Disable-ZrSecurity
Turns off control-plane security enforcement at runtime across every connected manager, so the Management Service stops requiring tokens; provisioned identities and keys are retained.
Syntax
Disable-ZrSecurity
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
[-WhatIf] [-Confirm]
Description
Disable-ZrSecurity flips enforcement off at runtime, fanning the change out to every resolved manager. After it runs, the Management Service no longer requires a valid token on control-plane calls. The change is to enforcement only — the shared signing key, users, service accounts, and role grants provisioned by Initialize-ZrSecurity are all retained, so enforcement can be turned back on later with Enable-ZrSecurity. Requires an active workspace or an explicit -Managers list.
This is a state-changing operation that removes authentication from the cluster's control plane. While disabled, any caller that can reach a manager can perform control-plane operations without a token. Re-enable enforcement as soon as the maintenance window that required disabling it is over.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-Managers | string[] | No | Management Service endpoints (host, host:port, or URL) to target. When omitted, the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Supports -WhatIf and -Confirm.
Examples
Turn off enforcement across all managers without removing the existing security configuration.
Disable-ZrSecurity