Skip to content

Bootstrap Workload Not Suspended

URI: https://docs.ankatech.co/errors/bootstrap-workload-not-suspended
HTTP Status: 409 Conflict

When you see this

The environment host asked to recover the platform automation workload (envctl.sh <env> workload-recovery), and the platform workload that envctl.sh <env> workload-bootstrap registered is not SUSPENDED. The recovery acts only on a SUSPENDED workload, so nothing was changed: no key was registered or revoked, no federated issuer binding was removed, and the key file on the host is left as it was. The refusal is recorded in the audit trail as DENIED. See Administrative Workload Identity*.

Common Causes

  • The workload is ACTIVE. There is nothing to recover: it still signs in with its current key, and its keys are managed with the platform workload credential operations.
  • The workload was revoked. Revocation is terminal, so a REVOKED workload stays revoked.
  • No workload was ever registered by the workload bootstrap on this environment. A platform workload a platform administrator registered in the console is never recovered by the host.

Response Example

{
  "type": "https://docs.ankatech.co/errors/bootstrap-workload-not-suspended",
  "title": "Bootstrap Workload Not Suspended",
  "status": 409,
  "detail": "The platform workload the workload bootstrap registered is ACTIVE, so there is nothing to recover. Its keys are managed with the platform workload credential operations. Nothing was changed.",
  "instance": "/api/v3/admin/platform/setup/workload-recovery",
  "timestamp": 1792236600,
  "extensions": {
    "requestId": "9c41e7a2-5b08-4d3f-a6e1-2f7c90b4d815"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The detail names which of the two cases applies: the workload is ACTIVE, or no workload registered by the workload bootstrap is SUSPENDED.

How to Resolve

  1. If the workload is ACTIVE, no action is needed. To replace its key, register a new key on it and revoke the old one from the console's platform workload screen.
  2. If the workload is REVOKED or was never registered, register a new one from the environment host with sudo envctl.sh <env> workload-bootstrap.
  3. envctl.sh discarded the key it generated for the refused run; no cleanup is needed on the host.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.

* restricted content — see higher-tier documentation