operator generate-root

The operator generate-root command generates a new root token by combining a quorum of share holders. With the -dr-token or -recovery-token options, it can generate a DR operation token or a recovery token in the same way.

One of the following must be provided to start the root token generation:

• A base64-encoded one-time-password (OTP) provided via the -otp flag. Use the -generate-otp flag to generate a usable value. The resulting token is XORed with this value when it is returned. Use the -decode flag to output the final value.

• A file containing a PGP key or a keybase username in the -pgp-key flag. The resulting token is encrypted with this public key.

An unseal key may be provided directly on the command line as an argument to the command. If key is specified as "-", the command will read from stdin. If a TTY is available, the command will prompt for text.

Please see the generate root guide for step-by-step instructions.

Examples

Generate an OTP code for the final token:

$ vault operator generate-root -generate-otp

Start a root token generation:

$ vault operator generate-root -init

Enter an unseal key to progress root token generation:

$ vault operator generate-root

Usage

The following flags are available in addition to the standard set of flags included on all commands.

Output options

• -format (string: "table") - Print the output in the given format. Valid formats are "table", "json", or "yaml". This can also be specified via the VAULT_FORMAT environment variable.

Command options

• -cancel (bool: false) - Reset the root token generation progress. This will discard any submitted unseal keys or configuration.

• -decode (string: "") - Decode and output the generated root token. This option requires the -otp flag be set to the OTP used during initialization. If value is "-" then read the encoded token from stdin.

• -generate-otp (bool: false) - Generate and print a high-entropy one-time-password (OTP) suitable for use with the "-init" flag.

• -init (bool: false) - Start a root token generation. This can only be done if there is not currently one in progress.

• -nonce (string; "")- Nonce value provided at initialization. The same nonce value must be provided with each unseal key.

• -otp (string: "") - OTP code to use with -decode or -init.

• -pgp-key (keybase or pgp)- Path to a file on disk containing a binary or base64-encoded public PGP key. This can also be specified as a Keybase username using the format keybase:<username>. When supplied, the generated root token will be encrypted and base64-encoded with the given public key.

• -status (bool: false) - Print the status of the current attempt without providing an unseal key. The default is false.

• -dr-token (bool: false) - Generate DR operation token

• -recovery-token (bool: false) - Generate recovery token