Init Command

Initialize a device to interact with the Secrets Manager API

Description: Initialize a One-Time Access Token

Parameters:

Sub-command to run

format: ksm init <sub-command>

Sub-Commands:

Sub-Command	Description
default	Return the redeemed token as base64 encoded JSON
k8s	Return the redeemed token as Kubernetes secret script.

Both default and k8s take the One-Time Access Token as a plain command-line argument (ksm init default <TOKEN>, ksm init k8s <TOKEN>), with no environment-variable alternative. The token will appear in shell history and, briefly, in the process list (for example ps aux on Linux) for any user able to inspect it. The token is single-use. Redeem it as soon as it is generated, and run this command in a private, trusted shell session.

default

Initialize a One-Time Access Token and create a configuration profile for use with external integrations like GitHub Actions, Terraform and others. The output of the configuration can be generated as either base64 encoded JSON (default), or k8s format. Other KSM Developer SDKs, and applications, will understand configurations in this format.

ksm init default <TOKEN>

optional parameters:

• --plain do not base64 encode the configuration. Return plain JSON.
• -h, --hostname change the hostname
• --skip-ssl-verify - Do not verify the remote SSL certificate.

$ ksm init default XX:XXXX

ewogICAgImNsaWVudElkIjogInd ... U1R4eUQrU3ZNbkhrMTVLUHRGS2MrZlZJOGtlOUtL==

k8s

Initialize a One-Time Access Token into a Kubernetes secret script.

ksm init k8s <TOKEN>

optional parameters:

• --name, -n Name of the Kubernetes secret. Default is ksm-config. The name must use lowercase letters, numbers, -, or .. Each .-separated label must start and end with a letter or a number. The name must not exceed 253 characters (the RFC 1123 subdomain rule Kubernetes applies to Secret names). The CLI rejects an invalid name immediately, before it redeems the One-Time Access Token.
• --namespace, --ns Name of the Kubernetes namespace. Default is default.
• --apply Automatically use kubectl to apply the secret. You will not see the secret script.
• --immutable, -i Make the secret immutable. Requires Kubernetes >= 1.21
• -h, --hostname change the hostname
• --skip-ssl-verify - Do not verify the remote SSL certificate.

$ ksm init k8s XX:XXXX

apiVersion: v1
data
  config: ewogICAgImNsaWVudElkIjogIml ... dWJsaWNLZXlJZCI6ICIxMCIKfQ==
kind: Secret
metadata:
  name: 'ksm-config'
  namespace: 'default'
type: Opaque

Some names are legal Kubernetes Secret names but ambiguous in YAML 1.1 (for example y, n, 1e5). The CLI quotes these names the same way. This makes kubectl apply read them as strings, not as a boolean or number.