stado service secret-sync
Invocation
stado service secret-sync [OPTIONS] --host <HOST> --item <ITEM> --variable <VARIABLE> --env-file <ENV_FILE> <NAME>Purpose
Synchronize one Skarbiec field into a service's runtime env file. The value is read through the isolated service-verifier grant and carried in the SSH request body. It is never printed or placed in argv.
Required inputs and options
| Input or option | Contract |
|---|---|
<NAME> | Service name, or the host's own name for the unit |
--host <HOST> | The single registry host to update |
--item <ITEM> | Skarbiec item containing the secret |
--field <FIELD> | Exact string field in the Skarbiec item [default: token] |
--variable <VARIABLE> | Environment variable to replace |
--env-file <ENV_FILE> | Runtime env file on the target, absolute or rooted at $HOME |
--restart | Restart the service after a successful atomic sync |
--json | Command option; required or optional as shown in the invocation. |
Output and state effect
It performs the operation described above and emits its operator result on standard output or standard error. Any state change is limited to the resources and records named by the purpose and options on this page.
Refusals
- Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.