Nodes
The Nodes page (/hosts, /nodes leads there too) lists in one view every machine of the cluster run by the
Navin agent, wherever it is: physical server, virtual machine on premises, private cloud, datacenter or public cloud
(AWS, Azure, Google Cloud, OVHcloud...). It needs cluster:read; adding and editing nodes needs hosts:manage.
What the screen shows
One list: node, state (registering, healthy, unhealthy, lost, maintenance, decommissioned) and trust of
its agent (Quarantined, Revoked), installed services, CPU, memory, disk, network, operating system, GPU.
View details adds the platform, the agent version, the last heartbeat, the identity (certificate, SPIFFE id,
rotation due) and who runs the machine (platform or client).
The detail of a node (/hosts/<id>) shows its facts (system, CPU, memory, disks, GPU, platform), its metrics, its
Preflight checks and its components.
Add nodes
Add nodes opens one screen with four methods. They all install the same agent and systemd unit and register the node the same way; the agent checks the fingerprint of the Manager CA before it registers.
| Method | For | What the console gives |
|---|---|---|
| Command to paste | physical server, VM, private cloud, datacenter | one command to paste in a terminal of the machine (account with sudo): downloads the agent from the Manager, checks its SHA-256, installs it (dnf, apt, pacman or archive), registers the node and starts the agent |
| SSH from the Manager | machines reachable over SSH, directly or through a bastion | the Manager connects with an Ed25519 key (RSA when the SSH policy of the cluster allows it, a key with a passphrase is accepted) or an OpenSSH certificate of an approved authority, checks the identity of every machine (SHA256 fingerprint or public key, or a host authority), then runs the same install (operation host.ssh_bootstrap) |
| Cloud instance | AWS, Azure, Google Cloud, OVHcloud, OpenStack, Scaleway, Oracle, Outscale, private cloud with cloud-init | the script to give as user data (or startup script), where it goes in the console of the cloud and the command line; the instance registers at its first boot, without SSH |
| Image or automation | Ansible, Terraform, golden image, Puppet, Chef, Salt | the Ansible command, the Terraform lines and the enroll.env file to drop into the image |
The three token methods share one access (a bootstrap token limited in time and uses), shown once; Active accesses
lists and revokes them. The script does nothing on a machine already registered (it can run at every boot), skips the
agent install when the agent is there, and runs nothing when it is truncated. When the console has its own
certificate, it is written to /etc/navin-manager-agent/manager-tls.pem and given to nm-agent register --ca-file.
The corporate proxy of Settings is applied to dnf, apt-get and pacman.
Security of the SSH method: never a password or the root account, never a host key learnt on the fly
(StrictHostKeyChecking=yes), every bastion checked the same way, the private key and the token kept in memory for
the operation only, the script sent on the standard input (the token is on no command line), the logs redacted. The
account needs sudo without a password (sudo_password_required otherwise).
Actions
| Button | Effect | Permission |
|---|---|---|
| Add nodes | the four methods above | hosts:manage |
| Quarantine, Recover, Revoke (row menu) | trust of the agent: quarantine blocks tasks and commands, revocation every call | hosts:manage |
| Update agent (row menu) | signed agent.update command for the signed binary of the mirror | hosts:manage |
| Break glass (row menu) | emergency SSH certificate, two other approvers | hosts:manage |
| Refresh facts | operation host.facts (task facts.collect) | hosts:manage |
| Preflight checks | operation host.preflight | hosts:manage |
| Start, Stop, Restart a component | operation service.action on this node | services:operate |
| New value of a node parameter | operation host.parameters | hosts:manage |
| Decommission | operation host.decommission; refused while components remain | hosts:manage |
| Remove node | removes the node from the inventory | hosts:manage |
A node run by the client offers neither update nor break glass.
Common tasks
- Add a machine on premises. Add nodes > Command to paste > Create the access, copy the command, paste it on the machine (see Install the Navin agent). The node appears with its preflight checks.
- Add AWS, Azure or Google Cloud instances. Cloud instance, choose the cloud, download
navin-user-data.shand give it as user data when you create the instances. - Remove a node. Remove its components in Services, then Decommission.