[{"data":1,"prerenderedAt":1015},["ShallowReactive",2],{"navigation_docs":3,"-troubleshooting-licensing-failures":136,"-troubleshooting-licensing-failures-surround":1010},[4,26,47,68,89,110,123],{"title":5,"path":6,"stem":7,"children":8,"page":25},"Getting Started","\u002Fgetting-started","1.getting-started",[9,13,17,21],{"title":10,"path":11,"stem":12},"What you are running","\u002Fgetting-started\u002Fwhat-you-are-running","1.getting-started\u002F1.what-you-are-running",{"title":14,"path":15,"stem":16},"Architecture","\u002Fgetting-started\u002Farchitecture","1.getting-started\u002F2.architecture",{"title":18,"path":19,"stem":20},"Prerequisites","\u002Fgetting-started\u002Fprerequisites","1.getting-started\u002F3.prerequisites",{"title":22,"path":23,"stem":24},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Install","\u002Finstall","2.install",[31,35,39,43],{"title":32,"path":33,"stem":34},"Install the chart","\u002Finstall\u002Finstall-the-chart","2.install\u002F1.install-the-chart",{"title":36,"path":37,"stem":38},"Activation","\u002Finstall\u002Factivation","2.install\u002F2.activation",{"title":40,"path":41,"stem":42},"DNS and TLS","\u002Finstall\u002Fdns-and-tls","2.install\u002F3.dns-and-tls",{"title":44,"path":45,"stem":46},"Verify your install","\u002Finstall\u002Fverify-your-install","2.install\u002F4.verify-your-install",{"title":48,"path":49,"stem":50,"children":51,"page":25},"Configure","\u002Fconfigure","3.configure",[52,56,60,64],{"title":53,"path":54,"stem":55},"Data services","\u002Fconfigure\u002Fdata-services","3.configure\u002F1.data-services",{"title":57,"path":58,"stem":59},"Secrets","\u002Fconfigure\u002Fsecrets","3.configure\u002F2.secrets",{"title":61,"path":62,"stem":63},"Registry and air-gapped installs","\u002Fconfigure\u002Fregistry-and-airgap","3.configure\u002F3.registry-and-airgap",{"title":65,"path":66,"stem":67},"Integrations","\u002Fconfigure\u002Fintegrations","3.configure\u002F4.integrations",{"title":69,"path":70,"stem":71,"children":72,"page":25},"Licensing","\u002Flicensing","4.licensing",[73,77,81,85],{"title":74,"path":75,"stem":76},"How licensing works","\u002Flicensing\u002Fhow-licensing-works","4.licensing\u002F1.how-licensing-works",{"title":78,"path":79,"stem":80},"Your key never leaves","\u002Flicensing\u002Fyour-key-never-leaves","4.licensing\u002F2.your-key-never-leaves",{"title":82,"path":83,"stem":84},"What phones home","\u002Flicensing\u002Fwhat-phones-home","4.licensing\u002F3.what-phones-home",{"title":86,"path":87,"stem":88},"Revoke and recover","\u002Flicensing\u002Frevoke-and-recover","4.licensing\u002F4.revoke-and-recover",{"title":90,"path":91,"stem":92,"children":93,"page":25},"Operate","\u002Foperate","5.operate",[94,98,102,106],{"title":95,"path":96,"stem":97},"Upgrade","\u002Foperate\u002Fupgrade","5.operate\u002F1.upgrade",{"title":99,"path":100,"stem":101},"Backup and restore","\u002Foperate\u002Fbackup-and-restore","5.operate\u002F2.backup-and-restore",{"title":103,"path":104,"stem":105},"Observability","\u002Foperate\u002Fobservability","5.operate\u002F3.observability",{"title":107,"path":108,"stem":109},"High availability","\u002Foperate\u002Fhigh-availability","5.operate\u002F4.high-availability",{"title":111,"path":112,"stem":113,"children":114,"page":25},"Troubleshooting","\u002Ftroubleshooting","6.troubleshooting",[115,119],{"title":116,"path":117,"stem":118},"Install failures","\u002Ftroubleshooting\u002Finstall-failures","6.troubleshooting\u002F1.install-failures",{"title":120,"path":121,"stem":122},"Licensing