mirror of
https://github.com/xcat2/confluent.git
synced 2026-08-04 08:27:01 +00:00
Markus Hilger
6f11dffae8
Adds `confluentdbutil showattrib <noderange> <attribute>...` to print the node attribute. In contrast to nodeattrib it can shows secrets and crypted values with -u flag. It's server-side only: reads the config store and master key directly, never over the API. It's read-only and works without confluentd running.
74 lines
2.7 KiB
Markdown
74 lines
2.7 KiB
Markdown
confluentdbutil(8) -- Backup or restore confluent database
|
|
=========================================================
|
|
|
|
## SYNOPSIS
|
|
|
|
`confluentdbutil [options] [dump|restore] <path>`
|
|
`confluentdbutil [-u] [-v] showattrib <noderange> <attribute>...`
|
|
|
|
## DESCRIPTION
|
|
|
|
**confluentdbutil** is a utility to export/import the confluent attributes
|
|
to/from json files. The path is a directory that holds the json version.
|
|
In order to perform restore, the confluent service must not be running. It
|
|
is required to indicate how the usernames/passwords are treated in
|
|
the json files (password protected, removed from the files, or unprotected).
|
|
|
|
The `showattrib` subcommand prints the stored value of any attribute for the
|
|
given noderange, reading directly from the configuration store. Because it
|
|
does not talk to the confluent daemon, it can be used to read attribute values
|
|
even while confluent is stopped. It must be run directly on the confluent
|
|
server as root. By default, `secret.*` and `crypted.*` values are masked as
|
|
`********`, just as nodeattrib(8) shows them. With `-u`, they are revealed:
|
|
`secret.*` values decrypted to plaintext and `crypted.*` values as their
|
|
stored one-way hashes.
|
|
|
|
## OPTIONS
|
|
|
|
* `-p PASSWORD`, `--password=PASSWORD`:
|
|
If specified, information such as usernames and passwords will be encrypted
|
|
using the given password.
|
|
|
|
* `-i`, `--interactivepassword`:
|
|
Prompt for password.
|
|
|
|
* `-r`, `--redact`:
|
|
Indicates to replace usernames and passwords with a dummy string rather
|
|
than including them.
|
|
|
|
* `-u`, `--unprotected`:
|
|
With `dump`, the keys.json file will include the encryption keys without
|
|
any protection. With `showattrib`, show `secret.*` values decrypted to
|
|
plaintext and `crypted.*` values as their stored hashes rather than
|
|
masking them as `********`.
|
|
|
|
* `-s`, `--skipkeys`:
|
|
This specifies to dump the encrypted data without
|
|
dumping the keys needed to decrypt it. This is
|
|
suitable for an automated incremental backup, where an
|
|
earlier password protected dump has a protected
|
|
keys.json file, and only the protected data is needed.
|
|
Keys do not change and as such they do not require
|
|
incremental backup.
|
|
|
|
* `-y`, `--yaml`:
|
|
Use YAML instead of JSON as file format
|
|
|
|
* `-v`, `--value-only`:
|
|
With `showattrib`, print only the values, without node and attribute names
|
|
(useful for scripting).
|
|
|
|
* `-h`, `--help`:
|
|
Show help message and exit
|
|
|
|
## EXAMPLES
|
|
|
|
* Show the decrypted BMC password confluent uses for a node (run on the
|
|
server as root):
|
|
`# confluentdbutil -u showattrib n1 secret.hardwaremanagementpassword`
|
|
`n1: secret.hardwaremanagementpassword: mypassword123`
|
|
|
|
* Get just the value, for use in a script:
|
|
`# confluentdbutil -u -v showattrib n1 secret.hardwaremanagementpassword`
|
|
`mypassword123`
|