Skip to main content

Initialize-ZrSecurity

Bootstraps token security across all target managers: it provisions the first manager (which generates the shared signing key), fans that same key out to every other manager so they all issue and verify tokens with one key, creates the bootstrap cluster-admin identity, and prints the admin token once.

Syntax​

Initialize-ZrSecurity
    [-AdminSubject <string>]
    [-AdminPassword <SecureString>]
    [-NoEnable]
    [-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
    [-WhatIf] [-Confirm]

Description​

Initialize-ZrSecurity is the one-time setup step for the token / RBAC security model. It provisions security on the first resolved manager — which mints the cluster's shared signing key — then carries that key to the remaining managers so the whole cluster issues and verifies tokens against a single key. It creates the bootstrap admin (-AdminSubject, default admin) and prints the admin token exactly once; the token is also captured into the connected context so subsequent cmdlets authenticate automatically.

Security must already be enabled in each manager's config and the managers restarted before running this cmdlet. Unless -NoEnable is supplied, enforcement is turned on across all managers as soon as the admin exists — from that point the Management Service requires a valid admin token for control-plane calls. Requires an active workspace (see New-ZrWorkspace / Use-ZrWorkspace) or an explicit -Managers list.

warning

Enabling enforcement immediately makes every manager reject unauthenticated control-plane calls. The bootstrap admin token is shown once — capture it before closing the session or you can lock yourself out of the cluster's control plane. Use -NoEnable if you want to provision first and turn enforcement on later with a deliberate Enable-ZrSecurity.

Parameters​

ParameterTypeRequiredDescription
-AdminSubjectstringNoSubject name of the bootstrap cluster-admin identity. Position 0. Default admin.
-AdminPasswordSecureStringNoPassword for the first admin account. Position 1. When set, the bootstrap admin is a real login user you can sign in with; when omitted, the bootstrap is token-only. Supply as a SecureString (e.g. (Read-Host -AsSecureString)).
-NoEnableswitchNoProvision security but leave enforcement disabled, so the cluster is set up but not yet enforcing. Turn it on later with Enable-ZrSecurity.
-Managersstring[]NoManagement Service endpoints (host, host:port, or URL) to target. When omitted, the active workspace's managers are used.
-PortintNoManagement Service port for bare-host managers. Default 7801.
-TokenstringNoAdmin bearer token for authenticated control-plane calls.
-TimeoutSecintNoPer-request timeout in seconds. Default 30.

Supports -WhatIf and -Confirm.

Examples​

Bootstrap security with a real admin login user and enable enforcement, printing the admin token once. Capture it immediately.

Initialize-ZrSecurity -AdminSubject admin -AdminPassword (Read-Host -AsSecureString)

Provision a token-only bootstrap admin but leave enforcement disabled for a later, deliberate enable.

Initialize-ZrSecurity -AdminSubject admin -NoEnable