failures","\u002Ftroubleshooting\u002Flicensing-failures","6.troubleshooting\u002F2.licensing-failures",{"title":124,"path":125,"stem":126,"children":127,"page":25},"Reference","\u002Freference","9.reference",[128,132],{"title":129,"path":130,"stem":131},"Helm values","\u002Freference\u002Fhelm-values","9.reference\u002F1.helm-values",{"title":133,"path":134,"stem":135},"Environment variables","\u002Freference\u002Fenvironment","9.reference\u002F2.environment",{"id":137,"title":120,"body":138,"description":1004,"extension":1005,"links":1006,"meta":1007,"navigation":533,"path":121,"seo":1008,"stem":122,"__hash__":1009},"docs\u002F6.troubleshooting\u002F2.licensing-failures.md",{"type":139,"value":140,"toc":998},"minimark",[141,145,149,184,187,195,214,219,234,239,245,252,312,318,328,334,409,412,418,425,429,440,445,451,454,460,463,468,473,596,607,610,616,626,630,646,650,656,661,664,682,690,736,739,745,748,755,761,764,768,780,815,820,826,829,835,844,849,908,913,918,970,980,994],[142,143,120],"h1",{"id":144},"licensing-failures",[146,147,148],"p",{},"Everything on this page is diagnosed from one log:",[150,151,156],"pre",{"className":152,"code":153,"language":154,"meta":155,"style":155},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","kubectl -n my-mvno logs deploy\u002Fmy-mvno-platform-license-agent --since=10m\n","bash","",[157,158,159],"code",{"__ignoreMap":155},[160,161,164,168,172,175,178,181],"span",{"class":162,"line":163},"line",1,[160,165,167],{"class":166},"sBMFI","kubectl",[160,169,171],{"class":170},"sfazB"," -n",[160,173,174],{"class":170}," my-mvno",[160,176,177],{"class":170}," logs",[160,179,180],{"class":170}," deploy\u002Fmy-mvno-platform-license-agent",[160,182,183],{"class":170}," --since=10m\n",[146,185,186],{},"The agent prints its current state on every pass through its loop, so the first line to look for is always the same one:",[150,188,193],{"className":189,"code":191,"language":192},[190],"language-text","level=INFO msg=\"agent: state\" state=licensed\n","text",[157,194,191],{"__ignoreMap":155},[146,196,197,198,201,202,205,206,209,210,213],{},"There are four states. ",[157,199,200],{},"licensed"," is healthy. ",[157,203,204],{},"unenrolled"," means it has no lease at all and is trying to get one. ",[157,207,208],{},"renew_failing"," means it holds a lease but cannot renew it. ",[157,211,212],{},"revoked"," means the parent has pulled the license. Each one maps to a section below.",[215,216,218],"h2",{"id":217},"the-activation-code-is-spent","The activation code is spent",[146,220,221,225,226,229,230,233],{},[222,223,224],"strong",{},"Symptom."," ",[157,227,228],{},"state=unenrolled",", and the API pod never leaves ",[157,231,232],{},"Init"," because nothing has written a lease for it.",[146,235,236],{},[222,237,238],{},"Log line.",[150,240,243],{"className":241,"code":242,"language":192},[190],"level=ERROR msg=\"agent: enroll failed\" err=\"activate: enrollment: activate 401: {\\\"error\\\":\\\"activation rejected: enrollment: activation code not found\\\"}\"\n",[157,244,242],{"__ignoreMap":155},[146,246,247,248,251],{},"The wrapping is always ",[157,249,250],{},"agent: enroll failed",". The part that tells you what happened is at the end. There are four:",[253,254,255,268],"table",{},[256,257,258],"thead",{},[259,260,261,265],"tr",{},[262,263,264],"th",{},"In the error",[262,266,267],{},"What it means",[269,270,271,282,292,302],"tbody",{},[259,272,273,279],{},[274,275,276],"td",{},[157,277,278],{},"enrollment: activation code not found",[274,280,281],{},"Wrong code, a typo, or a code minted against a different