ZEDEDA WiKi

User Tools

Site Tools

Trace:
zededa:projects:deployment_type

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
zededa:projects:deployment_type [2026/08/11 12:17] – mczededa:projects:deployment_type [2026/08/11 12:37] (current) – mc
Line 1: Line 1:
 ====== Policy deployments, and the tags that drive them ====== ====== Policy deployments, and the tags that drive them ======
  
-How an edge node gets a whole site — network, storage, apps — without anyone+How an edge node gets a whole site - network, storage, apps - without anyone
 naming that node anywhere. naming that node anywhere.
  
Line 21: Line 21:
  
 Two things must line up, and a third wires the app to its network. Each is a Two things must line up, and a third wires the app to its network. Each is a
-pair that must be //equal// on both sides — nothing matches by name.+pair that must be //equal// on both sides - nothing matches by name.
  
 ==== First, membership ==== ==== First, membership ====
Line 29: Line 29:
 below is even evaluated until this is true. below is even evaluated until this is true.
  
-==== Match 1 — picks which deployment ====+==== Match 1 - picks which deployment ====
  
 ^ On the node  ^  ^ On the deployment  ^ ^ On the node  ^  ^ On the deployment  ^
Line 36: Line 36:
 A project can hold more than one recipe. This says which one this node gets. A project can hold more than one recipe. This says which one this node gets.
  
-==== Match 2 — picks which policies ====+==== Match 2 - picks which policies ====
  
-^ On the node — tags  ^  ^ On each policy — target condition  ^+^ On the node - tags  ^  ^ On each policy - target condition  ^
 | ''demo = policy-demo''  | must equal  | ''demo = policy-demo''  | | ''demo = policy-demo''  | must equal  | ''demo = policy-demo''  |
  
Line 44: Line 44:
 only the ones whose condition its tags satisfy. only the ones whose condition its tags satisfy.
  
-==== Match 3 — plumbing, never touched in a demo ====+==== Match 3 - plumbing, never touched in a demo ====
  
-^ On the network policy — tags  ^  ^ On the app's NIC — netinsttag  ^+^ On the network policy - tags  ^  ^ On the app's NIC - netinsttag  ^
 | ''demo = policy-demo-ni''  | must equal  | ''demo = policy-demo-ni''  | | ''demo = policy-demo-ni''  | must equal  | ''demo = policy-demo-ni''  |
  
 The network does not exist until a node qualifies, so the app cannot refer to it The network does not exist until a node qualifies, so the app cannot refer to it
 by name. It finds it by tag instead. by name. It finds it by tag instead.
 +
 +==== The two words that trip people up ====
 +
 +**Target condition.** A filter written on the //policy//, not on the node. It
 +says: "only apply me to nodes whose tags include this exact key and value." The
 +policy states what it is looking for, the node carries the labels, and the
 +controller does the matching. A policy with no target condition applies to every
 +node that reaches the deployment.
 +
 +**netinsttag.** The same idea one level down, and about networks instead of
 +nodes. It is written on the app's network interface and says: "plug me into
 +whichever network instance carries this tag."
 +
 +Why not just name the network? Because it does not exist yet. The network is
 +created by a policy at the moment a node qualifies, and it is created separately
 +for every node. There is no name to refer to when you are writing the config, so
 +a label is the only stable handle.
 +
 +That is the pattern behind both: an object describes what it is looking for, and
 +the controller finds the match when the node shows up. Nothing is wired by name.
  
 **Tip:** matches 2 and 3 both use the key ''demo'' with different values, which **Tip:** matches 2 and 3 both use the key ''demo'' with different values, which
 makes them look related when they are not. Renaming the network tag key to makes them look related when they are not. Renaming the network tag key to
-something like ''net'' makes it read unambiguously — ''demo='' always means+something like ''net'' makes it read unambiguously - ''demo='' always means
 nodes, ''net='' always means networks. nodes, ''net='' always means networks.
  
Line 84: Line 104:
 even goes clean afterwards. even goes clean afterwards.
  
-Any change to a deployment needs a destroy and recreate — and the delete is+Any change to a deployment needs a destroy and recreate - and the delete is
 refused while a node is still attached, so unbind first: refused while a node is still attached, so unbind first:
  
Line 96: Line 116:
 always why. always why.
  
-===== Nothing deployed — what to check =====+===== Nothing deployed - what to check =====
  
 Every one of these fails //silently//. There is no error to read, so work down Every one of these fails //silently//. There is no error to read, so work down
Line 102: Line 122:
  
   * Is the project type ''TAG_TYPE_DEPLOYMENT''?   * Is the project type ''TAG_TYPE_DEPLOYMENT''?
-  * Is the node in that project — not its old one?+  * Is the node in that project - not its old one?
   * Does the node's ''deployment_tag'' match the deployment's, exactly?   * Does the node's ''deployment_tag'' match the deployment's, exactly?
   * Do the node's tags satisfy every policy's target condition?   * Do the node's tags satisfy every policy's target condition?
Line 110: Line 130:
 ==== Two red herrings ==== ==== Two red herrings ====
  
-A node reading ''ADMIN_STATE_REGISTERED'' is normal — working nodes read that+A node reading ''ADMIN_STATE_REGISTERED'' is normal - working nodes read that
 too. It does not mean the node is inactive. too. It does not mean the node is inactive.
  
Line 122: Line 142:
 all created by policy, reachable on the node's published port. all created by policy, reachable on the node's published port.
  
-Terraform reference: ''cisco-ot-ign-demo-policy-based/'' — see+Terraform reference: ''cisco-ot-ign-demo-policy-based/'' - see
 ''README-full.md'' for API queries and the full history. ''README-full.md'' for API queries and the full history.
  
zededa/projects/deployment_type.1786450646.txt.gz · Last modified: by mc