confluentdbutil(8) -- Backup or restore confluent database
=========================================================

## SYNOPSIS

`confluentdbutil [options] [dump|restore|merge] <path>`
`confluentdbutil [-u] [-v] showattrib <noderange> <attribute>...`

## DESCRIPTION

**confluentdbutil** is a utility to export/import the confluent attributes
to/from json files.  The path is a directory that holds the json version.
In order to perform restore, the confluent service must not be running.  It
is required to indicate how the usernames/passwords are treated in
the json files (password protected, removed from the files, or unprotected).

The `showattrib` subcommand prints the stored value of any attribute for the
given noderange, reading directly from the configuration store.  Because it
does not talk to the confluent daemon, it can be used to read attribute values
even while confluent is stopped.  It must be run directly on the confluent
server as root.  By default, `secret.*` and `crypted.*` values are masked as
`********`, just as nodeattrib(8) shows them.  With `-u`, they are revealed:
`secret.*` values decrypted to plaintext and `crypted.*` values as their
stored one-way hashes.

## OPTIONS

* `-p PASSWORD`, `--password=PASSWORD`:
  If specified, information such as usernames and passwords will be encrypted
  using the given password.
  
* `-i`, `--interactivepassword`:
  Prompt for password.  
  
* `-r`, `--redact`:
  Indicates to replace usernames and passwords with a dummy string rather
  than including them.
  
* `-u`, `--unprotected`:
  With `dump`, the keys.json file will include the encryption keys without
  any protection.  With `showattrib`, show `secret.*` values decrypted to
  plaintext and `crypted.*` values as their stored hashes rather than
  masking them as `********`.
  
* `-s`, `--skipkeys`:
  This specifies to dump the encrypted data without
  dumping the keys needed to decrypt it.  This is
  suitable for an automated incremental backup, where an
  earlier password protected dump has a protected
  keys.json file, and only the protected data is needed.
  Keys do not change and as such they do not require
  incremental backup.

* `-x ATTRIBUTE`, `--exclude=ATTRIBUTE`:
  Exclude matching node and node group attributes from `dump`, `restore`,
  or `merge`.
  The option may be specified multiple times.  Attribute names may use
  shell-style wildcards such as `net.*`.
  A bare namespace such as `net` excludes all attributes below that namespace.
  An exclusion omits the attribute from the data being written, it does not
  preserve the value already in the database.  A `restore` replaces the
  database outright, so attributes excluded there are missing from the
  restored configuration entirely; use `merge` to leave existing objects
  untouched.
  Node `groups`, node `id.index`, and node-group `noderange` are retained
  so that restore can reconstruct node-group membership and preserve
  node index assignments.
  During merge, existing nodes and node groups are skipped as whole objects;
  exclusions affect only new objects imported from the backup.

* `-y`, `--yaml`:
  Use YAML instead of JSON as file format

* `-v`, `--value-only`:
  With `showattrib`, print only the values, without node and attribute names
  (useful for scripting).

* `-h`, `--help`:
  Show help message and exit

## EXAMPLES

* Show the decrypted BMC password confluent uses for a node (run on the
  server as root):
    `# confluentdbutil -u showattrib n1 secret.hardwaremanagementpassword`
    `n1: secret.hardwaremanagementpassword: mypassword123`

* Get just the value, for use in a script:
    `# confluentdbutil -u -v showattrib n1 secret.hardwaremanagementpassword`
    `mypassword123`

* Dump configuration without (dynamic) deployment state:
    `# confluentdbutil -u -x 'deployment.state*' dump /root/confluent-backup`
