stado credentials put
Invocation
stado credentials put [OPTIONS] [NAME]Purpose
Store an item in the selected credential store, reading from STDIN. Without --route a write is an owner act: it goes to the owner vault the store selects. With --route, --consumer, --grant-file and --field it replaces one field of an existing item under that consumer's own `rotate:NAME#FIELD` grant, keeping every other field, the kind, the recipients and the tags; the vault records the consumer as the writer. A missing grant, an absent or trashed item, or an item a lifecycle or Weles controls is refused with Skarbiec's answer.
Required inputs and options
| Input or option | Contract |
|---|---|
[NAME] | Credential item id |
--role <ROLE> | Write the one live item carrying the tag `stado:role:<ROLE>` instead of naming an item, keeping its tags. No item in the role, or several, is refused. Not with --route: a consumer's rotate grant names an item, and a scoped consumer cannot look a role up |
--type <ITEM_TYPE> | Canonical Skarbiec kind. Defaults to the payload's own `kind` when stdin carries one, else `stado-secret`. An SSH host key stored as a free-form secret loses the schema's guarantee that both halves are present, which is how one fleet key ended up shaped unlike its peers |
--field <FIELD> | The one field a delegated write replaces. Only with --route |
--route <ROUTE> | Skarbiec route for a delegated field write. Requires --consumer, --grant-file and --field; never uses the store administrator |
--consumer <CONSUMER> | Identity holding the rotate grant for this exact field |
--grant-file <GRANT_FILE> | File holding that consumer's grant |
Output and state effect
It performs the operation described above and emits its operator result on standard output or standard error. Any state change is limited to the resources and records named by the purpose and options on this page.
Refusals
- No item in the role, or several, is refused.
- Not with --route: a consumer's rotate grant names an item, and a scoped consumer cannot look a role up
- Requires --consumer, --grant-file and --field; never uses the store administrator
- Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.