---

pxctl secrets

Description

Manage Secrets. Supported secret stores AWS KMS | Vault | DCOS Secrets | IBM Key Protect | Kubernetes Secrets | Google Cloud KMS

pxctl secrets set-cluster-key

Description

Sets an existing secret as a cluster-wide (default) secret to be used for volume encryption

Flags

Flag	Description
--secret (str)	Secret id of an existing secret
--secret_options (str)	Secret options is used to pass specific secret parameters. Usage: --secret_options=k1=v1,k2=v2
--overwrite (bool)	Overwrite an existing cluster wide secret key

pxctl secrets upload-cluster-wide-secret

Description

Uploads the provided key and secret as a cluster-wide (default) secret. Should be used only when migrating cluster-wide secrets between Portworx clusters.

Flags

Flag	Description
--secret_id (str)	An ID to identify the secret Required: true
--secret_value (str)	The actual secret to be used for encrypting volumes Required: true
--overwrite (bool)	If set then the command will overwrite the existing cluster-wide secret (Any existing volumes with the older secret will be unusable)

pxctl secrets dump-cluster-wide-secret

Description

Dumps the cluster-wide secret and the associated key for this cluster. Should be used only when migrating cluster-wide secrets between Portworx clusters.

pxctl secrets aws

Description

AWS secret-endpoint commands

pxctl secrets aws generate-kms-data-key

Description

Generates a KMS Data Key and associates the given secret_id to it

Flags

Flag	Description
--secret_id (str)	Secret Id to associate with the KMS Data Key

pxctl secrets aws list-secrets

Description

Lists all the available secret ids

pxctl secrets kvdb

Description

kvdb secret-endpoint commands

pxctl secrets kvdb put-secret

Description

Put Secret into kvdb

Flags

Flag	Description
--secret_id (str)	Id of the secret to write in kvdb
--secret_value (str)	Value of the secret

pxctl secrets kvdb get-secret

Description

Get Secret from kvdb

Flags

Flag	Description
--secret_id (str)	Id of the secret to fetch from kvdb

pxctl secrets kvdb list-secrets

Description

Lists all the available secret ids

pxctl secrets gcloud

Description

Google Cloud KMS commands

pxctl secrets gcloud create-secret

Description

Creates a new secret

Flags

Flag	Description
--secret_id, -i (str)	Id of the secret to be created Required: true
--passphrase, -p (str)	The secret passphrase to be associated with the secret id. If passphrase is empty portworx will generate one. Required: true

pxctl secrets gcloud list-secrets

Description

Lists all the available secret ids

pxctl secrets gcloud delete-secret

Description

Deletes a secret with the provided ID. Any volumes encrypted with that secret will not be usable

Flags

Flag	Description
--secret_id, -i (str)	Id of the secret to be deleted Required: true
--force, -f (bool)	Force delete a secret. Any volumes encrypted with that secret will not be usable. Default value: false

pxctl secrets ibm

Description

IBM Key Protect commands

pxctl secrets ibm list-secrets

Description

Lists all the available secret ids