tritonadm cn
tritonadm cn manages compute-node registration, enrollment, and per-node settings.
The family has six direct commands (list, show, approve, disable,
root-password, exec) and eight groups: label, traits, reservoir, sandbox,
mantablock, auto-approve, boot, and setup. boot also holds the policy
group. tritonadm cn traits and
tritonadm cn sandbox have their own pages.
Execution context
Every command in this family is an HTTP call against a running tritond. The commands
run on any host that has tritonadm installed and resolves both an endpoint and a
credential. Only cn exec reaches a compute node directly, over SSH. No command in this
family requires the head node global zone.
A <CN> positional takes a hostname, a UUID, or a UUID prefix, except where a section
says otherwise.
Every command accepts the global options. The tritonadm command index documents the endpoint and credential resolution order.
| Global option | Default | Description |
|---|---|---|
--endpoint <URL> | Cluster endpoint. Falls back to TRITONADM_ENDPOINT, then to the config file. | |
--api-key <KEY> | API key in place of the stored session. Falls back to TRITONADM_API_KEY. | |
--timeout <SECS> | 60 | Give up on a request after this many seconds. 0 waits forever. |
-v, --verbose | off | On error, print the full cause chain. |
-j, --json | off | Print JSON. Same as --format json. |
--format <FORMAT> | table | table, json, or yaml. |
-o, --output <COLS> | Table columns to show, comma separated. A dotted path such as sysinfo.hostname reads a field of the raw record. Refused with -j, --format json, or --format yaml. | |
-l, --long | off | Show the wider column set. Ignored with -o. |
-s, --sort <COLS> | per view | Sort by these columns. A leading - reverses a column. |
-H, --no-headers | off | Omit the header row. Refused with -j, --format json, or --format yaml. |
--limit <N> | Stop after this many rows. |
The synopsis blocks below are usage forms, not terminal transcripts.
Compute node states
CnState has five wire values. tritonadm cn list --state accepts only the first three.
| Wire value | Meaning | Accepted by --state |
|---|---|---|
pending | Self-registered, awaiting approval. Carries an active claim code until approval or expiry. | Yes |
approved | Approved and active. The bound per-CN API key is the agent's credential for the rest of /internal/v1/agent/*. | Yes |
disabled | Explicitly disabled by an operator. The record stays for audit visibility. | Yes |
awaiting_setup | Discovered over the boot bus, not yet running tritonagent. No claim code, no credential. | No |
setting_up | Approved for setup. The boot bus is authorized to drive zpool creation and install. | No |
cn list and cn show print all five values. The --state filter accepts only the
first three, because the CLI's value enum has three variants. A node in
awaiting_setup or setting_up appears in the unfiltered list and in -j output.
Placement roles
CnRole has three wire values. tritonadm cn label set --role sets the value.
| Wire value | Meaning |
|---|---|
tenant | Eligible for tenant workload placement. This is the default for a new compute node. |
edge | Eligible for north and south edge placement. |
both | Eligible for tenant workload placement and for north and south edge placement. |
tritonadm cn list
Synopsis
tritonadm cn list [--state <STATE>]
tritonadm cn ls [--state <STATE>]
tritonadm cns [--state <STATE>]
Description
Lists registered compute nodes, with an optional state filter. The command walks every
page of GET /v1/system/hardware/cns, then reads the traits and labels of every node,
and prints one table. It requires the SystemRead capability. ls is an alias, and
the top-level tritonadm cns is a shortcut with the same filter.
The table is sorted by hostname. When no compute node matches, the command prints the
header row only.