Hub",[259,283,284,289],{},[274,285,286],{},[157,287,288],{},"enrollment: activation code expired",[274,290,291],{},"Codes are short-lived (15 minutes by default) and this one aged out before the agent used it",[259,293,294,299],{},[274,295,296],{},[157,297,298],{},"enrollment: activation code superseded by a newer one",[274,300,301],{},"Somebody minted a second code for this deployment; only the newest one is valid",[259,303,304,309],{},[274,305,306],{},[157,307,308],{},"enrollment: activation code already used by a different key",[274,310,311],{},"The code was consumed under a signing key that no longer exists in your cluster",[146,313,314,317],{},[222,315,316],{},"Cause."," Activation codes are single-use and short-lived. The most common way to land here is minting a code, then spending twenty minutes fixing an unrelated install problem before the agent ever gets to use it.",[146,319,320,321,324,325,327],{},"The last row is different, and worth reading twice. It means this code was already spent successfully, but by a signing key that is no longer in your platform Secret. Usually that means the Secret was deleted and regenerated. The code cannot be replayed against a new key, by design: see ",[322,323,78],"a",{"href":79},". Restore the Secret from backup if you have one (",[322,326,99],{"href":100},"); otherwise mint a fresh code and enroll again.",[146,329,330,333],{},[222,331,332],{},"Fix."," Mint a new code from the Hub console and upgrade with it:",[150,335,337],{"className":152,"code":336,"language":154,"meta":155,"style":155},"helm upgrade my-mvno oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform \\\n  --version \u003Cversion> --namespace my-mvno -f my-values.yaml \\\n  --set activation.code=\u003Cnew-code>\n",[157,338,339,356,388],{"__ignoreMap":155},[160,340,341,344,347,349,352],{"class":162,"line":163},[160,342,343],{"class":166},"helm",[160,345,346],{"class":170}," upgrade",[160,348,174],{"class":170},[160,350,351],{"class":170}," oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform",[160,353,355],{"class":354},"sTEyZ"," \\\n",[160,357,359,362,366,369,372,375,378,380,383,386],{"class":162,"line":358},2,[160,360,361],{"class":170},"  --version",[160,363,365],{"class":364},"sMK4o"," \u003C",[160,367,368],{"class":170},"versio",[160,370,371],{"class":354},"n",[160,373,374],{"class":364},">",[160,376,377],{"class":170}," --namespace",[160,379,174],{"class":170},[160,381,382],{"class":170}," -f",[160,384,385],{"class":170}," my-values.yaml",[160,387,355],{"class":354},[160,389,391,394,397,400,403,406],{"class":162,"line":390},3,[160,392,393],{"class":170},"  --set",[160,395,396],{"class":170}," activation.code=",[160,398,399],{"class":364},"\u003C",[160,401,402],{"class":170},"new-cod",[160,404,405],{"class":354},"e",[160,407,408],{"class":364},">\n",[146,410,411],{},"The agent picks it up and enrolls. On success you get:",[150,413,416],{"className":414,"code":415,"language":192},[190],"level=INFO msg=\"activate: deployment licensed\" kind=mvno jti=...\n",[157,417,415],{"__ignoreMap":155},[146,419,420,421,424],{},"If instead you see ",[157,422,423],{},"activate: deployment already licensed, nothing to do",", the deployment already holds a lease and the code you passed was not needed. That is a no-op, not a failure.",[215,426,428],{"id":427},"the-agent-cannot-reach-the-parent","The agent cannot reach the parent",[146,430,431,225,433,435,436,439],{},[222,432,224],{},[157,434,228],{}," on a fresh install, or ",[157,437,438],{},"state=renew_failing"," on a running one, with a network error rather than a