ak secrets export

Xuất danh mục có phiên bản của mọi bí mật đã lưu.

Dùng ak secrets export với đối số và tùy chọn dưới đây. Phần help nguyên bản giữ nguyên thuật ngữ, cú pháp, tác động và điều kiện thực thi của CLI để đối chiếu chính xác.

Contract và help của lệnh

Emit a versioned inventory of every stored secret

Synopsis

Emit a schema-versioned inventory (schema_version 1) of every stored ref: name, creator, created/rotated timestamps, its rotation window in days, and how many grants name it. Values are excluded unless --include-values is passed, and that flag requires --out <path>.age: a value is never written to stdout or a terminal, in any mode including --json. --include-values asks for a y/N confirmation on stderr, then twice for a new passphrase, and seals the document to that passphrase with age before writing it; nothing on this host keeps that passphrase, so losing it loses the export, the same trade as any other age-encrypted backup you keep yourself. Without --include-values, --out (any extension) writes the bare plaintext document (mode 0600); omitted, it goes to stdout instead, wrapped in the usual envelope under --json or as a table otherwise. Use it to inventory a host before a migration, or to hand an auditor the list of refs without the secrets.

Effects: Reads the index and the grants file; reads the backend once per ref only with --include-values. Writes the --out path (mode 0600), replacing an existing file there and saying so; with --include-values the file is age-encrypted, sealed to a passphrase entered at the prompt and stored nowhere on this host.

Exit status: 0 success 2 invalid flags; for --include-values, --out is missing, does not end in .age, names stdout/a terminal/a symlink/a directory, or the confirmation/passphrase was declined, did not match, or was never entered (stdin closed or Ctrl-D at the prompt) 3 a listed ref has no stored value (only with --include-values) 5 backend, index, encryption, or --out write failure

ak secrets export [flags]

Examples

  ak secrets export --json                          # inventory on stdout, metadata only
  ak secrets export --out ./inventory.json          # bare document in a 0600 file
  ak secrets export --include-values --out ./v.age  # prompts, writes an age-encrypted file

Options

      --backend string         Storage backend: keychain (default), file (age-encrypted vault), or memory (dev/test; values and its index are throwaway)
  -h, --help                   help for export
      --include-values         Include every value, age-encrypted to a passphrase you enter (requires --out <path>.age)
      --json                   Emit machine-readable JSON (implies --no-interactive)
      --no-interactive         Disable interactive prompts (CI-safe)
      --out string             Write the export to this path (mode 0600) instead of stdout; --include-values requires this and a .age extension
  -q, --quiet                  Suppress non-error output on stderr
      --unlock-with-recovery   Open the file backend's vault with a recovery private key and set a new passphrase
  -V, --verbose                Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes                    Assume yes for all prompts

SEE ALSO

• ak secrets - Manage named secret values (API keys, tokens)