Options
| Option | Type | Default | Description |
|---|---|---|---|
--state <STATE> | pending, approved, disabled | No filter | Restrict the list to one state. |
Columns
Default columns are SHORTID, HOSTNAME, STATE, ROLE, ADMIN_IP, SEEN, AGE,
and TRAITS. With -l, the columns are SERVER_UUID, HOSTNAME, STATE, ROLE,
ADMIN_IP, LAST_SEEN, REGISTERED_AT, APPROVED_AT, SETUP_PROGRESS, TRAITS, and
LABELS.
| Column | Source |
|---|---|
shortid | The first eight characters of server_uuid. |
server_uuid | server_uuid. |
hostname | hostname. |
state | state. |
role | role. |
admin_ip | admin_ip, or - when unset. |
seen | Time since last_seen. |
last_seen | last_seen, as a timestamp. |
age | Time since registered_at. |
registered_at | registered_at, as a timestamp. |
approved_at | approved_at, or - when unset. |
setup_progress | setup_progress, or - when unset. |
traits | The node's placement traits. |
labels | The node's labels. |
With -j, each element is the CnView record with traits and labels added when
the node has any.
tritonadm cn show
Synopsis
tritonadm cn show <CN>
Description
Reads one compute node. The command calls GET /v1/system/hardware/cns/{cn} and
requires the SystemRead capability. It also reads the node's traits and labels and,
from the fleet capacity view, the node's gateway image.
With -j, the command prints the whole CnView. Without it, the command prints a
labeled block, then the node's sysinfo blob, indented.
Printed fields
| Label | Notes |
|---|---|
server_uuid | |
hostname | |
state | One of the five wire values. |
role | One of tenant, edge, both. |
admin_ip | - when unset. |
registered_at | Timestamp. |
approved_at | Timestamp, or - when unset. |
last_seen | Timestamp, or - when unset. |
setup_progress | - when unset. |
setup_error | Printed only when last_setup_error is set. |
claim_code | Printed only while a claim code is present, followed by claim_code_expires_at. |
bound_api_key_id | Printed only when a key is bound. The key plaintext is never printed. |
gateway_image | Printed only when the capacity view reports one: present (<ID>), missing (<ID>) with the agent's reason when given, or unknown (<ID>). <ID> is the first eight characters of the image ID. |
traits | Placement traits. |
labels | Labels. |
sysinfo | The full nested blob, pretty-printed and indented two spaces. |
The server removes secret boot parameters from sysinfo at the serve boundary, so
root_shadow and rabbitmq never appear in it.
The -j output carries fields the plain output omits, including last_status and
disk_layout.
tritonadm cn approve
Synopsis
tritonadm cn approve <CODE>
Description
Approves a pending compute node by its claim code. The command calls
POST /v1/system/hardware/cn-approvals. The server applies a per-source-IP rate limit
before any authorization work runs. The server mints the per-CN API key inside the same
transaction that changes the state.
The claim code is six characters of Crockford base32. The alphabet is
0123456789ABCDEFGHJKMNPQRSTVWXYZ. It omits O, I, L, and U to prevent console
misreads. The code is displayed as XXX-XXX and expires one hour after the server mints
it. The command sends the code as typed. The server removes whitespace and hyphens and
uppercases the input, so abc-def, ABCDEF, and ABC-DEF are all the same code.
The operator never sees the plaintext API key. The key reaches the agent through the
agent's long-poll on /internal/v1/agent/register/status. The operator sees only the
bound key id, which correlates the approval to later audit events.
On success, the command prints:
Approved CN <SERVER_UUID>; bound api key id <KEY_ID>
When no key is bound, the key id renders as (none). With -j, the command prints the
resulting CnView. The wire shape is redacted and never contains the plaintext key.
The server returns 404 with no Pending CN matches that claim code for an unknown,
expired, or already-approved code. The three cases return one status so that the
endpoint cannot be used to enumerate valid codes. The server returns 429 when the
per-IP bucket is empty. The server rejects a code that is not six characters of the
alphabet with 400 and this message:
claim code must be 6 chars of Crockford base32 (XXX-XXX accepted)
Arguments
| Argument | Type | Description |
|---|---|---|
<CODE> | string, positional, required | Six-character claim code displayed on the compute node's console. XXX-XXX and XXXXXX are both accepted. |
tritonadm cn disable
Synopsis
tritonadm cn disable <CN> [-n] [-y]
Description
Changes a compute node to disabled. The command calls
POST /v1/system/hardware/cns/{cn}/disable. The server keeps the record for audit visibility.