rejection.",[146,441,442,444],{},[222,443,238],{}," On enrollment:",[150,446,449],{"className":447,"code":448,"language":192},[190],"level=ERROR msg=\"agent: enroll failed\" err=\"activate: enrollment: POST https:\u002F\u002Fhub.solvegio.com\u002Fv1\u002Fdeployments\u002Factivate: dial tcp: i\u002Fo timeout\"\n",[157,450,448],{"__ignoreMap":155},[146,452,453],{},"On renewal:",[150,455,458],{"className":456,"code":457,"language":192},[190],"level=WARN msg=\"agent: renew attempt failed\" err=\"agent: renew request: ... no such host\"\n",[157,459,457],{"__ignoreMap":155},[146,461,462],{},"The distinguishing feature is that the error names the URL it was dialling and fails at the transport, before any HTTP status comes back.",[146,464,465,467],{},[222,466,316],{}," Egress from the namespace is blocked, the parent URL is wrong, or a proxy sits in the way.",[146,469,470,472],{},[222,471,332],{}," Check which URL you are actually pinned to, then check you can reach it from inside the cluster:",[150,474,476],{"className":152,"code":475,"language":154,"meta":155,"style":155},"kubectl -n my-mvno get secret my-mvno-platform-env \\\n  -o jsonpath='{.data.PARENT_BASE_URL}' | base64 -d; echo\n\nkubectl -n my-mvno run netcheck --rm -it --restart=Never --image=curlimages\u002Fcurl -- \\\n  curl -sS -o \u002Fdev\u002Fnull -w '%{http_code}\\n' https:\u002F\u002Fhub.solvegio.com\u002Fhealth\n",[157,477,478,497,529,535,567],{"__ignoreMap":155},[160,479,480,482,484,486,489,492,495],{"class":162,"line":163},[160,481,167],{"class":166},[160,483,171],{"class":170},[160,485,174],{"class":170},[160,487,488],{"class":170}," get",[160,490,491],{"class":170}," secret",[160,493,494],{"class":170}," my-mvno-platform-env",[160,496,355],{"class":354},[160,498,499,502,505,508,511,513,516,519,522,525],{"class":162,"line":358},[160,500,501],{"class":170},"  -o",[160,503,504],{"class":170}," jsonpath=",[160,506,507],{"class":364},"'",[160,509,510],{"class":170},"{.data.PARENT_BASE_URL}",[160,512,507],{"class":364},[160,514,515],{"class":364}," |",[160,517,518],{"class":166}," base64",[160,520,521],{"class":170}," -d",[160,523,524],{"class":364},";",[160,526,528],{"class":527},"s2Zo4"," echo\n",[160,530,531],{"class":162,"line":390},[160,532,534],{"emptyLinePlaceholder":533},true,"\n",[160,536,538,540,542,544,547,550,553,556,559,562,565],{"class":162,"line":537},4,[160,539,167],{"class":166},[160,541,171],{"class":170},[160,543,174],{"class":170},[160,545,546],{"class":170}," run",[160,548,549],{"class":170}," netcheck",[160,551,552],{"class":170}," --rm",[160,554,555],{"class":170}," -it",[160,557,558],{"class":170}," --restart=Never",[160,560,561],{"class":170}," --image=curlimages\u002Fcurl",[160,563,564],{"class":170}," --",[160,566,355],{"class":354},[160,568,570,573,576,579,582,585,588,591,593],{"class":162,"line":569},5,[160,571,572],{"class":170},"  curl",[160,574,575],{"class":170}," -sS",[160,577,578],{"class":170}," -o",[160,580,581],{"class":170}," \u002Fdev\u002Fnull",[160,583,584],{"class":170}," -w",[160,586,587],{"class":364}," '",[160,589,590],{"class":170},"%{http_code}\\n",[160,592,507],{"class":364},[160,594,595],{"class":170}," https:\u002F\u002Fhub.solvegio.com\u002Fhealth\n",[146,597,598,599,602,603,606],{},"If the URL is wrong, correct ",[157,600,601],{},"activation.parentUrl"," and upgrade. If the URL is right and ",[157,604,605],{},"curl"," cannot reach it, the problem is your egress policy or firewall, not the platform.",[146,608,609],{},"One related failure looks like a network problem but is not:",[150,611,614],{"className":612,"code":613,"language":192},[190],"enrollment: parent key fingerprint \"...