VeilNet

Realm Control

Move running machines between compartments, set the networks a router serves, and review blocks and control activity, from the console or from conflux.

Who
Admins move and block. Managers set networks. Auditors read the record
Where
Console → a machine's panel, and its realm's page

Acting Through the Admin Node

The console acts on a running machine through the admin node of the machine's realm. The admin node, also called the root node, is the guardian's own anchor in that realm, and it runs inside the guardian stack.

A power is the right to issue one kind of control in a realm, such as a block. Your machines hold no powers. Between actions, the admin node holds only the telemetry power.

When you take an action, the admin node is lent the one power that the action needs: block, taint or subnets. It holds that power for ten minutes at most, and a realm handles one action at a time. The result stays in force after the power has gone.

Fig. 01 — A power lent per action
Standing credentialTELEMETRY ONLYLent for one action+ BLOCKThe blockIN THE REALMTELEMETRY · RENEWED DAILYBLOCKAT MOST TEN MINUTESIN FORCE ON EVERY MEMBERBLOCK CLICKEDSTANDING CREDENTIAL BACK

Between actions, the admin node holds only the telemetry power. For one block, it is lent the block power as well, for ten minutes at most. When the action is done, it goes back to telemetry only, whether or not the action worked. The block stays in force after the power has gone.

ActionWhereWho
Block and unblockA machine's panel, or Revoke → Also block it nowAdmin
CompartmentsA machine's panelAdmin
NetworksA machine's panelManager, admin
Blocks in forceA realm's pageEvery role
Control activityA realm's pageAuditor and above

The guardian refuses an action, before anything is signed, in any of these cases:

  • Console control is off.
  • Your realm credential withholds the power.
  • The realm's admin node is not running.

To see which powers your credential grants, open Settings → Realm control.

Guardian console — Realm controlIllustrative

Moving Between Compartments

A machine's taints are its compartment labels. They decide which machines in its realm it can exchange data with. You set the taints when you commission the machine. Later, an admin can move a running machine to other compartments without a restart or a new identity.

0 of 3 done

  1. Open the machine's panel and choose Compartments. The dialog shows the machine's current compartments and the ones it was commissioned into. If the machine has moved before, the dialog also shows when, and the generation, which is the sequence number of the move.

Setting the Networks Served

A subnet router forwards traffic from the members of its realm onto the networks it is connected to. A manager or an admin can read and replace the list of networks it serves from the console.

0 of 3 done

  1. Open the machine's panel and choose Networks. The console asks the machine itself, through its realm's admin node, so the machine must be online. The dialog shows the following:

    • What the machine serves now.
    • Any entries it withholds, because it was on none of those networks when it started.
    • Where the list came from: the machine's own configuration, this console or an operator's CLI.

Blocks in Force

Every realm's page has a Blocks card that every role can read. It lists the blocks that the realm's admin node holds, with the machine, the reason, and the start and end of each block. The card refreshes every 15 seconds.

The card also lists blocks issued from conflux. A block on an anchor that the guardian did not commission shows that anchor's AnchorID instead of a name.

Guardian console — BlocksIllustrative

With console control on, an admin can lift a block from the card with Unblock. If the realm's admin node is not running, the card says so instead of showing the list. To block and unblock machines, see Revocation and Blocks.

Control Activity

The guardian records every action an operator takes on a realm's machines, whatever the outcome. Each entry shows who took the action, on which machine, from which address and with what result. Auditors and above can read the record at the foot of the realm's page, under Control activity, newest first.

Guardian console — Control activityIllustrative

Each kind of action keeps its own detail:

ActionThe detail it keeps
blockedThe reason, and how many members it reached
unblockedHow many members it reached
moved the compartments ofHow many compartments and the generation, but never their names
set the networks served byWhat the machine serves, with any compartment bindings reduced to how many
issued a control credentialWhich powers, for which anchor and for how many hours, but never the credential

Each row ends with done, refused or failed. A refused or failed row gives the reason in the words of the anchor that refused, so a refused block reads the same here as it did in the dialog.

Acting from the CLI

Console control is a deployment setting, and it is on by default. Turn it off if your organisation wants every block, compartment move and change of networks made from conflux. Operators then act with a control credential: a conflux manifest that carries the powers for the job and lasts a day at most.

0 of 5 done

  1. On the guardian host, set the value in secrets/.env and run setup again:

    on the guardian host
    GUARDIAN_CONSOLE_CONTROL=off

$ ./setup.sh

    Setup recreates the guardian's API with the new value, and the admin nodes start again with it.

    From then on, no admin node is lent a power that acts on members. The console still shows the blocks in force, the realm of each machine and the telemetry. Block, Unblock, Compartments, Networks and Also block it now no longer appear. Instead, a machine's panel says where to act from.

    Guardian console — Machine panel, control offIllustrative