A second call against an already-disabled node is idempotent.
A fresh anonymous registration from the same server_uuid returns a disabled record
to pending with a new claim code. This is the supported path back to an active node.
The command prints the change on standard error and asks for confirmation on the
terminal. -y skips the prompt, and is required when no terminal is available.
-n prints the change and exits:
This will make the following changes:
disable CN <CN_HOSTNAME> (<CN_SHORTID>), currently approved; no new instances place there
Would you like to continue? [y/N] y
[1/1] disable cn
Completed successfully (elapsed <ELAPSED>).
Disabling a node revokes its bound API key. tritond refuses a node-bound key
unless the node is approved or setting_up and still names that key. The key
record stays in the store, but it no longer authenticates.
Arguments and options
| Argument or option | Type | Default | Description |
|---|---|---|---|
<CN> | Hostname, UUID, or prefix, positional, required | The compute node to disable. | |
-n, --dry-run | flag | off | Print the change and exit. |
-y, --yes | flag | off | Skip the confirmation prompt. |
--keep-going | flag | off | Accepted by every mutating command. |
With a structured output format (-j or --format json), the command prints the
compute node record after the disable completes.
cn disable is the only command in this family that takes -n, -y, and
--keep-going. Every other mutating cn command, cn setup approve included, runs
without a confirmation prompt.
tritonadm cn root-password
Synopsis
tritonadm cn root-password <CN> [--hash <HASH> | --clear | --password-stdin]
Description
Sets or clears a compute node's global-zone root password. The command calls
POST /v1/system/hardware/cns/{cn}/root-password. It prompts for the password on the
terminal unless --hash, --clear, or --password-stdin is given. The server hashes a
plaintext password with sha512-crypt and stores only the hash. The booter emits the hash
as the root_shadow boot parameter, so it applies at the node's next netboot. A
compute node that completed setup boots its local zones pool on a plain reboot, so the
hash reaches it only after a one-time network boot override. A netboot enrollment also
hands the current hash to the installer.
On success, the command prints one of:
Set root password for CN <SERVER_UUID> — applies on its next netboot
Cleared root password for CN <SERVER_UUID>
The command refuses an empty password and names --clear instead. The server refuses a
plaintext password longer than 256 bytes or one that contains NUL, a newline, or :. It
refuses a --hash value that is not a plain $6$salt$hash string with a salt of 1 to 16
characters and an 86-character hash, all over ./0-9A-Za-z. The rounds= form is
refused.
Arguments and options
| Argument or option | Type | Default | Description |
|---|---|---|---|
<CN> | Hostname, UUID, or prefix, positional, required | The compute node. | |
--hash <HASH> | string | prompt | Store this pre-computed sha512-crypt hash verbatim. Conflicts with --clear. |
--clear | flag | off | Clear the stored password. The next netboot sets none. |
--password-stdin | flag | off | Read the plaintext password from stdin instead of prompting. Conflicts with --hash and --clear. |
tritonadm cn exec
Synopsis
tritonadm cn exec [OPTIONS] (<CN>... | --all) -- <COMMAND>...
tritonadm cn exec [OPTIONS] (<CN>... | --all) --script <FILE> [-- <ARG>...]
Description
Runs a command on compute-node global zones over SSH, in parallel. The command reads the
compute node inventory from GET /v1/system/hardware/cns, which needs the SystemRead
capability. It then runs the local ssh client against root@<ADMIN_IP> for each target.
The remote work uses the operator's own SSH credential, so distribute the key first with
the cn.root_authorized_keys setting.
