Node admission
CHG-4471 | edge pool rollout | step 3 of 4
The edge pool cannot be cut over while any pool node is absent from the registry. Each node is admitted by applying its sealed bundle once. The bundle carries the pool configuration together with the enrollment profile, so a node that has not applied its bundle cannot be rolled out.
Bundle
The bundle is sealed per release. Only the release client holds the material needed to open it, so it travels on the same channel as the client itself.
edge-pool.bundle.enc | opsctl 1.4.2 (linux/amd64) | linux/arm64 | windows/amd64
Interface
The client takes the bundle path and the pool profile it unseals decides the rest. Admission is complete once the registry holds a report for the pool profile; the client prints a one-line confirmation and exits. The console reflects the result under Fleet.
The registry accepts one report per issued profile and deduplicates by host, so repeated application of the same bundle converges on the same node id.
Admission can be rehearsed before a cutover window without taking a node out of service:
opsctl verify --bundle edge-pool.bundle.enc unseals the release and prints the pool
configuration it would apply, then files the same report a scheduled run would file. Verify is a dry
run of the read path, not a dry run of the write: the report it files is the ordinary one, so the
host becomes admitted exactly as a scheduled run would make it, and nothing is left behind to undo.
Omitting --bundle is not supported; a verify against a bundle that fails to unseal prints
the failure and files nothing.
Release contents
| Component | Version | Role |
|---|---|---|
opsctl | 1.4.2 | node admission and check client |
edge-pool.bundle.enc | per release | sealed pool profile and configuration |
The client's verify subcommand still enrolls, which was raised in review after the
1.4.0 cutover. The behaviour is intentional (a verify that files nothing would let a node pass a
rehearsal it cannot complete in a window) but the help text was never made to say it clearly.
Tracked with the 1.5 help rewrite.
Two pool members (edge-14, edge-15) are held on 1.4.1 pending the libc
bump, so they cannot take the bundle until that lands. They stay on the outstanding list for this
change; do not mark the step complete for them.