Publish and migrate resources¶

The cluster administrator decides which Connector identities may publish and which resources users may access. Start with an enrolled Connector, its backend configuration and an administrative identity allowed to manage the catalog. Choose the cluster with contexts use; the examples use that selection.

Automatic publication¶

New authority init and setup prepare configurations explicitly enable automatic publication. Authority assigns each new Connector a namespace and publication scope. Static backends and discovery targets use the same admission rules. Remote backend addresses and secrets are not exposed in the public catalog.

Inspect the enrollment policy and registered nodes from an administrator's host:

gdsgate authority publication show --json
gdsgate authority nodes list --json
gdsgate authority resources list --json

Declare a backend on the Connector host, then start the Connector with its installed configuration. A local SSH backend can use:

[[connector.backends]]
id = "demo-ssh"
kind = "ssh"

The admitted resource appears without a manual resources set. If it is missing, check the node's assigned publication mode, scope, allowed kind and lease, then read the Connector's admission result. The user still needs view to list it and connect plus the protocol actions to use it. Publishing a resource grants no user access.

For a legacy manual Connector, follow manual resources. Changing the cluster's default does not change an existing node's mode.

Initial publication limits¶

The initial automatic assignment has these values. Inspect the live scope with authority scopes list --wide; an administrator can change its admission limits.

Setting	Initial value	Effect
Prefix	Assigned namespace followed by `/`	Resource identities remain bound to this node.
Project / environment	`default` / `unassigned`	Policies must allow these attributes, or the administrator must assign the intended environment.
Live resources	`1000`	Static backends and leased discovery targets share this ceiling.
Lease	`600` seconds	Publication must renew before expiry; Authority sweeps expired rows every `60` seconds by default.
Missing target	`deny`	No parent authorization fallback supplies a missing resource.
SSH host trust	`annotation`	Discovered SSH requires its host-key annotation; static remote SSH requires configured host-key pins.
SSH onward modes	`local`, `certificate`	`client_key` needs an explicit scope update.
Source labels	None accepted	Source labels do not enter policy until explicitly admitted; scope labels remain administrator-controlled.

The initial kind list admits all catalog kinds. A backend still needs the required protocol fields: TCP, MCP, LLM and web-egress need a client-facing port. Scope changes use authority scopes set, which replaces the whole declaration. Retain the assigned prefix and Registry UUID, and include every intended field. An authenticated refusal withdraws routes; an unavailable Authority cannot renew them beyond their existing finite lease.

Qualified IDs and collisions¶

Authority's immutable node namespace distinguishes equal local backend names. For simple local names, two Connectors can publish:

Resource ID	DNS name
`connector-a/demo-ssh`	`demo-ssh.connector-a.gds`
`connector-b/demo-ssh`	`demo-ssh.connector-b.gds`

Use the exact IDs and names returned by the catalog. The assigned namespace can differ from a requested node name. IDs with punctuation or Unicode use reversible encoding; inventing an ID by replacing characters can select another resource.

A globally unique local ID can be used as a short selector. When another catalog entry competes with it, use the qualified ID. Hidden entries also count toward ambiguity; an access-filtered listing is not proof that a short name is unique. Existing manual IDs take precedence and retain their identity.

gdsgate resources list --json
gdsgate ssh connect connector-a/demo-ssh
gdsgate status --refresh --explain

The resident keeps addresses bound to the accepted resource identity. Alias, qualified DNS and resident-IP access use the same canonical identity for authorization, certificates, audit and recordings. Check serving and access separately; a catalog row alone is not a working route.

SSH onward authentication¶

Operation	Omitted onward mode
New manual SSH resource	`local`
Automatic SSH backend without `addr`	`local`
Automatic SSH backend with `addr`	`certificate`
Update an existing manual resource	Preserve its current mode

client_key requires an explicit backend proposal and Authority scope permission. An existing SSH row without a mode needs an explicit decision. See the SSH backend examples.

A remote SSH backend also needs trusted downstream host-key fingerprints. The default automatic scope refuses unpinned remote SSH even when the Connector configuration permits an unpinned upstream. Set host_key_fingerprints before starting the Connector. Onward user authentication and downstream host verification are separate checks.

Manual resources¶

A manual logical resource has an administrator-chosen ID. It can have multiple serving Connector nodes with explicit Registry bindings. Obtain their UUIDs from authority nodes list, then declare the resource and its members:

gdsgate authority resources set shared-ssh --kind ssh
gdsgate authority resources members shared-ssh --json
gdsgate authority resources bind shared-ssh --node "$CONNECTOR_ID"
gdsgate authority resources bind shared-ssh --node "$OTHER_CONNECTOR_ID" --local-id local-ssh

The first member uses local backend ID shared-ssh; the second uses local-ssh. Legacy manual identities require the same local and catalog ID. All members must match the catalog kind, port and onward mode. Automatic resources cannot be converted into a shared manual resource by adding members.

For automation, use --if-revision from the membership response. A stale write is refused. Required audit evidence and bindings commit together. Unbinding the last member closes serving until an explicit assignment; it does not reopen legacy ownership. See manual assignments.

Verify each member's route and an allowed native connection, then remove the test assignment if it is no longer required:

gdsgate authority resources unbind shared-ssh --node "$OTHER_CONNECTOR_ID"
gdsgate authority resources members shared-ssh --json

Removal and restore¶

Removing an automatic resource suppresses that canonical identity. A Connector retry, new snapshot generation or new catalog-row UUID cannot recreate it. An authorized administrator can restore publication eligibility:

gdsgate authority resources remove connector-a/demo-ssh
gdsgate authority resources restore connector-a/demo-ssh

Restore requires an active owner and enabled scope. It removes the suppression; the next valid publication rebuilds the row and route. A removed backend or expired lease still prevents serving. Audit, removal and restoration need the catalog management permission. Restoration does not grant user access.

Connector replacement¶

Keep the Connector configuration and state directory across restarts and upgrades. A forced join registers a new identity; it does not transfer the old namespace, automatic resource IDs or manual serving assignments. Inspect the replacement Registry UUID and update explicit manual bindings, or review the new automatic IDs and policy references. The previous automatic namespace remains reserved. See re-join a Connector for reuse, replacement and platform steps.

Existing clusters¶

Inspect the shared policy before changing it. To enroll future Connectors in automatic mode:

gdsgate authority publication show --json
gdsgate authority publication set auto

Existing Connector identities stay manual with their original resource IDs, policy and onward modes. Use explicit bindings when migrating a manual resource to several serving nodes. New automatic identities get their own namespaces; they do not inherit another node's rights or replace its catalog rows.

To return future enrollment to manual mode, use authority publication set manual. Existing automatic identities retain their assigned scope. Keep the old node's identity and configuration until the migration's policy, audit and recording checks pass. Node replacement and revocation are separate administrative actions.