--all targets every approved compute node that has a recorded admin IP. A named
compute node can be in any state, but it needs a recorded admin IP. A node named twice
runs once.
The inventory read takes one page of the list, which holds 50 compute nodes by default.
--all covers only the nodes on that page, and a node beyond it cannot be named either.
Every run reads the same first page, so on a fleet larger than one page some nodes are
out of reach of cn exec. Check the fanning out to count against cn list.
Everything after -- is joined with spaces and run by the remote shell, as ssh itself
does. With --script, the command copies the local file to a private temporary file
under /var/tmp on the compute node, runs it with the arguments after --, and removes
it.
Every connection uses BatchMode=yes, StrictHostKeyChecking=accept-new, and a
ConnectTimeout of the smaller of --timeout and 15 seconds. --ssh-opt adds options
after these.
Without -j, the command prints fanning out to <N> CNs, then one block per compute
node as it finishes:
=== <CN_HOSTNAME> [<ADMIN_IP>] ok
The status is ok, exit <CODE>, TIMED OUT after <SECS>s, ERROR: <MESSAGE>, or
killed by signal. Remote stdout follows on stdout, and remote stderr on stderr. The run
ends with <N> of <N> succeeded. When any node fails, the command exits non-zero with
failed on <COUNT> of <N> CNs: <HOSTNAMES>.
With -j, the command prints one array sorted by hostname. Each element carries
server_uuid, hostname, admin_ip, exit_code, timed_out, error, stdout, and
stderr.
Arguments and options
| Argument or option | Type | Default | Description |
|---|---|---|---|
<CN>... | Hostname, UUID, or prefix, positional | Compute nodes to target. Required unless --all is given. Conflicts with --all. | |
--all | flag | off | Target every approved compute node with a recorded admin IP. |
--script <FILE> | path | Push this local file to the compute node and run it. | |
--parallel <N> | integer | 8 | Maximum compute nodes contacted at once. |
--timeout <SECS> | integer | 300 | Per-node deadline covering connection and execution. The ssh process is killed when it expires. |
--ssh-opt <OPT> | string, repeatable | Extra option passed to ssh as -o <OPT>. | |
<COMMAND>... | strings after -- | The remote command, or with --script the script's arguments. |
The command refuses to run with neither a command after -- nor --script.
tritonadm cn label set
Synopsis
tritonadm cn label set <CN> [--role <ROLE>] [<KEY=VALUE>...]
Description
Sets the placement role, labels, or both. Give --role, at least one
KEY=VALUE, or both.
--role calls POST /v1/system/hardware/cns/{cn}/role. On a role-only change the
command prints:
Set CN <SERVER_UUID> role to <ROLE>
KEY=VALUE pairs are merged into the compute node's labels. Other labels stay. The
command writes them with POST /v1/system/hardware/cns/{cn}/labels. With labels, the
command prints server_uuid, traits, and labels.
A label selects a compute node and never reserves it. Labels are not
traits. Examples are image-build=true for a NoCloud build node,
and cluster and rack for the capacity view.
Arguments and options
| Argument or option | Type | Default | Description |
|---|---|---|---|
<CN> | Hostname, UUID, or prefix, positional, required | The compute node. | |
--role <ROLE> | tenant, edge, both | Placement role. See Placement roles. | |
<KEY=VALUE> | String pairs, repeatable | Labels to merge. Key and value must both be non-empty. |
Limits
The server refuses a change past these limits, with an error that starts with labels:.
| Limit | Value |
|---|---|
| Labels per compute node | 32 |
| Key | 1 to 64 characters: letters, digits, -, _, ., :, / |
| Value | 1 to 128 bytes, no control characters |
tritonadm cn label unset
Synopsis
tritonadm cn label unset <CN> <KEY>...
