usage: claim.sh --code <code> --edge <url> --station <name> \
[--namespace <ns>] [--rotate] [--print-once]
required
--code the six digits read to you on the call. Written 123 456 and
typed either way: --code 123456, or --code '123 456' in quotes
--edge the channel's claim endpoint, e.g. https://channel.example/claim
--station your station name, from your onboarding pack
writing the Secret (the normal path)
--namespace namespace to write the Secret into. Required unless --print-once
--secret-name Secret to write (default: vexa-station-credential, the name the
station bundle expects; keys username/password)
--rotate overwrite a Secret that already exists. Without it an existing
Secret is a refusal, because replacing a working credential by
accident is indistinguishable from a rotation until the next pull
--kubeconfig kubeconfig path (default: ambient)
the mirror path
--print-once print the credential to stdout instead of writing a Secret, for
pasting into a registry mirror's endpoint configuration (Harbor,
Artifactory, ECR) that has no way to read a Kubernetes Secret.
It is the ONE path here that puts the value on your screen: the
code is spent either way, so the value is now yours to keep or
lose. Never both --print-once and --namespace
other
--dry-run print what would happen; contact nothing, write nothing
exit codes
0 claimed — the credential is in the cluster (or on your screen, --print-once)
1 THE EDGE REFUSED THIS CLAIM. Something answered and said no: the code is
wrong, expired, already used, burned by failed attempts, or bound to
another station. Ask for a new code
2 usage
3 NO CLAIM SERVICE ANSWERED AT --edge. Nothing was reached, or something
that is not the claim service answered. Your code is untouched and still
good — check the URL and your egress, then run this again