> ## Documentation Index > Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL. > Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other. > Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking. > Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify. # Get offline Device twin configuration (GET /v1/devices/name/{name}/config/offline) > GET /api/v1/devices/name/{name}/config/offline. Diagnostics API reference. Sign in to try this endpointExplore the parameters, examples, and responses below. Connect your ZedCloud session when you’re ready to send a request. > [accordion] Connect your console > > Sign in to your usual ZedCloud console, then open: > >
    >
  1. Profile menu
  2. Help & Documentation
  3. API Reference
    4. >
> > Your cluster and authorization are filled in automatically. No token to copy. > [More about signing in ](https://zededa.mintlify.site/api-reference/authentication.md#sign-in-to-the-api-reference) Modifying requests stay off until you enable them. [Authentication](https://zededa.mintlify.site/api-reference/authentication.md) · [API availability](https://zededa.mintlify.site/api-reference/clusters.md) · [Download OpenAPI](https://zededa.mintlify.site/openapi/services/diagnostics.json) A successful response. Bad Request. The API gateway did not process the request because of missing parameter or invalid value of parameters. Unauthorized. The API gateway did not process the request because it lacks valid authentication credentials for the target resource. The request header has either no authorization details or an authorization that has been refused. Forbidden. The API gateway did not process the request because the requestor does not have edge-node level access permission for the operation or does not have access scope to the project. Not Found. The API gateway did not process the request because the requested resource could not be found. Internal Server Error. The API gateway experienced an unexpected condition. Specific error condition is indicated in error codes. Gateway Timeout. The API gateway did not receive a timely response from an upstream microservice it needed to communicate with in order to complete the request. An unexpected error response. ## OpenAPI ````yaml openapi/services/diagnostics.json GET /v1/devices/name/{name}/config/offline openapi: 3.0.0 info: title: ZEDEDA Diagnostics Service description: >- ZEDEDA Diagnostics Service is a helper service that provides insight into two things - cloud diagnostics data and edge diagnostics data. As part of Cloud Diagnostics, it allows insight into zedcontrol cluster. As part of Edge Diagnisticss, it collects monitoring data from the edge nodes and presents an aggregated timeline view of resource usage and health of edge nodes termsOfService: https://www.zededa.com/terms version: '1.0' contact: name: ZEDEDA API Support url: https://www.zededa.com/support email: support@zededa.com license: name: Apache 2.0 url: http://www.apache.org/licenses/LICENSE-2.0.html servers: - url: https://{apiHost}/api variables: apiHost: default: invalid.invalid description: Connect from ZedUI to supply your verified API destination. security: - BearerToken: [] tags: - name: CloudDiagnostics - name: EdgeDiagnostics externalDocs: description: ZEDEDA Product Documentation url: https://help.zededa.com/hc/en-us/articles/30323173611931-ZEDEDA-API-Overview paths: /v1/devices/name/{name}/config/offline: get: tags: - EdgeDiagnostics summary: Get offline Device twin configuration description: >- Get offline Device twin configuration for the edge node. Edge node will get this configuration when it queries Cloud controller next time. operationId: EdgeDiagnostics_GetDeviceTwinOfflineConfigByName parameters: - name: name description: user defined device name for a device in: path required: true schema: type: string - name: X-Request-Id in: header required: false description: User-Agent specified id to track a request schema: type: string responses: '200': description: A successful response. content: application/json: schema: $ref: '#/components/schemas/ConfigServiceResp' '400': description: >- Bad Request. The API gateway did not process the request because of missing parameter or invalid value of parameters. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '401': description: >- Unauthorized. The API gateway did not process the request because it lacks valid authentication credentials for the target resource. The request header has either no authorization details or an authorization that has been refused. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '403': description: >- Forbidden. The API gateway did not process the request because the requestor does not have edge-node level access permission for the operation or does not have access scope to the project. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '404': description: >- Not Found. The API gateway did not process the request because the requested resource could not be found. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '500': description: >- Internal Server Error. The API gateway experienced an unexpected condition. Specific error condition is indicated in error codes. