Skip to content
SHC Docs

shc vault migrate

shc vault migrate

Section titled “shc vault migrate”

migrate vault secrets to the envelope encryption format

Synopsis

Section titled “Synopsis”

Flip the cluster’s vault crypto format and rewrite every secret into it. The default target (format 2, envelope encryption) requires EVERY node to run envelope-aware code first: older nodes cannot read envelope values. —crypto-format 1 is the rollback pass — run it to rewrite everything back to the legacy format before downgrading any node. Idempotent and online; requires an unlocked vault.

shc vault migrate [flags]

Options

Section titled “Options”
      --crypto-format int   target crypto format: 2 = envelope (default), 1 = legacy rollback (default 2)
  -h, --help                help for migrate

Options inherited from parent commands

Section titled “Options inherited from parent commands”
      --config stringArray   extra YAML config file to layer on top of auto-discovered config; repeatable, later files win
  -d, --debug                enable debug mode (default: $SHC_DEBUG)
  -e, --environment string   environment name (default: $SHC_ENVIRONMENT)
      --exclude string       comma-separated dotted paths to drop
      --fields string        comma-separated columns/keys to show (and their order)
      --filter string        comma-separated dotted paths to keep (drops everything else)
  -o, --output string        output format: tty|text|json|yaml (default: $SHC_OUTPUT)
  -p, --password string      vault password
  -s, --stack string         stack name (default: $SHC_STACK)
  -t, --tenant string        tenant name (default: $SHC_TENANT)
  -v, --verbose              verbose output (default: $SHC_VERBOSE)

SEE ALSO

Section titled “SEE ALSO”