Struct Enrollment 

pub struct Enrollment {
    pub base: Option<String>,
    pub fleet: FleetSpec,
    pub principal: Vec<PrincipalSpec>,
}

The enrollment file zenctl acl gen --enrollment reads (#392).

One [[principal]] per transport identity, each bound to a role and — for a host — to the origin it may act as (RFC 03 §4 D6: without this binding, D6 is a hygiene boundary, not a security one). Everything the router needs beyond that is derived.

base = "zensight"                      # optional; default = --base / context / ""

[fleet]
catalog_adv = true                     # the catalog runs the advanced tier:
                                       # spell @catalog/**/@adv/** explicitly
salt = "zensight-host-id-v1"           # the app's RFC 06 §1 origin salt —
                                       # needed only where a host gives machine_id

[[principal]]
cn = "h-3fa9c2d41b7e"                  # the mTLS certificate CN
role = "host"                          # host | catalog | console | desired-author | watch
origin = "h-3fa9c2d41b7e"              # or machine_id = "<32 hex>" (+ fleet.salt);
                                       # both given must agree, or the principal is refused
adv = true                             # uses the @adv sidecars (RFC 04 §3.3)
blob_seed = true                       # seeds the router @blob store (RFC 07 §2)
media = true                           # publishes @media streams (RFC 07 §1)

[[principal]]
cn = "zensight-catalog"
role = "catalog"                       # origin defaults to @catalog

[[principal]]
cn = "zensight-console"
role = "console"
adv = true
remote_actions = false                 # true drops the no-remote-actions deny

[[principal]]
cn = "zensight-desired"
role = "desired-author"
origin = "@desired"                    # its own service origin (RFC 07 §3)

[[principal]]
cn = "zensight-watch"
role = "watch"                         # read-only: data classes, catalog, RPC reads

A zid = "…" in place of cn is accepted only under --allow-zid-subjects: zenoh’s own config says a ZID “is not backed by an authentication mechanism … can be useful for prototyping but should not be used in production” (zenoh-1.10.0/DEFAULT_CONFIG.json5).

Fields

base: Option<String>

The deployment base (RFC 03 §1.1). None = take the observer’s resolved --base, the empty base being the bus-root deployment.

fleet: FleetSpec

principal: Vec<PrincipalSpec>

Trait Implementations

impl Clone for Enrollment

fn clone(&self) -> Enrollment

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Enrollment

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Enrollment

fn default() -> Enrollment

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Enrollment

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.