# Driver `cluster` **Supported keywords:** - ca - cert - comment - dns - dns_reverse - drpnodes - envs - id - name - nodes - quorum - secret ## Keyword `ca` required: false scopable: false convert: list rbac: This driver group requires the root grant. **Default:** `system/sec/ca` **Description:** A whitespace-separated list of `sec` paths. The listener accepts a x509 client certificate if it is trusted by any CA certificate found in these `sec` objects. ## Keyword `cert` required: false scopable: false rbac: This driver group requires the root grant. **Default:** `system/sec/cert` **Description:** The path of the secret hosting the certificate that the listener use for its TLS socket. ## Keyword `comment` required: false scopable: false rbac: This driver group requires the root grant. **Description:** A free form text describing the role of the object, of the node, or of the section it is set in. The keyword is accepted in any section, so the DEFAULT section can document a configuration as a whole, and a resource, pool, heartbeat, array or network section can document itself. The agent does not interpret the value. ## Keyword `dns` required: false scopable: true convert: list rbac: This driver group requires the root grant. **Description:** The list of nodes to set as nameserver in the resolv.conf of the containers the CRM starts. If set, the search will also be set to: 1/ `..svc.` 2/ `.svc.` 3/ ``. ## Keyword `dns_reverse` required: false scopable: false default: true convert: bool rbac: This driver group requires the root grant. **Description:** The cluster nameservers answer the reverse lookups of the addresses of the cluster networks, with the name of the object holding each, from the reverse zones of the addresses om hands out: the ones of the ranges of a lan network, the ones of the whole network for the others. A client allowed to query the cluster nameservers, as a container of any namespace, can then list the names of the objects holding the addresses of a range, those of the other namespaces included, by looking each address up. Set to `false` on a cluster where these names are not to be listed: the reverse lookups of its addresses are then not answered. ## Keyword `drpnodes` required: false scopable: false convert: list rbac: This driver group requires the root grant. **Description:** This list is fetched from the join command payload received from the joined node. The service configuration ``{clusterdrpnodes}`` is resolved to this keyword value. ## Keyword `envs` required: false scopable: false default: CERT DEV DRP FOR INT PRA PRD PRJ PPRD QUAL REC STG TMP TST UAT convert: list rbac: This driver group requires the root grant. **Description:** The list of environment codes the cluster uses, offered as the choice for the `env` keyword of the node and of the objects. The agent does not restrict `env` to this list. It is a site convention, which the user interfaces read from the cluster configuration. ## Keyword `id` required: false scopable: true rbac: This driver group requires the root grant. **Default:** An autogenerated random UUID. **Description:** This unique identifier is auto-generated on install and should never be change by the cluster administrators. It is changed when the node joins a cluster, so the remote cluster id replaces the joiners' cluster id. ## Keyword `name` required: false scopable: false rbac: This driver group requires the root grant. **Default:** A random generated clustername. **Description:** The cluster name is used, * as the zone name in the cluster dns records * in the {fqdn} configuration reference * in the AES secret encryption metadata The cluster name should be unique site-wide. Missing cluster name will be automatically created with random value during daemon startup. It is always lowercased, so better to set it to a lowercase value to avoid confusion. The cluster name is provided to joining nodes, so they can replace their own. ## Keyword `nodes` required: false scopable: false convert: list rbac: This driver group requires the root grant. **Description:** This list of node names contains only the local node name on install. When the node joins a cluster, the joined node provides the new list, with the new node added. The joiner then replace its nodes list with the one received. When a node receives a join request, it adds the new node to its cluster nodes list, then provide the new list to the joiner. ## Keyword `quorum` required: false scopable: false default: false convert: bool rbac: This driver group requires the root grant. **Description:** If `true`, when the cluster is split a vote happens on each cluster node. Each reachable node and each reachable arbitrator give their vote. If the votes is less than half the total number of nodes plus arbitrators, the node trigger a node fencing method defined by `node.split_action` (crash, reboot or disabled). ## Keyword `secret` required: false scopable: true secret: true rbac: This driver group requires the root grant. **Default:** A random string autogenerated on first use **Description:** The cluster shared secret used to encrypt and decrypt heartbeat payloads and `sec` values, with AES256 This secret is auto-generated on install, then merged from the joined nodes when joining a cluster. The cluster secret should be unique site-wide, and be set before starting to add `sec` keys: changing it later leaves the values encrypted with the previous one unreadable.