BBramaDocs
Browse documentation

Brama CLI command reference

brama workload deregister

Withdraw what brama workload register granted: revoke the vault grant of every agent this installation's workload names.

Invocation

brama workload deregister [--json]

What it reads and writes

It finds the router, vault and registry.json exactly as register does, and runs skarbiec-entitlements-router grant revoke for each agent the first workload names. Revoking a grant the vault no longer holds changes nothing, so a rerun is harmless. After it, the broker refuses every capability for those agents until register runs again.

Output

registry and the revoked agents as key: value lines, or one document with --json. Exit 0 means every grant was revoked.

Refusals

Each exits 1; on a router refusal the agents before it are already revoked:

  • cannot resolve the running installation <current>: <cause>; <installation> holds no bin directory, at its root or in a platform directory; <installation> holds several platform directories with a bin directory, so which one runs is not stated: <directories>
  • ENTITLEMENTS_ROUTER_BIN, SKARBIEC_VAULT_FILE and BRAMA_SKARBIEC_CONFIG_DIR must be named by the running installation, environment, or service env
  • no workload registry at <path>; cannot read workload registry <path>: <error>; workload registry <path> is not JSON: <error>; workload registry <path> declares no workload
  • <registry> names no agent whose grant could be revoked
  • grant revoke for <agent> could not run: <error>; grant revoke refused <agent>: <router's own answer>

Back to the complete CLI command tree.