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' '504': description: >- Gateway Timeout. The API gateway did not receive a timely response from an upstream microservice it needed to communicate with in order to complete the request. content: application/json: schema: $ref: '#/components/schemas/ZsrvResponse' default: description: An unexpected error response. content: application/json: schema: $ref: '#/components/schemas/googlerpcStatus' externalDocs: description: ZEDEDA Product Documentation url: >- https://help.zededa.com/hc/en-us/articles/30323173611931-ZEDEDA-API-Overview components: schemas: ConfigServiceResp: type: object properties: config: $ref: '#/components/schemas/configEdgeDevConfig' createdAt: type: string format: date-time updatedAt: type: string format: date-time readAt: type: string format: date-time result: $ref: '#/components/schemas/ZsrvResponse' lastKnownStatus: $ref: '#/components/schemas/LastKnownStatus' pconfig: type: string title: protobuf stringified nextConfig: title: >- Next config (config which available for the device, but is not yet pushed to the device) Latest config (config which is generated, but not allowed to be pushed to the device due to config lock configured on the device) allOf: - $ref: '#/components/schemas/configEdgeDevConfig' nextConfigHash: type: string latestConfig: $ref: '#/components/schemas/configEdgeDevConfig' latestConfigHash: type: string localOperatorConsoleBlobList: title: Local Operator Console Blob Config allOf: - $ref: '#/components/schemas/LocalOperatorConsoleBlobList' title: Edge Device Configuration Response to CLI/UI routed via Kafka ZsrvResponse: type: object properties: operationType: title: |- Describes one of the operations type : possible values Read/Delete/Create/Update/List allOf: - $ref: '#/components/schemas/ZcOpsType' operationStatus: title: if this is log running job allOf: - $ref: '#/components/schemas/ZcOpsStatus' objectKind: type: string title: zedcloud object kind on which the operation was performed objectId: type: string title: Unique value identifies the object that was operated on objectName: type: string title: name of the object objectRevision: type: string title: |- object revision post the operation, note Read operation doesn't change the revision objectType: $ref: '#/components/schemas/ObjectType' operationTime: type: string title: time of operation startTime: type: string title: total time taken by operations endTime: type: string user: type: string title: the operation is performed on behalf of this user httpStatusCode: type: integer format: int32 title: http response httpStatusMsg: type: string title: summary of the error in text format jobId: type: string title: for tracking asynchronous tasks error: type: array items: $ref: '#/components/schemas/ZsrvError' title: |- one or more errors will be set if the operation failed i.e. httpStatusCode != 2xx googlerpcStatus: type: object properties: code: type: integer format: int32 message: type: string details: type: array items: $ref: '#/components/schemas/protobufAny' configEdgeDevConfig: type: object properties: id: $ref: '#/components/schemas/configUUIDandVersion' apps: type: array items: $ref: '#/components/schemas/configAppInstanceConfig' networks: type: array items: $ref: '#/components/schemas/configNetworkConfig' datastores: type: array items: $ref: '#/components/schemas/configDatastoreConfig' base: type: array items: $ref: '#/components/schemas/configBaseOSConfig' description: |- OBSOLETE - base. Use baseos instead. Controller should fill this for backward compatibility till all the Older Eve images are no longer supported. reboot: $ref: '#/components/schemas/configDeviceOpsCmd' backup: $ref: '#/components/schemas/configDeviceOpsCmd' configItems: type: array items: $ref: '#/components/schemas/configConfigItem' systemAdapterList: type: array items: $ref: '#/components/schemas/configSystemAdapter' description: |- systemAdapterList - List of DeviceNetworkAdapters. Only Network adapters ( Ex: eth0, wlan1 etc ) have a corresponding SystemAdapter. non-Network adapters do not have systemadapters. deviceIoList: type: array items: $ref: '#/components/schemas/configPhysicalIO' title: |- deviceIoList - List of Physical Adapters. Includes both Network Adapters and Non-Network Adapters ( USB / Com etc ) manufacturer: type: string title: Override dmidecode info if set productName: type: string networkInstances: type: array items: $ref: '#/components/schemas/configNetworkInstanceConfig' cipherContexts: type: array items: $ref: '#/components/schemas/commonCipherContext' title: |- controller supplies a list of cipher contexts, containing certificate and other details, to be used for sensitive data decryption contentInfo: type: array items: $ref: '#/components/schemas/configContentTree' description: |- These images aka ContentTrees and Volumes should be created by EVE independently of any application usage. Application instances will refer to the volumes. volumes: type: array items: $ref: '#/components/schemas/configVolume' controllercertConfighash: type: string description: >- This field is used by the device to detect when it needs to re-download the controller certs using the /certs API endpoint. The