Repository navigation
docs: correct the architecture page against the router and node code - #764
Merged
Merged
Conversation
The architecture page said the routers keep the directory as a Kademlia DHT. A router keeps its members' records in its own store and places a copy on the routers closest to the key over /mesh/directory/1.0.0. The Kademlia routing table only picks those routers.
The architecture page said a router has no policy of its own. The router syncs the mesh policy and refuses a record for a service that the member's credential does not grant serving.
The architecture page said a node publishes its services to the control plane's catalog on request. The node posts its catalog to /nodes/catalog every minute, for the console to show.
The architecture page's decision table had no row for publishing. The router checks the member's allowed_publish grant when the member announces a service, and the calling node checks it again before it sends a request.
Four pages named the chart agentmesh-p2p, which is the SDK package name. The chart in charts/agentmesh is named agentmesh.
The architecture page said a new control plane with no policy admits nodes. /register refuses an OIDC identity that no binding gives the requested role, so with no policy only a node with a bootstrap token enrolls, and its credential grants nothing.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the documentation to reflect architectural changes, including renaming the agentmesh-p2p Helm chart to agentmesh, detailing how agentmesh-router manages directory records and mesh policy syncing, and clarifying node reporting behavior. The review feedback suggests refining the description of control plane admission to include both nodes and routers when using bootstrap tokens.
|
|
||
| Every one of these decisions is deny by default. A new control plane with | ||
| no policy admits nodes but grants them nothing, and a node with no services | ||
| no policy admits only nodes that present a bootstrap token, and grants them |
Contributor
There was a problem hiding this comment.
Since routers also enroll using bootstrap tokens, stating that the control plane admits only nodes with a bootstrap token is slightly restrictive. It would be more accurate to say 'nodes and routers' or 'peers'.
Suggested change
| no policy admits only nodes that present a bootstrap token, and grants them | |
| no policy admits only nodes and routers that present a bootstrap token, and grants them |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The architecture page describes how the routers keep the directory, what a router enforces, and how a node reports its catalog. The code no longer works that way in those three places. The page also calls the control plane chart by the SDK package name.
What changed
agentmeshon every page that named itagentmesh-p2p. A control plane with no policy admits only nodes that present a bootstrap token.Scope
Verification
/registerhandler.