tunnels
Interactive access to an instance or a node through its gateway and daemon: exec, SSH, TCP or the serial console of an instance, or the console of a node. The server's tunnels module hosts this group when the deployment configures `tunnels` with an exec ticket issuer. See [Tunnels](/docs/guides/access/tunnels).
Interactive access to an instance or a node through its gateway and daemon: exec, SSH, TCP or the serial console of an instance, or the console of a node. The server's tunnels module hosts this group when the deployment configures tunnels with an exec ticket issuer. See Tunnels.
All 1 methods are served by this release.
| Method | Kind | Authorization | Phase | Status |
|---|---|---|---|---|
open | mutation | compute:instances:exec @ compute-instance or compute:nodes:console @ compute-node | v0.3 | registered |
open
POST /api/compute/tunnels/open
Issues a single-use exec ticket, valid for 60 seconds, for a tunnel to an instance or a node; returns the ticket, the tunnel id, the node and the path (tunnels/<ticket>, relative to the API base path) the caller then opens.
-
Give exactly one of
instanceIdornodeId. An instance takesexec,ssh,tcp(with aportfrom 1 to 65535) orconsole(its serial console: the daemon opens the domain's console from its runtime, never a host shell), decided withcompute:instances:execoncompute-instance/{instanceId}. A node takesconsoleonly, decided withcompute:nodes:consoleoncompute-node/{nodeId}. Any other combination isINVALID_INPUT. -
Instance tunnels need a daemon that advertises
tunnel.instance-dial: an older one would reach the host rather than the instance, so the call isUNSUPPORTEDwithdetails.reason: 'daemon-capability'; upgrade the daemon. -
A sandbox's instance, or a warm one waiting for a sandbox, takes no tunnels:
INVALID_STATEwithdetails.reason: 'sandbox-managed';sandboxes.execis its only way in. -
NOT_FOUNDwhen the instance is not the tenant's or is still a draft, or the node is outside the tenant's view.UNSUPPORTEDfor a provider instance, which has no node agent to tunnel through. -
INVALID_STATEwhen the instance is notrunningor its node is not connected to a gateway. -
RATE_LIMITED(withretryAfterMs) beyond the per-identity limit of each API replica, 10 tunnels per minute by default. -
Emits
tunnel.issued. -
Kind: mutation
-
Authorization:
compute:instances:exec@compute-instanceorcompute:nodes:console@compute-node -
Module:
tunnels -
Phase: v0.3 (registered)
Input
| Field | Type | Required | Constraints |
|---|---|---|---|
tenantId | string | yes | at most 128 characters; matches ^[A-Za-z0-9._:-]{1,128}$ |
instanceId | string | at most 57 characters; matches ^inst_[0-9a-z]{26,52}$ | |
nodeId | string | at most 57 characters; matches ^node_[0-9a-z]{26,52}$ | |
op | one of exec, console, ssh, tcp | yes | |
port | integer | 1-65535 |
Better Compute is created by Sean Filimon
Last updated
system
The `system` group answers questions about the deployment itself. `whoami` and `version` are public and answer without a credential, which makes them a quick connectivity and credential check; `selfCheck` is a fleet administrator's health report. See [Observability](/docs/operations/observability).
usage
The hourly usage windows compute meters per allocation and hands to Better IAM billing, as the tenant can read them. Both methods decide `compute:usage:read` on `compute-tenant/{tenantId}`, or on `compute-project/{projectId}` when the call names a project, since windows carry their project as a tag. See [Billing and usage](/docs/guides/iam/billing-and-usage).