34 lines
2.4 KiB
Markdown
34 lines
2.4 KiB
Markdown
# mesh-provisioner
|
|
|
|
Holds the `mesh-provisioner` seat once for the mesh: the provisioner's server (novox/hq ADR 0349 clause 3, design 57
|
|
P4). Go, one binary (`cmd/mesh-provisioner`), served by a runtime of its own on its own bus account (`runs-as`), so
|
|
that its account alone writes the registry. The provisioner client on each node (`node-provisioner`, design 57 P5)
|
|
is the module `mesh-provisioner-client`.
|
|
|
|
## What it keeps
|
|
|
|
- `mesh-provisioner_registry`: which domain answers which kind of placeholder, keyed by the kind (`config`,
|
|
`secret`, `bound` — the provider's own bucket, `<provider-module>_bound`, keyed
|
|
`<node>.<module>.<provision>[.<local>]` (mesh-sdk `go/provider`) — `consumers` — a provider's consumers'
|
|
credentials, asked of the vault by the provider machine's client (novox/hq ADR 0373) — `collected` — and `shell`, `environment` and `contribution`, read as collections of the same
|
|
name (design 57 L1) — and the placement namespaces `dir`, `access`, `port`, `seat`, `machine`). Each
|
|
answer names the owning module and where a client finds the values: a domain's bucket and its key shape
|
|
(placement's is the controller's assignments mirror, whose value carries the provisioner's plan of a module handed
|
|
to it), or a seat's verb asked on request and reply (a secret is never in a bucket). Compiled in
|
|
`registry.go`, written at start and every hour, only where it differs; a kind no domain answers is deleted.
|
|
- `mesh-provisioner_needs`: what each module on each node needs, `<node>.<module>.<kind>.<name>`.
|
|
- `mesh-provisioner_applied`: what is applied where, `<node>.<module>`.
|
|
- `mesh-provisioner_collect`: the items of every collection, `<node>.<collection>.<contributor>`, the collection
|
|
with a character a key's token cannot hold written `=<hex>` (`shell=3Azsh=3Anormal` is `shell:zsh:normal`), and
|
|
read back by its name.
|
|
|
|
The last three are written by each node's provisioner client for its own node's keys alone: the controller grants
|
|
the client `<node>.>` of each and nothing wider (mesh-controller `internal/broker/provisioner.go`), and a provider
|
|
reads the needs without writing them. This module writes only the registry.
|
|
|
|
## The verb
|
|
|
|
`mesh-provisioner.provisioning` with `what` `registry` (the default), `needs`, `applied` or `collect`, narrowed by
|
|
`node` and `module` (for `collect`, the contributor) and, for `collect`, `collection`. Reads only. A key out of its
|
|
bucket's shape is said in the answer, never dropped quietly.
|