Cluster module

Source: modules/cluster/ (ce module); the join/enroll/mesh overlays live in this repo’s modules/cluster/.

modules/cluster/
├── binaries.go
├── ca.go
├── command.go
├── doctor.go
├── drain.go
├── errors.go
├── failure.go
├── health.go
├── host_prep.go
├── init.go
├── leave.go
├── mesh_join.go
├── models.go
├── network.go
├── recovery.go
├── router.go
├── service.go
├── swarm.go
├── tokens.go
├── types.go
├── voters.go
└── commands/

Routes are listed in the generated route reference; request/response notes live in the API reference.

Typed errors are catalogued in the error code reference with HTTP statuses and message templates.

The cluster module owns the cluster-level view of node membership and the tokens that let new nodes join. It complements node, which owns per-node lifecycle (mTLS, daemon state, join/leave mechanics). Think of cluster as “the shape of the whole” and node as “one node’s state machine.”

Two concerns live here:

• Node table CRUD via ClusterNodeService in service.go: list_nodes, get_node / get_node_by_name, get_status (the whole-cluster health summary including leader, quorum, voter count), create_node / upsert_node / update_node / update_node_state / update_last_seen, set_leader, remove_node / delete_node, and voter-counting helpers. This is the backing store for shc cluster nodes, shc cluster status, and any UI that shows node topology.
• Join tokens via tokens.go (GenerateLANJoinToken, GenerateMeshJoinToken). The HTTP API exposes these through /api/method/shc.cluster.token so an operator on the leader can mint a short-lived token; a joining node then presents it to bootstrap mTLS and (optionally) Nebula mesh membership.

The CA infrastructure for mTLS lives in ca.go and is consumed by both cluster (token issuance) and node (certificate rotation). Nebula mesh specifics are owned by the nebula module.

What the cluster module does not own: the actual enroll handshake (that is shc.internal_api.endpoints.enroll), per-node daemon wiring (that is node + shc.subsystems.daemon_manager), raft consensus (that is the rqlited engine, core/rqlited), or leader election (leader). This module is the state + token layer; the others are the mechanism.