.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
.TH PACEMAKER "8" "March 2024" "Pacemaker 2.1.7" "System Administration Utilities"
.SH NAME
Pacemaker \- Part of the Pacemaker cluster resource manager
.SH DESCRIPTION
cibsecret \- manage sensitive information in Pacemaker CIB
.SS "Usage:"
.IP
cibsecret [<options>] <command> [<parameters>]
.SH OPTIONS
.TP
\fB\-\-help\fR
Show this message, then exit
.TP
\fB\-\-version\fR
Display version information, then exit
.TP
\fB\-C\fR
Don't read or write the CIB
.SS "Commands and their parameters:"
.IP
set <resource\-id> <resource\-parameter> <value>
.IP
Set the value of a sensitive resource parameter.
.IP
get <resource\-id> <resource\-parameter>
.IP
Display the locally stored value of a sensitive resource parameter.
.IP
check <resource\-id> <resource\-parameter>
.IP
Verify that the locally stored value of a sensitive resource parameter
matches its locally stored MD5 hash.
.IP
stash <resource\-id> <resource\-parameter>
.IP
Make a non\-sensitive resource parameter that is already in the CIB
sensitive (move its value to a locally stored and protected file).
This may not be used with \fB\-C\fR.
.IP
unstash <resource\-id> <resource\-parameter>
.IP
Make a sensitive resource parameter that is already in the CIB
non\-sensitive (move its value from the locally stored file to the CIB).
This may not be used with \fB\-C\fR.
.IP
delete <resource\-id> <resource\-parameter>
.IP
Remove a sensitive resource parameter value.
.IP
sync
.IP
Copy all locally stored secrets to all other nodes.
.PP
This command manages sensitive resource parameter values that should not be
stored directly in Pacemaker's Cluster Information Base (CIB). Such values
are handled by storing a special string directly in the CIB that tells
Pacemaker to look in a separate, protected file for the actual value.
.PP
The secret files are not encrypted, but protected by file system permissions
such that only root can read or modify them.
.PP
Since the secret files are stored locally, they must be synchronized across all
cluster nodes. This command handles the synchronization using (in order of
preference) pssh, pdsh, or ssh, so one of those must be installed. Before
synchronizing, this command will ping the cluster nodes to determine which are
alive, using fping if it is installed, otherwise the ping command. Installing
fping is strongly recommended for better performance.
.PP
Known limitations:
.IP
This command can only be run from full cluster nodes (not Pacemaker Remote
nodes).
.IP
Changes are not atomic, so the cluster may use different values while a
change is in progress. To avoid problems, it is recommended to put the
cluster in maintenance mode when making changes with this command.
.IP
Changes in secret values do not trigger an agent reload or restart of the
affected resource, since they do not change the CIB. If a response is
desired before the next cluster recheck interval, any CIB change (such as
setting a node attribute) will trigger it.
.IP
If any node is down when changes to secrets are made, or a new node is
later added to the cluster, it may have different values when it joins the
cluster, before "cibsecret sync" is run. To avoid this, it is recommended to
run the sync command (from another node) before starting Pacemaker on the
node.
.SH EXAMPLES
.IP
cibsecret set ipmi_node1 passwd SecreT_PASS
.IP
cibsecret get ipmi_node1 passwd
.IP
cibsecret check ipmi_node1 passwd
.IP
cibsecret stash ipmi_node2 passwd
.IP
cibsecret sync
.SH AUTHOR
Written by Andrew Beekhof and the Pacemaker project contributors