Enable-ZrSecurity
Turns on control-plane security enforcement at runtime across every connected manager, so the Management Service begins requiring a valid token on control-plane calls.
Syntax
Enable-ZrSecurity
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
[-WhatIf] [-Confirm]
Description
Enable-ZrSecurity flips enforcement on at runtime, fanning the change out to every resolved manager. Once enabled, each Management Service rejects unauthenticated control-plane calls and requires a valid token; callers must present an admin token (via -Token or the token captured during bootstrap).
Security must already be initialized with Initialize-ZrSecurity — this cmdlet only toggles enforcement of an already-provisioned security setup. Requires an active workspace or an explicit -Managers list.
Enabling enforcement immediately makes every manager require a valid admin token. Confirm you hold a working admin token (check Get-ZrSecurityStatus) before enabling, or you can lock yourself out of the control plane.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-Managers | string[] | No | Management Service endpoints (host, host:port, or URL) to target. When omitted, the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Supports -WhatIf and -Confirm.
Examples
Turn on enforcement across all managers in the active workspace.
Enable-ZrSecurity