cloudtaser-cli source host-launch revoke¶
Stop the old launch and all its Ports first. Verify the exact immutable approval reservation, remove its policy and AppRole, then enumerate and revoke its service tokens by exact policy or role_name metadata. Accessor revocation requests cascade to non-orphan children; concurrent minting can leave survivors. Requires independent administrator credentials. Safe to retry after partial failure, even before approval expiry. Spent markers remain; never reuse the ID. The receipt counts directly selected tokens; descendants remain unverified. It does not cover independently issued or orphan tokens; run the offline cluster revoke-tokens scan afterwards for every fingerprint in the old launch's catalog and keep every affected issuer offline.
Usage¶
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--approval-file |
string | (empty) |
yes | original public approval, retained after expiry |
--confirm-offline |
bool | false |
no | attest the old launch and all its Ports are stopped and cannot auto-restart |
--help, -h |
bool | false |
no | help for revoke |
--secretstore-address |
string | (empty) |
no | exact approved source origin; defaults to approval |
--secretstore-ca-file |
string | (empty) |
no | public source CA bundle matching the approval (required before token input) |
--secretstore-token-file |
string | (empty) |
no | administrator token file or '-' for private stdin |
--timeout |
duration | 20m0s |
no | maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env) |