6f52bb46cd
Source commit: a43e907efd9d1561c23fe73499478e881f868355 Public tree identity: sha256:453dea30195485dd8939f575a69b39f4bb7acd84c4df23f8aa29b55d044f2673
53 lines
1.8 KiB
Markdown
53 lines
1.8 KiB
Markdown
# Nodes
|
|
|
|
Your node runs real commands and retains real output bytes. Enroll it once, then
|
|
restart it with the same public-key identity.
|
|
|
|
## Enroll
|
|
|
|
~~~bash
|
|
clusterflux node enroll --project-id my-project --json
|
|
clusterflux node attach --project-id my-project --node workstation --enrollment-grant "$ENROLLMENT_GRANT" --public-key "$NODE_PUBLIC_KEY"
|
|
~~~
|
|
|
|
Treat the enrollment grant as a short-lived secret. It is exchanged once and is
|
|
not a worker credential.
|
|
|
|
## Run the worker
|
|
|
|
~~~bash
|
|
CLUSTERFLUX_NODE_PRIVATE_KEY="$NODE_PRIVATE_KEY" clusterflux-node --coordinator https://clusterflux.michelpaulissen.com --tenant "$TENANT" --project-id my-project --node workstation --public-key "$NODE_PUBLIC_KEY" --project-root "$PWD" --worker --emit-ready
|
|
~~~
|
|
|
|
Start the worker from the project directory when tasks need a local checkout.
|
|
The worker reports detected command, container, source, VFS, environment, OS,
|
|
and architecture capabilities. Use "clusterflux node attach --cap <capability>"
|
|
only when detection needs an explicit override.
|
|
|
|
## Liveness
|
|
|
|
~~~bash
|
|
clusterflux node list
|
|
clusterflux node status workstation
|
|
~~~
|
|
|
|
The coordinator marks a node stale after its accepted heartbeat age exceeds the
|
|
configured threshold. Stale nodes are excluded before placement and before a
|
|
retained-node download link is created.
|
|
|
|
## Local source
|
|
|
|
A bind-mounted local checkout is fast and avoids transferring the repository,
|
|
but it is non-hermetic: uncommitted changes, ignored files, and concurrent
|
|
editor writes can affect the command. Use a content-addressed source snapshot
|
|
when reproducibility matters.
|
|
|
|
## Revoke
|
|
|
|
~~~bash
|
|
clusterflux node revoke workstation
|
|
~~~
|
|
|
|
Revocation removes the node identity and its live descriptor. Subsequent signed
|
|
requests fail. Artifacts retained only by that node become unavailable unless
|
|
you explicitly synchronized them elsewhere.
|