Secrets Manager instance management CLI

You can use the IBM Cloud® Secrets Manager instance management command-line interface (CLI) to manage your Secrets Manager Vault Dedicated instance from the command line.

Current version: 2.0.7

The Vault Dedicated plan is currently available as a public beta. Beta features are provided for evaluation and testing purposes and have limitations compared to generally available features.

Before you begin

Before you get started, install the IBM Cloud CLI, and then install the Secrets Manager instance management CLI plug-in by running the following command:

ibmcloud plugin install secrets-manager-instance-management

You're notified on the command line when updates to the IBM Cloud CLI and plug-ins are available. Keep your CLI up to date to use the latest commands, so that you can use the latest commands. You can view the current version of all installed plug-ins by running ibmcloud plugin list.

Targeting a Secrets Manager instance

To target the Secrets Manager Vault Dedicated instance, use one of the following options.

Run the ibmcloud secrets-manager-instance-management config set command.

ibmcloud secrets-manager-instance-management config set service-url https://{instance_ID}.{region}.secrets-manager.cloud.ibm.com

Export an environment variable with your Secrets Manager control plane service endpoint URL.

export SECRETS_MANAGER_INSTANCE_MANAGEMENT_URL=https://{instance_ID}.{region}.secrets-manager.cloud.ibm.com

Set the service endpoint in the command.

ibmcloud secrets-manager-instance-management instance --service-url https://{instance_ID}.{region}.secrets-manager.cloud.ibm.com

Replace {instance_ID} and {region} with the values that apply to your Secrets Manager Vault Dedicated service instance. To find the endpoint URL that is specific to your instance, you can copy it from the Endpoints page in the Secrets Manager UI. For more information, see Viewing your endpoint URLs.

Globals

Commands

`ibmcloud secrets-manager-instance-management docs`

Opens the plug-in documentation in the web browser.

ibmcloud secrets-manager-instance-management docs

Example

ibmcloud secrets-manager-instance-management docs

Options

--region (string): The region where you provisioned your Vault Dedicated Instance. Available regions: us-south, eu-de.
--output (string): Choose an output format - can be 'json', 'yaml', or 'table'. Defaults to 'table'.
-j, --jmes-query (string): Provide a JMESPath query to customize output.
--service-url (string): Provide the base endpoint URL for the API.
-q, --quiet: Suppresses verbose messages.
-v, --version: Prints the plug-in version.

Example

ibmcloud secrets-manager-instance-management \
    --region=us-south \
    --output=json \
    --jmes-query="[:10]" \
    --service-url="https://myservice.cloud.ibm.com" \
    --quiet

This example only demonstrates the global options available to all sub-commands and is not a valid command itself.

Config

Global parameters can also be stored in persistent configuration so that they do not need to be manually specified each time the plug-in is invoked. Each parameter can be configured with the config command and its subcommands.

ibmcloud secrets-manager-instance-management config

`ibmcloud secrets-manager-instance-management config set`

Set a new config value for a specific option. Each subcommand of the set command maps to a global option. Each subcommand accepts a single argument, the string representation of the value to store for the option.

ibmcloud secrets-manager-instance-management config set <option> <value>

Examples

ibmcloud secrets-manager-instance-management config set service-url \
    'https://{region}.secrets-manager.cloud.ibm.com'

`ibmcloud secrets-manager-instance-management config get`

Print out the currently set value for a specific option. Each subcommand of the get command maps to a global option.

ibmcloud secrets-manager-instance-management config get <option>

Examples

ibmcloud secrets-manager-instance-management config get service-url

`ibmcloud secrets-manager-instance-management config unset`

Unset the currently set value for a specific option. Each subcommand of the unset command maps to a global option.

The subcommands available for this service are: service-url, .

ibmcloud secrets-manager-instance-management config unset <option>

Examples

ibmcloud secrets-manager-instance-management config unset service-url

`ibmcloud secrets-manager-instance-management config list`

List out all of the currently set config values.

ibmcloud secrets-manager-instance-management config list

Examples

ibmcloud secrets-manager-instance-management config list

Tokens

Manage admin tokens.

`ibmcloud secrets-manager-instance-management admin-token-create`

Generate a Vault admin token for authenticating to your Vault Dedicated cluster. The token is valid for 1 hour and grants administrative privileges. Use only for initial setup and cluster management, then revoke immediately.

ibmcloud secrets-manager-instance-management admin-token-create --id ID [--region REGION] [-j, --jmes-query JMES-QUERY] [--output OUTPUT] [-q, --quiet]

Command options

--id (string)

Secrets Manager instance ID. Required.

Length must be 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.

Example

Example request

ibmcloud secrets-manager-instance-management admin-token-create --id bfc50c2e-d66d-4f37-9ccf-9713f8325b39

`ibmcloud secrets-manager-instance-management admin-tokens-delete`

Revoke all active Vault admin tokens. This immediately invalidates all existing admin tokens.

ibmcloud secrets-manager-instance-management admin-tokens-delete --id ID [--region REGION] [-j, --jmes-query JMES-QUERY] [--output OUTPUT] [-q, --quiet]

Command options

--id (string)

Secrets Manager instance ID. Required.

Length must be 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.

Example

Example request

ibmcloud secrets-manager-instance-management admin-tokens-delete --id bfc50c2e-d66d-4f37-9ccf-9713f8325b39

Instances

Instance details.

`ibmcloud secrets-manager-instance-management instance-details`

Get service instance details including cluster state, endpoints, and key management service.

ibmcloud secrets-manager-instance-management instance-details --id ID [--region REGION] [-j, --jmes-query JMES-QUERY] [--output OUTPUT] [-q, --quiet]

Command options

--id (string)

Secrets Manager instance ID. Required.

Length must be 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.

Example

Example request

ibmcloud secrets-manager-instance-management instance-details --id bfc50c2e-d66d-4f37-9ccf-9713f8325b39

Example output

Example Instance response

{
  "id" : "12345678-abcd-1234-abcd-1234567890ab",
  "name" : "Example Instance",
  "href" : "https://us-south.secrets-manager.cloud.ibm.com/v2/instances/12345678-abcd-1234-abcd-1234567890ab",
  "instance_crn" : "crn:v1:bluemix:public:secrets-manager:us-south:a/a1b2c3d4e5f61234567890abcdef1234:12345678-abcd-1234-abcd-1234567890ab::",
  "plan" : "dedicated",
  "vault_cluster" : {
    "status" : "healthy",
    "version" : "1.21.2+ent.hsm"
  },
  "endpoints" : {
    "public" : {
      "vault_api" : "https://12345678-abcd-1234-abcd-1234567890ab.us-south.secrets-manager.appdomain.cloud",
      "vault_ui" : "https://12345678-abcd-1234-abcd-1234567890ab.us-south.secrets-manager.appdomain.cloud/ui"
    },
    "private" : {
      "vault_api" : "https://private.12345678-abcd-1234-abcd-1234567890ab.us-south.secrets-manager.appdomain.cloud",
      "vault_ui" : "https://private.12345678-abcd-1234-abcd-1234567890ab.us-south.secrets-manager.appdomain.cloud/ui"
    }
  },
  "encryption" : {
    "mode" : "customer_managed",
    "provider" : "key_protect",
    "key_crn" : "crn:v1:bluemix:public:kms:us-south:a/a1b2c3d4e5f61234567890abcdef1234:abcd1234-ab12-ab12-ab12-abcdef123456:key:12ab34cd-12ab-12ab-12ab-123456abcdef"
  }
}