Enable-ZrStoreSecurity
Enables data-plane token verification for a store by writing the shared public key into every node configuration of that store across all managers, so the store's nodes verify caller tokens.
Syntax
Enable-ZrStoreSecurity
-Store <string>
[-Restart]
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
[-WhatIf] [-Confirm]
Description
Where Enable-ZrSecurity enforces auth on the control plane, Enable-ZrStoreSecurity extends token verification to a store's data plane. It writes the cluster's shared public key (see Get-ZrPublicKey) into every node configuration of the named store, across all managers, so those nodes validate the tokens clients present.
Without -Restart the configuration is staged and takes effect the next time the nodes restart; with -Restart the running nodes are rolling-restarted so enforcement activates immediately. Requires an active workspace or an explicit -Managers list and an admin token.
This is the data-plane switch. Turning on cluster security (Enable-ZrSecurity) secures only the control plane — a store stays open to unauthenticated clients until you enable it here. The web console does the same thing under Security & TLS → Require a token to connect (per store).
When an orchestrator owns the nodes (attach mode), the manager cannot reconfigure them — this cmdlet reports "0 nodes updated." Declare the security block (enabled + the cluster public key) in each node's configuration and restart; the store registration then records that enforcement is on. See Security and TLS.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-Store | string | Yes | Name of the store whose node configurations are updated to verify tokens. Position 0. |
-Restart | switch | No | Rolling-restarts the store's running nodes so the change takes effect immediately instead of at the next restart. |
-Managers | string[] | No | Management Service endpoints (host, host:port, or URL) to target. When omitted, the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Supports -WhatIf and -Confirm.
Examples
Stage token verification for the orders store; its nodes enforce it after their next restart.
Enable-ZrStoreSecurity -Store orders
Enable and rolling-restart the orders store's nodes so enforcement is active immediately.
Enable-ZrStoreSecurity -Store orders -Restart