mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-23 15:41:07 +02:00
0660ea6fac
* Update README Let contributors know that docs will now be located in UDR * Add comments to each mdx doc Comment has been added to all mdx docs that are not partials * chore: added changelog changelog check failure * wip: removed changelog * Fix content errors * Doc spacing * Update website/content/docs/deploy/kubernetes/vso/helm.mdx Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com> --------- Co-authored-by: jonathanfrappier <92055993+jonathanfrappier@users.noreply.github.com> Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
98 lines
3.7 KiB
Plaintext
98 lines
3.7 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: operator generate-root - Command
|
|
description: |-
|
|
The "operator generate-root" command generates a new root token by combining a
|
|
quorum of share holders.
|
|
---
|
|
|
|
> [!IMPORTANT]
|
|
> **Documentation Update:** Product documentation, which were located in this repository under `/website`, are now located in [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs), colocated with all other product documentation. Contributions to this content should be done in the `web-unified-docs` repo, and not this one. Changes made to `/website` content in this repo will not be reflected on the developer.hashicorp.com website.
|
|
|
|
# operator generate-root
|
|
|
|
The `operator generate-root` command generates a new root token by combining a
|
|
quorum of share holders. With the `-dr-token` or `-recovery-token` options,
|
|
it can generate a DR operation token or a recovery token in the same way.
|
|
|
|
One of the following must be provided to start the root token generation:
|
|
|
|
- A base64-encoded one-time-password (OTP) provided via the `-otp` flag. Use the
|
|
`-generate-otp` flag to generate a usable value. The resulting token is XORed
|
|
with this value when it is returned. Use the `-decode` flag to output the
|
|
final value.
|
|
|
|
- A file containing a PGP key or a
|
|
[keybase](/vault/docs/concepts/pgp-gpg-keybase) username in the `-pgp-key`
|
|
flag. The resulting token is encrypted with this public key.
|
|
|
|
An unseal key may be provided directly on the command line as an argument to the
|
|
command. If key is specified as "-", the command will read from stdin. If a TTY
|
|
is available, the command will prompt for text.
|
|
|
|
Please see the [generate root guide](/vault/docs/troubleshoot/generate-root-token)
|
|
for step-by-step instructions.
|
|
|
|
## Examples
|
|
|
|
Generate an OTP code for the final token:
|
|
|
|
```shell-session
|
|
$ vault operator generate-root -generate-otp
|
|
```
|
|
|
|
Start a root token generation:
|
|
|
|
```shell-session
|
|
$ vault operator generate-root -init
|
|
```
|
|
|
|
Enter an unseal key to progress root token generation:
|
|
|
|
```shell-session
|
|
$ vault operator generate-root
|
|
```
|
|
|
|
## Usage
|
|
|
|
The following flags are available in addition to the [standard set of
|
|
flags](/vault/docs/commands) included on all commands.
|
|
|
|
### Output options
|
|
|
|
- `-format` `(string: "table")` - Print the output in the given format. Valid
|
|
formats are "table", "json", or "yaml". This can also be specified via the
|
|
`VAULT_FORMAT` environment variable.
|
|
|
|
### Command options
|
|
|
|
- `-cancel` `(bool: false)` - Reset the root token generation progress. This
|
|
will discard any submitted unseal keys or configuration.
|
|
|
|
- `-decode` `(string: "")` - Decode and output the generated root token. This
|
|
option requires the `-otp` flag be set to the OTP used during initialization.
|
|
If value is "-" then read the encoded token from stdin.
|
|
|
|
- `-generate-otp` `(bool: false)` - Generate and print a high-entropy
|
|
one-time-password (OTP) suitable for use with the "-init" flag.
|
|
|
|
- `-init` `(bool: false)` - Start a root token generation. This can only be done
|
|
if there is not currently one in progress.
|
|
|
|
- `-nonce` `(string; "")`- Nonce value provided at initialization. The same
|
|
nonce value must be provided with each unseal key.
|
|
|
|
- `-otp` `(string: "")` - OTP code to use with `-decode` or `-init`.
|
|
|
|
- `-pgp-key` `(keybase or pgp)`- Path to a file on disk containing a binary or
|
|
base64-encoded public PGP key. This can also be specified as a Keybase
|
|
username using the format `keybase:<username>`. When supplied, the generated
|
|
root token will be encrypted and base64-encoded with the given public key.
|
|
|
|
- `-status` `(bool: false)` - Print the status of the current attempt without
|
|
providing an unseal key. The default is false.
|
|
|
|
- `-dr-token` `(bool: false)` - Generate DR operation token
|
|
|
|
- `-recovery-token` `(bool: false)` - Generate recovery token
|