\" not present in the parent JWKS: refusing to enroll against an unrecognized parent\n",[157,615,613],{"__ignoreMap":155},[146,617,618,619,622,623,625],{},"That means you reached ",[620,621,322],"em",{}," server, and it was not the one your activation code was minted against. Check ",[157,624,601],{}," for a typo. If the URL is definitely right, something is intercepting TLS between you and the parent, and the agent is refusing to hand over an enrollment to it. That refusal is the feature working.",[215,627,629],{"id":628},"renewals-come-back-401","Renewals come back 401",[146,631,632,634,635,637,638,641,642,645],{},[222,633,224],{}," The platform enrolled fine and is serving, but ",[157,636,438],{},", ",[157,639,640],{},"license_renew_failures_total"," is climbing and ",[157,643,644],{},"license_expiry_seconds"," is draining toward zero with no sawtooth.",[146,647,648],{},[222,649,238],{},[150,651,654],{"className":652,"code":653,"language":192},[190],"level=WARN msg=\"agent: renew attempt failed\" err=\"agent: renew status 401: {\\\"error\\\":\\\"renew: dpop: htu does not match request url\\\"}\"\n",[157,655,653],{"__ignoreMap":155},[146,657,658,660],{},[222,659,316],{}," Almost always: the Hub's public URL is not the URL you are dialling.",[146,662,663],{},"The agent proves it holds the lease's private key by signing a proof that is bound to the exact URL of the request. The Hub verifies that proof against its own configured public API URL. If the two strings differ in any way, the proof does not match and the Hub answers 401. Enrollment does not catch this, because it binds to the same URL you dialled, which is why a deployment can activate cleanly and only start failing at its first renewal, days later.",[146,665,666,667,670,671,674,675,678,679,681],{},"Things that differ enough to break it: dialling an IP or an internal DNS name instead of the public hostname; ",[157,668,669],{},"http"," where the Hub expects ",[157,672,673],{},"https","; a port in one and not the other; a trailing path segment. If you are self-hosting the parent MVNE, this also means the MVNE's own ",[157,676,677],{},"API_URL"," has to be its real public URL, not an in-cluster Service address. ",[322,680,82],{"href":83}," explains the binding.",[146,683,684,686,687,689],{},[222,685,332],{}," Set ",[157,688,601],{}," to exactly the parent's public API URL and upgrade. The agent's next renewal dials the corrected base.",[150,691,693],{"className":152,"code":692,"language":154,"meta":155,"style":155},"helm upgrade my-mvno oci:\u002F\u002Fghcr.io\u002Fsolvegio\u002Fcharts\u002Fplatform \\\n  --version \u003Cversion> --namespace my-mvno -f my-values.yaml \\\n  --set activation.parentUrl=https:\u002F\u002Fhub.solvegio.com\n",[157,694,695,707,729],{"__ignoreMap":155},[160,696,697,699,701,703,705],{"class":162,"line":163},[160,698,343],{"class":166},[160,700,346],{"class":170},[160,702,174],{"class":170},[160,704,351],{"class":170},[160,706,355],{"class":354},[160,708,709,711,713,715,717,719,721,723,725,727],{"class":162,"line":358},[160,710,361],{"class":170},[160,712,365],{"class":364},[160,714,368],{"class":170},[160,716,371],{"class":354},[160,718,374],{"class":364},[160,720,377],{"class":170},[160,722,174],{"class":170},[160,724,382],{"class":170},[160,726,385],{"class":170},[160,728,355],{"class":354},[160,730,731,733],{"class":162,"line":390},[160,732,393],{"class":170},[160,734,735],{"class":170}," activation.parentUrl=https:\u002F\u002Fhub.solvegio.com\n",[146,737,738],{},"Then watch the escalation lines. As the lease drains, the agent raises the severity of what it prints:",[150,740,743],{"className":741,"code":742,"language":192},[190],"level=WARN  msg=\"agent: renew failing, less than half the lease TTL remains\" remaining=...