a mutating operation.--non-interactive— Disable interactive prompts where a command supports a prompt-based flow.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.
Subcomandos
rotate— Rotate one runtime secret.write— Validate and persist one regulated secret in the operator-local store for env-less deploys.remove— Remove one persisted regulated secret from the operator-local store.list— Show regulated material status (missing/seeded-env/persisted/demo).
finnest secrets rotate
Rotate one runtime secret.
Argumentos
<name>— Secret name.
Opções
--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--cloud <cloud>— Target cloud for setup, deploy, and diagnostics.--environment <environment>— Target environment: sandbox or prod.--yes— Approve a mutating operation.--non-interactive— Disable interactive prompts where a command supports a prompt-based flow.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.
finnest secrets write
Validate and persist one regulated secret in the operator-local store for env-less deploys.
Argumentos
<key>— Regulated key: the FINNEST_* name without the prefix (e.g. brcac-tls-cert-pem).
Opções
--file <path>— Read secret material from a file path.--pair-file <path>— Read the counterpart cert or key so a pair can rotate in one write.--stdin— Read secret material from piped stdin.--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--cloud <cloud>— Target cloud for setup, deploy, and diagnostics.--environment <environment>— Target environment: sandbox or prod.--yes— Approve a mutating operation.--non-interactive— Disable interactive prompts where a command supports a prompt-based flow.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.
finnest secrets remove
Remove one persisted regulated secret from the operator-local store.
Argumentos
<key>— Regulated key: the FINNEST_* name without the prefix (e.g. brcac-tls-cert-pem).
Opções
--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--cloud <cloud>— Target cloud for setup, deploy, and diagnostics.--environment <environment>— Target environment: sandbox or prod.--yes— Approve a mutating operation.--non-interactive— Disable interactive prompts where a command supports a prompt-based flow.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.
finnest secrets list
Show regulated material status (missing/seeded-env/persisted/demo).
Opções
--scope <scope>— Scope selector: regulatory (secrets list, default) or opin (support bundle; also accepted for secrets list).--config <path>— Path to an explicit Finnest TOML configuration file.--config-only <path>— Load only this Finnest TOML file; do not merge ambient user or project config.--config-overlay <path>— Overlay this Finnest TOML file over operator and project config.--cloud <cloud>— Target cloud for setup, deploy, and diagnostics.--environment <environment>— Target environment: sandbox or prod.--yes— Approve a mutating operation.--non-interactive— Disable interactive prompts where a command supports a prompt-based flow.--log-level <level>— Diagnostic verbosity: error, warn, info, debug, or trace.--plain— Force headless output even on an interactive TTY.--verbose— Enable debug-level diagnostics.
As opções globais de saída também se aplicam.