{
  "slug": "gcloud-privateca-subordinates-activate-supports-first-party-activation-d74e3bcbea1f",
  "title": "gcloud privateca subordinates activate supports first-party activation",
  "tools": [
    "gcloud"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-08-11T00:00:00.000Z",
  "announced_at": "2026-08-11T00:00:00.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When a subordinate CA already exists and is awaiting activation, activate it with `gcloud privateca subordinates activate` and the issuer pool, location, and CA flags.",
    "examples": [
      "gcloud privateca subordinates activate <subordinate-ca> --location=<subordinate-location> --pool=<subordinate-pool> --issuer-pool=<issuer-pool> --issuer-location=<issuer-location> --issuer-ca=<issuer-ca>"
    ],
    "gotchas": [
      "CERTIFICATE_AUTHORITY (required): ID or fully qualified identifier of the subordinate CA to activate.",
      "--location (required): Subordinate CA location; can be supplied through a fully qualified CA name or the `privateca/location` property.",
      "--pool (required): Parent CA pool of the subordinate CA; can be supplied through a fully qualified CA name.",
      "--issuer-pool (required): ID or fully qualified identifier of the issuing CA pool when using issuer flags.",
      "--issuer-location (required): Location of the issuing CA; can be supplied through a fully qualified issuer pool name or `privateca/location`.",
      "--issuer-ca: ID of the issuing CA. If omitted, an available enabled CA in the issuing pool is chosen.",
      "--pem-chain: File of PEM certificates from the current CA certificate through the root CA certificate. This is an alternative activation method to issuer flags; the docs specify exactly one of `--pem-chain` or issuer-based activation.",
      "Prerequisite: The subordinate CA must already be created and awaiting activation.",
      "The activation suggestion applies when create with issuer flags fails due to an already existing subordinate CA."
    ]
  },
  "why_it_matters": "Activate a subordinate CA that already exists or needs first-party activation.",
  "sources": [
    "https://docs.cloud.google.com/sdk/docs/release-notes#58000_2026-08-11",
    "https://docs.cloud.google.com/sdk/gcloud/reference/privateca/subordinates/activate"
  ],
  "rank": 0.91015,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v1+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "cloud-20261008",
    "verdict_id": "cloud-20261008:cloud-20261008-1b3c63b953a140ee-0:gate",
    "evidence_hash": "201f3ad00ec0bdb5f6486b9f16ef37e47a8ca605cf9720ed6de0b662bdd79129"
  },
  "review": {
    "draft_hash": "ef62c20ccbd4bca3e8c4fd94475946788eff87d6e56aedf2b536a6eb6e84e835",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "cloud-20261008:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.91 >= 0.9; 2 needed) and Jev gave 0.66 (>= 0.6 needed)."
  }
}