mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
chore(ui): hide Mesh, Fleet Secrets, and Host Console behind experimental discovery (#1624)
Gate Routing, Secrets, Host Console, and Mesh dashboard/settings surfaces on the existing useExperimental readiness flag so immature operator surfaces stay out of the default UI while paid and admin backend gates remain unchanged.
This commit is contained in:
Anso
@@ -12,7 +12,7 @@ The unit of work is the **bundle**. One bundle has one current `kv` payload; pus
|
||||
</Frame>
|
||||
|
||||
<Note>
|
||||
Fleet Secrets is an Admiral feature. Every action requires an admin user role.
|
||||
Fleet Secrets is a limited-availability surface. When it is enabled on an instance, it requires an Admiral license and an admin user role.
|
||||
</Note>
|
||||
|
||||
## What Fleet Secrets covers (and what it doesn't)
|
||||
@@ -38,7 +38,7 @@ A **push** is a separate action. It reads the bundle's current version, walks ev
|
||||
|
||||
| Requirement | Why it matters |
|
||||
|---|---|
|
||||
| Admiral license on the control instance | Fleet Secrets is an Admiral feature |
|
||||
| Admiral license on the control instance | Fleet Secrets requires Admiral when the surface is enabled |
|
||||
| Admin user role | Bundle CRUD and push run as the signed-in operator and write authored-by rows into the audit log |
|
||||
| At least one stack on at least one node | Pushes target an existing stack directory; the wizard does not create stacks |
|
||||
| The target stack's compose declares the env file via `env_file:` | The env-file dropdown in the push wizard reads `env_file:` entries from a representative node's compose; a stack with only an inline `environment:` block will not show up |
|
||||
@@ -46,7 +46,7 @@ A **push** is a separate action. It reads the bundle's current version, walks ev
|
||||
|
||||
## Create a bundle
|
||||
|
||||
1. Open **Fleet → Secrets**.
|
||||
1. Open **Fleet → Secrets** (when that tab is available on the instance).
|
||||
2. Click **New bundle**.
|
||||
3. Give it a name. Names are 2-64 characters, alphanumerics plus space, dot, dash, and underscore, and must start and end with an alphanumeric.
|
||||
4. Optionally add a description; the description is a free-text field and is shown in the bundle list.
|
||||
|
||||
@@ -38,7 +38,7 @@ A single rail summarises the state of every registered node so you can read the
|
||||
|
||||
### Tabs
|
||||
|
||||
The Fleet view is a tab strip. Every tier sees Overview, Status, Map, Deployments, and Actions. Snapshots appears for admins. Deployments is available on Community. Routing and Secrets appear when the active plan includes them. Federation is available on every tier. A vertical separator after **Status** divides the per-node monitoring tabs from the fleet-wide orchestration tabs.
|
||||
The Fleet view is a tab strip. Every tier sees Overview, Status, Map, Deployments, Federation, and Actions. Snapshots appears for admins. Routing and Secrets are limited-availability fleet surfaces and are not part of the default tab strip. A vertical separator after **Status** divides the per-node monitoring tabs from the fleet-wide orchestration tabs.
|
||||
|
||||
| Tab | Tier | What it does |
|
||||
|-----|------|--------------|
|
||||
@@ -47,10 +47,10 @@ The Fleet view is a tab strip. Every tier sees Overview, Status, Map, Deployment
|
||||
| **Status** | Community | One card per node summarising which automations and security features are configured. Covered below. |
|
||||
| **Map** | Community | A read-only map of how stacks, services, networks, volumes, and ports relate across the fleet, with anomaly flags. Covered below. |
|
||||
| **Deployments** | Community | Blueprint deployments and reconciler state. See [Blueprints](/features/blueprint-model). |
|
||||
| **Routing** | Admiral | Cross-node service routing via Sencho Mesh. See [Sencho Mesh](/features/sencho-mesh). |
|
||||
| **Routing** | Limited availability | Cross-node service routing via Sencho Mesh when that surface is enabled on the instance. See [Sencho Mesh](/features/sencho-mesh). |
|
||||
| **Federation** | Community | Cordon nodes and pin blueprints to specific hosts. See [Fleet Federation](/features/fleet-federation). |
|
||||
| **Actions** | Community (admin role) | Fleet-wide bulk operations: stop stacks by label, bulk-assign labels, prune Docker resources. See [Fleet Actions](/features/fleet-actions). |
|
||||
| **Secrets** | Admiral | Encrypted env-var bundles you push to labeled nodes. See [Fleet Secrets](/features/fleet-secrets). |
|
||||
| **Secrets** | Limited availability | Encrypted env-var bundles you push to labeled nodes when that surface is enabled on the instance. See [Fleet Secrets](/features/fleet-secrets). |
|
||||
|
||||
### Action buttons
|
||||
|
||||
|
||||
@@ -6,7 +6,7 @@ description: An interactive terminal on your host OS, directly in the browser -
|
||||
The **Console** tab opens a full interactive terminal session on the machine running Sencho. It behaves exactly like an SSH session, but without needing an SSH server, client, or key management.