Description
Removes labels by key. Give at least one key.
tritonadm cn reservoir set
Synopsis
tritonadm cn reservoir set <CN> [--enabled <BOOL>] [--percent <FLOAT>]
Description
Sets the per-compute-node bhyve memory reservoir override. The command calls
POST /v1/system/hardware/cns/{cn}/reservoir. The body fully replaces the override.
The reservoir floor is a fraction of physical RAM. Neither tritonadm nor tritond
range-checks --percent. tritonagent clamps the effective value to 0.0 through 1.0
and to the kernel reservoir limit before it applies the value.
The response carries both the stored override and the effective values after the server
applies the cluster defaults. Without -j, the command prints the override with
(inherit) in place of a cleared field, then the effective pair:
CN <SERVER_UUID> reservoir override:
enabled: (inherit)
percent: (inherit)
effective: enabled=true percent=0.80
An omitted flag does not mean "leave unchanged". The request sends null for any flag
you do not pass. A null clears that field, so the compute node inherits the cluster
default. Passing only --percent also clears an existing --enabled override, and the
reverse. Pass both flags on every set to keep both pinned.
Arguments and options
| Argument or option | Type | Default | Description |
|---|---|---|---|
<CN> | Hostname, UUID, or prefix, positional, required | The compute node to override. | |
--enabled <BOOL> | true or false | Field cleared when omitted | Enable or disable the reservoir on this compute node. |
--percent <FLOAT> | float | Field cleared when omitted | Reservoir floor as a fraction of physical RAM, 0.0 through 1.0. |
With -j, the command prints the resulting CnReservoirView.
Cluster defaults
A cleared field inherits a cluster-wide setting. tritonadm config reads and writes these settings.
| Setting key | Built-in default |
|---|---|
reservoir.enabled_default | true |
reservoir.percent_default | 0.80 |
tritonadm cn reservoir clear
Synopsis
tritonadm cn reservoir clear <CN>
Description
Clears the per-compute-node reservoir override so that the node inherits the cluster
defaults. This is reservoir set with both fields absent. The command sends the same
POST /v1/system/hardware/cns/{cn}/reservoir with reservoir_enabled and
reservoir_percent both null, and prints the same block.
tritonadm cn mantablock
Synopsis
tritonadm cn mantablock show <CN>
tritonadm cn mantablock set <CN> --role <ROLE>
Description
Reads or sets the compute node's MantaBlock role. show calls
GET /v1/system/hardware/cns/{cn}/mantablock-role. set calls
POST /v1/system/hardware/cns/{cn}/mantablock-role. Both print:
CN <SERVER_UUID> MantaBlock role: <ROLE>
| Role | Meaning |
|---|---|
storage | Holds members of MantaBlock volumes. An instance here keeps one copy of each of its volumes on this compute node. This is the default. |
compute | Holds no copy of any volume. Each MantaBlock disk of an instance here has its three copies on storage nodes, so the node runs only instances whose disks have three copies. |
The server refuses a change to compute with 409 while the node holds a copy of a
volume. It refuses a change to storage while the node coordinates a volume it holds no
copy of. The node's MantaBlock engine reads the role when it starts. After set, the
command prints Restart site/mantablock-engine on the CN now. on standard error.
tritonadm cn auto-approve status
Synopsis
tritonadm cn auto-approve status
Description
Reads the current auto-approve window. The command calls
GET /v1/system/hardware/cn-auto-approve. The command sends this GET directly rather
than through the generated client, so a null body parses as "no window" instead of a
deserialization failure.
When no window is open the command prints:
No window open.
When a window is open the command prints Auto-approve window: followed by four fields:
opened_at, expires_at, remaining_count, and opened_by. remaining_count renders
as (unlimited) when the window is time-bound only. opened_by is the authenticated
principal captured when the window was opened.
With -j, the command prints null or the window object.
tritonadm cn auto-approve open
Synopsis
tritonadm cn auto-approve open --duration-secs <SECS> [--count <N>]
Description
Opens or replaces the auto-approve window. The command calls
POST /v1/system/hardware/cn-auto-approve. While the window is open, the server
promotes new self-registrations to approved without operator action, so no claim code
is exchanged.
