EnrollmentGrantService

本页列出 kibotos.operator.v1 中 EnrollmentGrantService 的方法及每个方法用到的消息与枚举，由 operator.proto 及其注释生成，注释保持英文。多个服务共用的消息与枚举见 kibotos.operator.v1 类型。

ctrl API使用 Operator 证书调用。调用方式

EnrollmentGrantService lets an authenticated Operator create one-time enrollment grants for other Operators or for exact node IDs, and revoke a principal. The enrollment key is returned exactly once; ctrl keeps only the grant record, the bootstrap certificate serial, and the key fingerprint.

CreateEnrollmentGrant

POST/kibotos.operator.v1.EnrollmentGrantService/CreateEnrollmentGrant一元调用

请求CreateEnrollmentGrantRequest

CreateEnrollmentGrantRequest names the exact principal the grant admits. ttl is bounded by ctrl (one minute to twenty-four hours, default one hour). data_plane_extra_hosts is allowed only on a node grant: extra lowercase DNS names or IP addresses (an IP, a loopback address, or an external DNS name) the node's data-plane certificate must also name, beyond the derived <node_id>.<suffix> node host ctrl always signs. Enroll copies them into the node admission. None of them may be the ctrl host.

command_idstring= 1
kind EnrollmentKind= 2
subjectstring= 3
ttlgoogle.protobuf.Duration= 4
data_plane_extra_hostsrepeatedstring= 5

响应CreateEnrollmentGrantResponse

CreateEnrollmentGrantResponse carries the opaque enrollment key only on the first response for a command_id. A replay returns the same grant with an empty key and replayed set, because ctrl never stores the key.