|
||||
|
||||
<Note>
|
||||
The Host Console requires a **Sencho Admiral** license and the **admin** role. [Learn more about licensing](/features/licensing).
|
||||
The Host Console is a limited-availability operator surface. When it is enabled on an instance, it requires an **Admiral** license and the **admin** role. [Learn more about licensing](/features/licensing).
|
||||
</Note>
|
||||
|
||||
<Frame>
|
||||
@@ -75,7 +75,7 @@ Environment variables whose names suggest secrets (passwords, tokens, keys, cred
|
||||
The Host Console is one of the most powerful features in Sencho and is treated as such:
|
||||
|
||||
- **Admin role required.** Only users with the **admin** role can open a console session.
|
||||
- **Admiral license required.** The Host Console is an Admiral feature.
|
||||
- **Admiral license required when enabled.** The Host Console is a limited-availability surface that uses an Admiral license.
|
||||
- **Browser sessions only.** Console sessions are only available from a signed-in browser session, not from API tokens.
|
||||
- **Audited.** Every console session is recorded in the audit log. Opening and closing a session each write an entry capturing the user, node, client IP, and timestamp, so shell access is fully accountable.
|
||||
|
||||
@@ -106,6 +106,6 @@ The Host Console is one of the most powerful features in Sencho and is treated a
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="Console tab is not visible">
|
||||
The Console tab only appears for users with the **admin** role on an Admiral-licensed instance. Verify both conditions are met. If you recently activated an Admiral license, refresh the page.
|
||||
Console appears only when the surface is enabled on the instance, and only for users with the **admin** role on an Admiral-licensed instance. Verify those conditions are met. If you recently activated an Admiral license, refresh the page.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
@@ -53,7 +53,7 @@ See [the pricing page](https://sencho.io/pricing) for current pricing.
|
||||
- **Governance:** advanced RBAC roles (Deployer, Node Admin, Auditor), scoped permissions per stack or node, and audit log export (CSV, JSON), anomaly detection, and configurable retention beyond the recent window
|
||||
- **Managed continuity:** Sencho Cloud Backup (a managed, off-site snapshot allowance)
|
||||
- **Directory integration:** LDAP / Active Directory authentication
|
||||
- **Current plan availability:** some product surfaces (including Fleet Secrets, AWS ECR credentials, Sencho Mesh, and the Host Console) still require an Admiral plan today. That access rule is temporary availability, not the reason Admiral exists.
|
||||
- **Current plan availability:** some product surfaces (including AWS ECR credentials) still require an Admiral plan today. That access rule is temporary availability, not the reason Admiral exists. Other operator surfaces may be limited-availability on a given instance and are documented on their own feature pages when enabled.
|
||||
|
||||
## Free trial
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@ description: Cross-node container networking. Reach any meshed service on any no
|
||||
---
|
||||
|
||||
<Note>
|
||||
Sencho Mesh requires an [Admiral license](/features/licensing).
|
||||
Sencho Mesh is a limited-availability surface. When it is enabled on an instance, it requires an [Admiral license](/features/licensing).
|
||||
</Note>
|
||||
|
||||
Sencho Mesh gives a multi-node fleet the network topology of a single machine. Once a stack opts in, every service it exposes becomes reachable from any other meshed stack on the fleet by a stable hostname. Cross-node traffic rides the same authenticated channel Sencho already uses to manage the fleet, so a node behind NAT or a residential firewall participates exactly like a public VPS.
|
||||
@@ -33,7 +33,7 @@ The user-facing effect is `psql -h db.api.opsix.sencho` from a container on any
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- An Admiral license on the central Sencho.
|
||||
- Mesh enabled on the instance, with an Admiral license on the central Sencho.
|
||||
- At least one [enrolled remote node](/features/multi-node) (Pilot Agent or Distributed API Proxy).
|
||||
- Functioning `sencho_mesh` data plane on every node that should participate. The Routing tab shows a red banner if a node's data plane did not come up; the troubleshooting section below covers each cause.
|
||||
- Per-stack opt-in. Enabling mesh on a node does not automatically place every stack into the mesh; each stack is opted in individually.
