stado azure repair-rbac
Invocation
stado azure repair-rbac [OPTIONS]Purpose
Apply Stado control-plane/agent roles and inspect a named deny assignment
Required inputs and options
| Input or option | Contract |
|---|---|
--subscription <SUBSCRIPTION> | Azure subscription to repair; defaults to AZURE_SUBSCRIPTION_ID/config |
--resource-group <RESOURCE_GROUP> | Resource group containing Stado compute resources |
--storage-account <STORAGE_ACCOUNT> | Queue storage account; defaults to WC_AZURE_STORAGE_ACCOUNT/config |
--principal-object-id <PRINCIPAL_OBJECT_ID> | Stado service-principal object id; otherwise decoded from its ARM token |
--agent-object-id <AGENT_OBJECT_ID> | Agent managed-identity object id; otherwise resolved from AZURE_VM_IDENTITY_ID |
--operator-item <OPERATOR_ITEM> | Owner-only Skarbiec item containing the operator refresh token [default: stado-azure-operator] |
--remove-deny-name <REMOVE_DENY_NAME> | Exact substring of a deny-assignment display name to remove when Azure permits it |
Output and state effect
It performs the operation described above and emits its operator result on standard output or standard error. Any state change is limited to the resources and records named by the purpose and options on this page.
Refusals
- Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.