Module fleet 

Fleet config pull: signed configs from HTTPS, S3 or git (18.23.0). Fleet config pull (18.23.0, #80): many instances, one source of truth.

With [fleet] source set, rws fetches its config file from an HTTPS URL, an S3 object or a git repository every interval_secs, checks its Ed25519 signature (<source>.sig) against public_key, validates it like rws --check, writes it over the local config file and reloads. A config that fails any step is refused and the running one stays; report_url gets each outcome. {node} in the source is the node name ([cluster] node, else the host name), so each instance can have its own file.

The fleet config is the declared layer; runtime changes made through the admin API (crate::cluster) are the live one.

rws fleet keygen makes a key pair; rws fleet sign <file> --key <key> writes <file>.sig.

Structs

Fleet

The puller: fetch, verify, check, write, reload, report.

FleetConfig

[fleet] settings.

Enums

Fetched

What a fetch brought.

Outcome

One round’s outcome.

Source

Where the config comes from.

Constants

RWS_CONFIG_FLEET_INSECURE

RWS_CONFIG_FLEET_INTERVAL_SECS

RWS_CONFIG_FLEET_PUBLIC_KEY

RWS_CONFIG_FLEET_REPORT_URL

RWS_CONFIG_FLEET_S3_ENDPOINT

RWS_CONFIG_FLEET_SOURCE

SIG_PREFIX

The signature file rws fleet sign writes (18.24.0): one line, rws-fleet-sig v2 <serial> <base64 signature>, the signature over signed_message. The serial only grows: an instance refuses a config whose serial isn’t above the one it applied, so an older signed file can’t roll it back.

Functions

command

rws fleet keygen [<prefix>] / rws fleet sign <file> --key <file>: Some(exit code) when args (a full argv) asks for one.

parse_signature

A parsed signature file: the serial (0 for the 18.23 format, which signed the body alone) and the signature bytes.

read_public_key

A public key: base64 of the 32 raw bytes, inline or in a file.

signed_message

What a v2 signature covers: a domain tag, the serial, then the file.

start_from_env

The binary’s entry point: with [fleet] source, pull on a thread.

status_json

The fleet status for the admin API, or None without [fleet].

verify

Check body against a signature file with public_key; the serial it carries (0 for an 18.23-format file).