|
||||
@@ -42,13 +42,13 @@ App-layer authentication is **not** in scope. Postgres still needs a password, R
|
||||
|
||||
## Enable the mesh
|
||||
|
||||
Mesh lives under **Fleet → Routing**. Managing it (the per-node mesh toggle and stack opt-in or opt-out) requires an administrator; non-admin users see the Routing tab as read-only.
|
||||
When Mesh is enabled, it lives under **Fleet → Routing**. Managing it (the per-node mesh toggle and stack opt-in or opt-out) requires an administrator; non-admin users see the Routing tab as read-only.
|
||||
|
||||
<Frame caption="Fleet → Routing, Table view. Each node card shows mesh stack count, published aliases, per-alias Test probe, and an Add stack to mesh action.">
|
||||
<img src="/images/sencho-mesh/routing-tab-overview.png" alt="Sencho Mesh Routing tab Table view with node cards" />
|
||||
</Frame>
|
||||
|
||||
1. Open **Fleet → Routing**.
|
||||
1. Open **Fleet → Routing** (when that tab is available on the instance).
|
||||
2. Flip the mesh toggle (`ON` / `OFF`) on each node that should participate.
|
||||
3. Click **Add stack to mesh** on a node and confirm one or more stacks.
|
||||
|
||||
@@ -328,6 +328,6 @@ These are the explicit boundaries of the v1 mesh.
|
||||
Steer blueprint placement across the same fleet Mesh networks together.
|
||||
</Card>
|
||||
<Card title="Licensing" icon="key" href="/features/licensing">
|
||||
Mesh requires an Admiral plan today. See [Licensing](/features/licensing) for Community and Admiral plan details.
|
||||
Mesh is limited-availability and, when enabled, requires an Admiral plan. See [Licensing](/features/licensing) for Community and Admiral plan details.
|
||||
</Card>
|
||||
</CardGroup>
|
||||
|
||||
@@ -21,7 +21,7 @@ These are the main terms you will see across the app and docs:
|
||||
- **Resource**: A Docker image, volume, network, or unmanaged container. Sencho classifies resources as managed, external, system, unused, or protected so cleanup decisions are visible.
|
||||
- **Blueprint**: A fleet deployment model for keeping a compose template assigned to matching nodes.
|
||||
- **Pilot Agent**: An outbound connector for remote nodes that cannot accept inbound traffic.
|
||||
- **Mesh**: Cross-node container networking for fleets that need stable service-to-service hostnames.
|
||||
- **Limited-availability networking and secrets surfaces**: documented on their own feature pages when enabled on an instance.
|
||||
|
||||
## What you see after sign-in
|
||||
|
||||
@@ -64,7 +64,7 @@ The **Fleet** view is the multi-node command center. The masthead summarizes onl
|
||||
|
||||
The Fleet toolbar includes **Check Updates**, **Refresh**, and **Add node** for admins. The **Overview** tab supports search, sort, status filters, label filters, and a Grid or Topology view. Node cards show online state, resource use, container counts, version state, update actions, and direct drill-down into stacks on that node.
|
||||
|
||||
Beyond **Overview**, Fleet provides tabs for **Snapshots**, node **Status**, a dependency **Map**, blueprint **Deployments**, mesh **Routing**, **Federation**, fleet **Actions**, and **Secrets**. Routing and Secrets require Admiral. Federation placement (cordon and pin) is available on every tier. See [Licensing](/features/licensing) for the full tier breakdown.
|
||||
Beyond **Overview**, Fleet provides tabs for **Snapshots**, node **Status**, a dependency **Map**, blueprint **Deployments**, **Federation**, and fleet **Actions**. Federation placement (cordon and pin) is available on every tier. Routing and Secrets are limited-availability tabs when enabled on an instance. See [Licensing](/features/licensing) for the full tier breakdown.
|
||||
|
||||
## Resources, templates, and logs
|
||||
|
||||
|
||||
@@ -93,7 +93,7 @@ Every Sencho instance includes the foundational security stack. Advanced access-
|
||||
| Recent-activity audit log (14-day window) | ✓ | ✓ |
|
||||
| Scan policies (`block_on_deploy`) | | ✓ |
|
||||
| SARIF export | | ✓ |
|
||||
| Fleet Secrets (encrypted env-var bundles) | | ✓ |
|
||||
| Fleet Secrets (encrypted env-var bundles, limited availability) | | ✓ |
|
||||
| Advanced RBAC (Deployer, Node Admin, Auditor) | | ✓ |
|
||||
| Scoped permissions (per-stack, per-node) | | ✓ |
|
||||
| Audit log export, anomaly detection, and extended retention | | ✓ |
|
||||
|
||||
Reference in New Issue
Block a user