{
  "id": 1403728,
  "title": "Ask the machine what it is before you change it",
  "url": "https://urgent.news/2026/08/17/ask-the-machine-what-it-is-before-you-change-it",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-17T02:30:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/nasrulhazim/ask-the-machine-what-it-is-before-you-change-it-54k6"
  },
  "original_language": "en",
  "account": "When provisioning virtual machines over SSH, a single question must be answered: does the database have a row corresponding to this address? This question applies to three distinct machines - one administered by the original control plane, one rebuilt by an operator, and one belonging to a different control plane. The database cannot differentiate between them, so the machine itself must identify itself.\n\nTo achieve this, the bootstrap pipeline writes a small JSON file onto each node, serving as the machine's side of its identity. The file contains three crucial pieces of information: the node's UUID, provider's UUID, and the control plane administering it. This file is world-readable, allowing any operator to answer \"what is this machine?\" without requiring administrative privileges.\n\nThe manifest file is carefully designed to be read-only and devoid of sensitive information like private keys or tokens. It is treated as world-readable to enable operators to answer questions about the machine's identity without administrative access. The file does not store sensitive details like private keys or control-plane tokens, thereby reducing potential security risks.\n\nBefore any changes are made to a machine, a single read-only probe is performed to read the manifest, check the database, and return an outcome. The six possible outcomes are: Bootstrap, Reconnect, Upgrade, RefuseUnknownNode, RefuseAddressClaimed, and RefuseForeignControlPlane. Six different cases exist, each indicating whether the operation should proceed or be refused.\n\nThe refusals, namely RefuseUnknownNode, RefuseAddressClaimed, and RefuseForeignControlPlane, are the core of the mechanism. They ensure that the system knows when to proceed with an operation or when to refuse it. For instance, if a machine carries no manifest, it is deemed a rebuilt machine, and the node record should be retired. Similarly, if a machine carries a manifest but cannot be identified by the database, it is considered an unknown node, and the system should look for the location where that record went.\n\nThe refusal messages are designed to guide operators on what action to take. For example, \"unknown node\" prompts the operator to search for a record that exists, while \"address claimed\" indicates that the node has been rebuilt and the record should be retired. Each refusal comes with a distinct message, rather than a generic one, to prevent a vague response. This approach ensures that operators receive clear guidance on how to handle each situation, ultimately making the system more efficient and user-friendly.",
  "summary": "I spent today on a control plane that provisions plain VMs over SSH — the kind of app where a wrong answer doesn't render badly, it reinstalls a database daemon on a machine that's serving traffic. Here's the thing I had to admit: the only question the platform could actually answer about a host was \"is there a row in my database with this address?\" That question is true of three completely…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}