Wall time bounds the window. A count budget is optional and also bounds it. The server
clamps duration_secs to 24 hours, so a mistyped 86400000 becomes a 24-hour window
rather than a multi-year one. The audit record captures both the requested and the
effective duration.
On success the command prints Auto-approve window opened: followed by the same four
fields that status prints.
Options
| Option | Type | Default | Description |
|---|---|---|---|
--duration-secs <SECS> | integer, required | How long to keep the window open. The server clamps the value to 86400. | |
--count <N> | integer | Unlimited | Maximum number of registrations to auto-approve before the window closes early. Omit for a time-bound window. |
tritonadm cn auto-approve close
Synopsis
tritonadm cn auto-approve close
Description
Closes the auto-approve window early. The command calls
DELETE /v1/system/hardware/cn-auto-approve. The call is idempotent. A call with no
window open does nothing and still reports success.
The command prints:
Auto-approve window closed.
tritonadm cn boot
Synopsis
tritonadm cn boot list
tritonadm cn boot show <MAC>
tritonadm cn boot assign <MAC> --pi <PI_STAMP>
tritonadm cn boot declared
tritonadm cn boot converge
tritonadm cn boot policy show
tritonadm cn boot policy set [--enrollment-pi <PI_STAMP>] [--auto-enroll <BOOL>] [--enrollment-kernel-arg <ARG>]...
Description
Netboot boot records, one per admin-network MAC, and the site-wide boot policy. <MAC>
is an admin-network MAC address, not a <CN> reference.
| Command | Endpoint | Description |
|---|---|---|
boot list | GET /v1/system/hardware/cn-boot | List boot records. ls is an alias. |
boot show <MAC> | GET /v1/system/hardware/cn-boot/{mac} | Show one boot record. A MAC that was never reported returns a synthesized discovered record and creates no row. |
boot assign <MAC> --pi <PI_STAMP> | PATCH /v1/system/hardware/cn-boot/{mac} | Set the platform image a compute node boots next. Takes effect on the next netboot. The stamp must be staged on the booter (tritonadm pi list). Prints Assigned PI <PI_STAMP> to <MAC> (takes effect on its next netboot). |
boot declared | three reads | The answers-declared node roster joined with live state: which declared machines have netbooted, enrolled, or not appeared yet. The join is by MAC. A declared aggregate's first member is the node's boot MAC. |
boot converge | PATCH per record | Write declared networking (hostname, bond, NIC tags) again onto boot records that enrolled before the declaration changed. Each record applies the change at its next netboot. |
boot policy show | GET /v1/system/hardware/cn-boot-policy | Show the site-wide boot policy. |
boot policy set | GET, then PUT /v1/system/hardware/cn-boot-policy | Update enrollment_pi, auto_enroll, or the enrollment kernel arguments. The command reads the current policy and writes it back whole, so unspecified fields are preserved. |
boot list default columns are MAC, STATE, MODE, ASSIGNED_PI, LAST_PI,
ADDRESS, CN, and LAST_BOOT. With -l, the columns are MAC, STATE, MODE,
ASSIGNED_PI, LAST_PI_BOOTED, ADDRESS, SERVER_UUID, RACK, PORT,
SERVICE_TAG, DISCOVERED_AT, and LAST_BOOT_AT. The table is sorted by mac.
boot show prints BootRecord <MAC>, then state, boot_mode, assigned_pi,
last_pi_booted, last_boot_at, address, server_uuid, kernel_args (only when
set), discovered_at, rack, port, and service_tag.
boot declared prints the columns HOSTNAME, CANONICAL_MAC, BOND, EXTRA_TAGS,
BOOT, ADDRESS, CN_STATE, TAGS_SEEN, and SERVER_UUID. With no declared nodes in
the policy, both boot declared and boot converge print
(no declared nodes in the boot policy). boot converge ends with a count line:
<N> declared, <N> re-stamped, <N> unchanged, <N> not yet seen, <N> seen but not yet stamped
boot policy show and boot policy set print BootPolicy (site), then auto_enroll,
enrollment_pi, enrollment_kernel_args, the number of allowlist entries, and
whether admin_network is configured.