\nlevel=ERROR msg=\"agent: renew failing, lease nearing expiry\" remaining=...\n",[157,744,742],{"__ignoreMap":155},[146,746,747],{},"Once the lease expires, the platform fails closed. Fix a 401 while it is still a WARN.",[146,749,750,751,754],{},"Two other 401 bodies show up occasionally. ",[157,752,753],{},"renew: no confirmation key for lease"," means the parent's record of your lease has no key bound to it, which is a parent-side problem to raise with us. And this one is not an error at all:",[150,756,759],{"className":757,"code":758,"language":192},[190],"level=ERROR msg=\"agent: hub did not rotate cnf to the presented key; declining rotation, keeping current key\" lease_jti=... presented_jkt=...\n",[157,760,758],{"__ignoreMap":155},[146,762,763],{},"The parent is on a build that does not rotate keys. Your lease still renewed and your platform keeps serving. The agent correctly kept the key the parent still recognises.",[215,765,767],{"id":766},"the-deployment-has-parked-itself","The deployment has parked itself",[146,769,770,225,772,775,776,779],{},[222,771,224],{},[157,773,774],{},"\u002Fhealth"," is green, but every business route answers ",[157,777,778],{},"424 Failed Dependency"," with:",[150,781,785],{"className":782,"code":783,"language":784,"meta":155,"style":155},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\"error\": \"parent lease revoked\"}\n","json",[157,786,787],{"__ignoreMap":155},[160,788,789,792,795,799,801,804,807,810,812],{"class":162,"line":163},[160,790,791],{"class":364},"{",[160,793,794],{"class":364},"\"",[160,796,798],{"class":797},"spNyl","error",[160,800,794],{"class":364},[160,802,803],{"class":364},":",[160,805,806],{"class":364}," \"",[160,808,809],{"class":170},"parent lease revoked",[160,811,794],{"class":364},[160,813,814],{"class":364},"}\n",[146,816,817,819],{},[222,818,238],{}," In the agent, once:",[150,821,824],{"className":822,"code":823,"language":192},[190],"level=WARN msg=\"agent: lease revoked by parent, stopping renewals\"\n",[157,825,823],{"__ignoreMap":155},[146,827,828],{},"and then, every thirty seconds:",[150,830,833],{"className":831,"code":832,"language":192},[190],"level=INFO msg=\"agent: state\" state=revoked\n",[157,834,832],{"__ignoreMap":155},[146,836,837,839,840,843],{},[222,838,316],{}," The parent revoked this deployment's license. Nothing was pushed into your cluster to make that happen: the agent found out on its own, when its next renewal came back ",[157,841,842],{},"410",", or when the platform's heartbeat was told so. The platform then parked itself. It is quiesced, not torn down. No data has been touched and the process has not restarted.",[146,845,846],{},[222,847,848],{},"Check.",[150,850,852],{"className":152,"code":851,"language":154,"meta":155,"style":155},"kubectl -n my-mvno logs deploy\u002Fmy-mvno-platform-license-agent --since=30m\nkubectl -n my-mvno get secret my-mvno-platform-env \\\n  -o jsonpath='{.data.LEASE_STATUS}' | base64 -d; echo\n",[157,853,854,869,885],{"__ignoreMap":155},[160,855,856,858,860,862,864,866],{"class":162,"line":163},[160,857,167],{"class":166},[160,859,171],{"class":170},[160,861,174],{"class":170},[160,863,177],{"class":170},[160,865,180],{"class":170},[160,867,868],{"class":170}," --since=30m\n",[160,870,871,873,875,877,879,881,883],{"class":162,"line":358},[160,872,167],{"class":166},[160,874,171],{"class":170},[160,876,174],{"class":170},[160,878,488],{"class":170},[160,880,491],{"class":170},[160,882,494],{"class":170},[160,884,355],{"class":354},[160,886,887,889,891,893,896,898,900,902,904,906],{"class":162,"line":390},[160,888,501],{"class":170},[160,890,504],{"class":170},[160,892,507],{"class":364},[160,894,895],{"class":170},"{.data.LEASE_STATUS}",[160,897,507],{"class":364},[160,899,515],{"class":364},[160,901,518],{"class":166},[160,903,521],{"class":170},[160,905,524],{"class":364},[160,907,528],{"class":527},[146,909,910,912],{},[157,911,212],{}," confirms it.",[146,914,915,917],{},[222,916,332],{}," Talk to whoever revoked it first, because they revoked it for a reason. The technical recovery is one step: mint a fresh activation code from the parent's console and upgrade with it.",[150,919,920],{"className":152,"code":336,"language":154,"meta":155,"style":155},[157,921,922,934,956],{"__ignoreMap":155},[160,923,924,926,928,930,932],{"class":162,"line":163},[160,925,343],{"class":166},[160,927,346],{"class":170},[160,929,174],{"class":170},[160,931,351],{"class":170},[160,933,355],{"class":354},[160,935,936,938,940,942,944,946,948,950,952,954],{"class":162,"line":358},[160,937,361],{"class":170},[160,939,365],{"class":364},[160,941,368],{"class":170},[160,943,371],{"class":354},[160,945,374],{"class":364},[160,947,377],{"class":170},[160,949,174],{"class":170},[160,951,382],{"class":170},[160,953,385],{"class":170},[160,955,355],{"class":354},[160,957,958,960,962,964,966,968],{"class":162,"line":390},[160,959,393],{"class":170},[160,961,396],{"class":170},[160,963,399],{"class":364},[160,965,402],{"class":170},[160,967,405],{"class":354},[160,969,408],{"class":364},[146,971,972,973,976,977,979],{},"The parked agent re-reads the Secret's activation code every thirty seconds and re-enrolls the moment it sees one it has not already spent. There is no pod to restart, no flag to set and no job to delete. Your signing key is reused; only the lease is minted again. Within a minute you should see ",[157,974,975],{},"activate: deployment licensed"," and the API, which reloads the lease from its mounted file without restarting, starts serving again. ",[322,978,86],{"href":87}," walks through the whole cycle.",[146,981,982,983,986,987,989,990,993],{},"Two related 424s are not revocations, and the message tells you which you have. ",[157,984,985],{},"parent lease not loaded"," means no lease has ever been written, so you are on the install path: see ",[322,988,116],{"href":117},". ",[157,991,992],{},"parent lease expired"," means the agent held a lease and could not renew it in time, which is the end state of the 401 and unreachable-parent sections above.",[995,996,997],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}",{"title":155,"searchDepth":163,"depth":358,"links":999},[1000,1001,1002,1003],{"id":217,"depth":358,"text":218},{"id":427,"depth":358,"text":428},{"id":628,"depth":358,"text":629},{"id":766,"depth":358,"text":767},"Spent activation codes, an unreachable parent, 401s on renewal, and a platform that has parked itself.","md",null,{},{"title":120,"description":1004},"xRL4_8JSgnj5RT1F41byM5xQpTEExgzViWry1fmE6ao",[1011,1013],{"title":116,"path":117,"stem":118,"description":1012,"children":-1},"Pods that will not pull, an API that never goes ready, an Ingress with no address, and certificates that never issue.",{"title":129,"path":130,"stem":131,"description":1014,"children":-1},"Every value the platform chart accepts, its default, and what it does.",1783967741116]