Module managed 

The machine’s managed configuration (leanctx.managed-config/v1).

An organisation preconfigures a machine through MDM. The carrier IO lives in lean_ctx_fs::managed and the schema in lean_ctx_protocol::hive::managed; this facade joins them, and holds the three decisions that need engine types:

• Managed::apply_to_hive: the managed hive.url, hive.root_key and telemetry.* overlay [hive] on every Config load. The overlay is never written back: config set and Config::update_global read the user’s file, not the loaded value.
• refusal_for_key: config set of a managed key is refused.
• require_gate: with hive.require, every tool refuses until the machine is signed in (a live lease) and a Hive policy floor is installed.

A carrier that exists but cannot be read or parsed fails closed: Hive calls refuse, hive.* settings refuse, and so does every tool (a broken carrier may have been the one that set hive.require).

Structs

Managed

A managed configuration found on this machine.

Functions

current

This machine’s managed configuration, re-read every few seconds.

refusal_for_key

config set refusal for key under this machine’s managed configuration.

register_signed_in_probe

Register the connector’s sign-in probe (the first registration wins). Without one, hive.require refuses every tool.

require_gate

The hive.require gate: Err (every tool refuses) while a managed configuration requires a sign-in and there is no live lease or no installed policy floor, or while the carrier is refused.

Type Aliases

SignedInProbe

Whether this machine is signed in to its Hive with a live lease.