Options on boot policy set
| Option | Type | Description |
|---|---|---|
--enrollment-pi <PI_STAMP> | string | Platform-image stamp served to enrolling nodes. |
--auto-enroll <BOOL> | true or false | Enable or disable auto-enroll of discovered nodes. |
--enrollment-kernel-arg <ARG> | string, repeatable | Replace the enrollment kernel arguments. Omit to leave unchanged. |
With none of the three options, the command exits with
nothing to change: pass --enrollment-pi, --auto-enroll, and/or --enrollment-kernel-arg.
The allowlist and admin_network fields have no option. Edit them through the API.
tritonadm cn setup
Synopsis
tritonadm cn setup plan <CN>
tritonadm cn setup approve <CN> --layout <LAYOUT> [--width <N>] [--spares <N>] [--exclude <DISK>]... [--no-cache] [--compress <VALUE>] [--hostname <HOSTNAME>]
Description
The ur-enrollment setup lifecycle. A netbooted node has no claim code. The boot-policy
allowlist already admitted it, and setup approval is the remaining operator gate. Both
commands require the operator action CnSetupApprove. Of the API key scopes, only full
reaches it.
setup plan calls GET /v1/system/hardware/cns/{cn}/setup-layout-proposal. It prints
the announced disks with their sizes in GB, the proposed layout with its width, spares,
and storage, spare, and cache disks, the supported layouts, and the approve command to
run. The proposal is advisory. When the node announced no usable storage disk, the
command prints No proposal: and the reason.
setup approve calls POST /v1/system/hardware/cns/{cn}/approve-setup. It confirms the
pool layout and moves the node from awaiting_setup to setting_up. It is destructive
on the compute node: the installer wipes the disks in the confirmed layout. The command
does not ask for confirmation. On success it prints:
Approved setup for CN <SERVER_UUID> (<CN_HOSTNAME>); layout <LAYOUT> — watch with: tritonadm cn show <SERVER_UUID> (state setting_up until the install reports; failures land in `setup error`)
The response also carries an operation_id. It is a correlation id for the audit
trail. No saga or operation record stands behind it.
The server rate-limits approve-setup per source IP. It returns 409 when the node is
not in awaiting_setup, and 400 when the layout, hostname, or compression value fails
validation.
Options on setup approve
| Option | Type | Default | Description |
|---|---|---|---|
<CN> | Hostname, UUID, or prefix, positional, required | The compute node in awaiting_setup. | |
--layout <LAYOUT> | single, mirror, raidz1, raidz2, raidz3, required | Confirmed pool layout keyword. | |
--width <N> | integer | disklayout picks | Fixed stripe width. A value below 2 is refused. |
--spares <N> | integer | auto | Fixed spare count. 0 means exactly zero spares. |
--exclude <DISK> | disk name, repeatable | none | Disk to keep out of the pool. |
--no-cache | flag | off | Disable the L2ARC cache assignment. |
--compress <VALUE> | off, on, lz4, zstd, gzip, gzip-1 through gzip-9 | pool default | zpool compression property. The server validates the value. |
--hostname <HOSTNAME> | RFC 1123 label | announce-time hostname | Nodename persisted to the node's node.config. |
Endpoints and authorization
| Command | Method and path | Authorization |
|---|---|---|
cn list | GET /v1/system/hardware/cns | Capability SystemRead |
cn show | GET /v1/system/hardware/cns/{cn} | Capability SystemRead |
