stado cloud roles repair
Invocation
stado cloud roles repair [OPTIONS] --provider <PROVIDER> --operator-role <OPERATOR_ROLE>Purpose
Apply Stado control-plane/agent roles and inspect a named deny assignment
Required inputs and options
| Input or option | Contract |
|---|---|
--provider <PROVIDER> | Provider whose role assignments are repaired. No provider is assumed Possible values: - azure: Microsoft Azure: Entra sign-in and Azure RBAC |
--subscription <SUBSCRIPTION> | Azure subscription to repair; defaults to AZURE_SUBSCRIPTION_ID/config |
--resource-group <RESOURCE_GROUP> | Resource group containing Stado compute resources |
--storage-account <STORAGE_ACCOUNT> | Queue storage account; defaults to WC_AZURE_STORAGE_ACCOUNT/config |
--principal-object-id <PRINCIPAL_OBJECT_ID> | Stado service-principal object id; otherwise decoded from its ARM token |
--agent-object-id <AGENT_OBJECT_ID> | Agent managed-identity object id; otherwise resolved from AZURE_VM_IDENTITY_ID |
--operator-role <OPERATOR_ROLE> | Vault role whose item holds the operator refresh token: the role `cloud login --role` stored it under |
--remove-deny-name <REMOVE_DENY_NAME> | Exact substring of a deny-assignment display name to remove when Azure permits it |
--json | Print the repair report as JSON instead of lines |
Output and state effect
It performs the operation described above and emits its operator result on standard output or standard error. Any state change is limited to the resources and records named by the purpose and options on this page.
Refusals
- Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.