cn approve | POST /v1/system/hardware/cn-approvals | Action CnApprove, plus a per-source-IP rate limit checked first |
cn disable | POST /v1/system/hardware/cns/{cn}/disable | Action CnDisable |
cn root-password | POST /v1/system/hardware/cns/{cn}/root-password | Action CnSetRootPassword |
cn exec | GET /v1/system/hardware/cns, then SSH | Capability SystemRead, plus the operator's SSH key on the node |
cn label set --role | POST /v1/system/hardware/cns/{cn}/role | Action CnSetRole |
cn label set, cn label unset | POST /v1/system/hardware/cns/{cn}/labels | Action CnSetTraits |
cn reservoir set, cn reservoir clear | POST /v1/system/hardware/cns/{cn}/reservoir | Action CnSetReservoir |
cn mantablock show | GET /v1/system/hardware/cns/{cn}/mantablock-role | Capability SystemRead |
cn mantablock set | POST /v1/system/hardware/cns/{cn}/mantablock-role | Action CnSetMantablockRole |
cn auto-approve status | GET /v1/system/hardware/cn-auto-approve | Action AutoApproveGet |
cn auto-approve open | POST /v1/system/hardware/cn-auto-approve | Action AutoApproveSet |
cn auto-approve close | DELETE /v1/system/hardware/cn-auto-approve | Action AutoApproveClear |
cn boot list | GET /v1/system/hardware/cn-boot | Action CnBootList |
cn boot show | GET /v1/system/hardware/cn-boot/{mac} | Action CnBootGet |
cn boot assign, cn boot converge | PATCH /v1/system/hardware/cn-boot/{mac} | Action CnBootUpdate |
cn boot policy show | GET /v1/system/hardware/cn-boot-policy | Action CnBootPolicyGet |
cn boot policy set | PUT /v1/system/hardware/cn-boot-policy | Action CnBootPolicySet |
cn setup plan | GET /v1/system/hardware/cns/{cn}/setup-layout-proposal | Action CnSetupApprove |
cn setup approve | POST /v1/system/hardware/cns/{cn}/approve-setup | Action CnSetupApprove, plus a per-source-IP rate limit checked first |
tritonadm cn traits and tritonadm cn sandbox list their own endpoints.
Operations this command family does not cover
tritonadm cn has no subcommand for the following operations. Each exists only as a
tritond HTTP endpoint.
| Operation | Endpoint | Authorization |
|---|---|---|
Factory-reset a node back to awaiting_setup | POST /v1/system/hardware/cns/{cn}/factory-reset | Action CnFactoryReset |
| Remove a node from the control plane | DELETE /v1/system/hardware/cns/{cn} | Action CnDelete |
| List the instances placed on one node | GET /v1/system/hardware/cns/{cn}/instances | Capability SystemRead |
| Dry-run a drain plan | POST /v1/system/hardware/cns/{cn}/drain/preview | Action CnGet |
Authorize a discovered boot record | POST /v1/system/hardware/cn-boot/{mac}/authorize | Action CnBootAuthorize |
| Set or clear rescue boot mode | POST /v1/system/hardware/cn-boot/{mac}/rescue, .../rescue/clear | Actions CnBootRescueSet, CnBootRescueClear |
| Decommission or reactivate a boot record | POST /v1/system/hardware/cn-boot/{mac}/decommission, .../reactivate | Actions CnBootDecommission, CnBootReactivate |
| Replace the boot policy allowlist or admin network | PUT /v1/system/hardware/cn-boot-policy | Action CnBootPolicySet |
| Read, open, or close the strict-mode enrollment window | GET, POST, DELETE /v1/system/hardware/enroll-window | Actions UrEnrollWindowGet, UrEnrollWindowOpen, UrEnrollWindowClose |
tritonadm instance list --cn <CN> lists the instances on one node from the CLI.
There is also no tritonadm command for instance console, VNC, or serial access at any
level of the CLI.