controller just needs to ensure this value changes when it wants the device to re-fetch the controller certs, for instance by having it be a hash of all of the controller certificates. maintenanceMode: type: boolean description: >- deprecated 23; If maintence_mode is set the device will operate in a limited mode e.g., not start applications etc as to enable inspection of its state and recover from bad state. controllerEpoch: type: string format: int64 title: >- controller_epoch indicates current epoch of config if we set new epoch, EVE sends all info messages to controller it captures when a new controller takes over and needs all the info be resent baseos: title: Baseos Config Block allOf: - $ref: '#/components/schemas/configBaseOS' globalProfile: type: string description: >- global_profile, if set, controls set of applications which will run. The Activate=true app instances which have this profile in their profile_list will run. If the global_profile is not set, then the profile_list is not used to gate the application instances. localProfileServer: type: string title: >- local_profile_server, if set, indicates a hostname/IPv4/IPv6 address and optional port number at which EVE will request for a local profile. If such a local profile is retrieved, it will override the global_profile. The syntax follows the usual URL server name syntax thus the following are example valid strings: [fe80::1]:1234 10.1.1.1:1234 hostname:1234 [fe80::1] 10.1.1.1 hostname If the port number is not specified, it will default to 8888 profileServerToken: type: string description: |- Together with a local_profile_server one can specify a profile_server_token. EVE must verify that the response from the local_profile_server contains this token. vlans: type: array items: $ref: '#/components/schemas/configVlanAdapter' description: >- A list of VLAN sub-interfaces configured for EVE management traffic and for local network instances. bonds: type: array items: $ref: '#/components/schemas/eveconfigBondAdapter' description: >- A list of bond interfaces (LAGs) aggregating physical network adapters. edgeview: title: edge-view configuration allOf: - $ref: '#/components/schemas/configEdgeViewConfig' disks: title: disks configuration allOf: - $ref: '#/components/schemas/configDisksConfig' shutdown: description: >- Graceful shutdown of all app instances on the edge node. Any local profile server is shut down after all the other app instances have halted. Note that this does not power off the edge node since there is no remote power on capability; power off can be done locally using the Local Profile Server API. allOf: - $ref: '#/components/schemas/configDeviceOpsCmd' deviceName: type: string projectName: type: string projectId: type: string enterpriseName: type: string enterpriseId: type: string configTimestamp: type: string format: date-time description: >- Timestamp updated by controller whenever device config is modified. Used by EVE to properly order configurations that originate at the same controller but get submitted to device through different ways: /config API vs. initial config for bootstrapping vs. USB-based config override etc. This ensures that device will not accidentally revert back to an older configuration. Does not apply to legacy override.json and usb.json mechanisms. locConfig: title: Configuration of the Local Operator Console (LOC) allOf: - $ref: '#/components/schemas/configLOCConfig' patchEnvelopes: type: array items: $ref: '#/components/schemas/configEvePatchEnvelope' cluster: title: cluster configuration allOf: - $ref: '#/components/schemas/eveconfigEdgeNodeCluster' pnacs: type: array items: $ref: '#/components/schemas/configPNAC' description: Port access control configuration per PhysicalIO port. scepProfiles: type: array items: $ref: '#/components/schemas/eveconfigSCEPProfile' description: >- SCEP (Simple Certificate Enrollment Protocol) profiles. Currently used only in conjunction with 802.1X to enroll certificates which are then used for port-based authentication. Support for additional certificate enrollment protocols may be added in the future, each with its own configuration type and profile list. description: >- This is the response to a GET /api/v1/edgeDevice/config The EdgeDevConfig message carries all of the device's configuration from the controller to the device. The device will request these messages either periodically or as a result of some TBD notification. The message is assumed to be protected by a TLS session bound to the device certificate. LastKnownStatus: type: object properties: lastKnownStatusLine: type: string lastAttemptState: type: integer format: int32 lastAttemptedAt: type: string format: date-time LocalOperatorConsoleBlobList: type: object properties: localOperatorConsoleBlobList: type: array items: $ref: '#/components/schemas/LocalOperatorConsoleBlob' controllerCerts: type: string title: Local Operator Console Blob List ZcOpsType: type: string enum: - OPS_TYPE_UNSPECIFIED - OPS_TYPE_READ - OPS_TYPE_DELETE - OPS_TYPE_CREATE - OPS_TYPE_UPDATE - OPS_TYPE_LIST default: OPS_TYPE_UNSPECIFIED title: ZedCloud internal operation type ZcOpsStatus: type: string enum: - OPS_STATUS_UNSPECIFIED - OPS_STATUS_PENDING - OPS_STATUS_ONGOING - OPS_STATUS_COMPLETE default: OPS_STATUS_UNSPECIFIED description: >- - OPS_STATUS_PENDING: In rare cases, system may not start operation when it was requested. Client will be notified that operation is PENDING - OPS_STATUS_ONGOING: system will start the operation, but at the time response was generated, operation is still ONGOING. - OPS_STATUS_COMPLETE: Even if the result of the operations may result in failure, but the OpsStatus will marked COMPLETE for almost all cases. title: ZedCloud internal operation status ObjectType: type: string enum: - OBJECT_TYPE_UNSPECIFIED - OBJECT_TYPE_USER - OBJECT_TYPE_EDGE_NODE - OBJECT_TYPE_EDGE_APP - OBJECT_TYPE_IMAGE - OBJECT_TYPE_EDGE_APP_INSTANCE - OBJECT_TYPE_PROJECT - OBJECT_TYPE_NETWORK - OBJECT_TYPE_DATASTORE - OBJECT_TYPE_SERVICE - OBJECT_TYPE_SERVICE_INSTANCE - OBJECT_TYPE_ENTERPRISE - OBJECT_TYPE_ROLE - OBJECT_TYPE_CREDENTIAL - OBJECT_TYPE_NETWORK_INSTANCE - OBJECT_TYPE_VOLUME_INSTANCE - OBJECT_TYPE_REALM - OBJECT_TYPE_AUTHPROFILE - OBJECT_TYPE_POLICY - OBJECT_TYPE_APP_POLICY - OBJECT_TYPE_CLUSTER_INSTANCE - OBJECT_TYPE_PLUGIN - OBJECT_TYPE_DOC_POLICY - OBJECT_TYPE_ORCHESTRATOR_CLUSTER - OBJECT_TYPE_TAGS - OBJECT_TYPE_EDGE_NODE_INTERFACE - OBJECT_TYPE_DEPLOYMENT - OBJECT_TYPE_ENTITLEMENTS - OBJECT_TYPE_DATA_STREAM - OBJECT_TYPE_API_USAGE - OBJECT_TYPE_APP_INSTANCE_SNAPSHOT - OBJECT_TYPE_PATCH_ENVELOPE - OBJECT_TYPE_RESOURCE_USAGE_TRACK - OBJECT_TYPE_PATCH_ENVELOPE_REFERENCE - OBJECT_TYPE_DEV_PASSTHROUGH - OBJECT_TYPE_EDGE_NODE_CLUSTER - OBJECT_TYPE_ASSET_GROUP - OBJECT_TYPE_APP_PROFILE - OBJECT_TYPE_PROFILE_DEPLOYMENT - OBJECT_TYPE_ZKS_INSTANCE - OBJECT_TYPE_CLUSTER_GROUP default: OBJECT_TYPE_UNSPECIFIED ZsrvError: type: object properties: ec: title: |- Enumrated error code, describes more granular numerical value than just httpStatus allOf: - $ref: '#/components/schemas/ZsrvErrorCode' location: type: string title: 'Ignore: Internal field only' details: type: string title: Field captures string description of details protobufAny: type: object properties: typeUrl: type: string value: type: string format: byte configUUIDandVersion: type: object properties: uuid: type: string version: type: string configAppInstanceConfig: type: object properties: uuidandversion: $ref: '#/components/schemas/configUUIDandVersion' displayname: type: string fixedresources: $ref: '#/components/schemas/configVmConfig' drives: type: array items: $ref: '#/components/schemas/configDrive' description: |- VolumeRefs, if supported by EVE, will supersede drives. Drives still exist for backward compatibility. Drives will be deprecated in the future. The order here is critical because they are presented to the VM or container in the order they are listed, e.g., the first VM image will be the root disk. activate: type: boolean description: Set activate to start the application instance; clear it to stop it. interfaces: type: array items: $ref: '#/components/schemas/configNetworkAdapter' description: >- NetworkAdapter are virtual adapters assigned to the application The order here is critical because they are presented to the VM or container in the order they are listed, e.g., the first NetworkAdapter will appear in a Linux VM as eth0. Also, the MAC address is determined based on the order in the list. adapters: type: array items: $ref: '#/components/schemas/configAdapter' title: |- Physical adapters such as eth1 or USB controllers and GPUs assigned to the application instance. The Name in Adapter should be set to PhysicalIO.assigngrp restart: description: >- The device behavior for a restart command (if counter increased) is to restart the application instance Increasing this multiple times does not imply the application instance will restart more than once. EVE can assume that the adapters did not change. allOf: - $ref: '#/components/schemas/configInstanceOpsCmd' purge: description: >- The EVE behavior for a purge command is to restart the application instance with the first drive/volumeRef recreated from its origin. allOf: - $ref: '#/components/schemas/configInstanceOpsCmd' userData: type: string description: |- App Instance initialization configuration data provided by user This will be used as "user-data" in cloud-init Empty string will indicate that cloud-init is not required It is also used to carry environment variables for containers. XXX will be deprecated and replaced by the cipherData below. remoteConsole: type: boolean description: |- Config flag if the app-instance should be made accessible through a remote console session established by the device. cipherData: title: contains the encrypted userdata allOf: - $ref: '#/components/schemas/commonCipherBlock' collectStatsIPAddr: type: string title: >- The static IP address assigned on the NetworkAdapter which App Container stats collection uses. If the 'collectStatsIPAddr' is not empty and valid, it enables the container stats collection for this App. During App instance creation, after user enables the collection of stats from App, cloud needs to make sure at least one 'Local' type of Network-Instance is assigned to the App interface, and based on the subnet of the NI, statically assign an IP address on the same subnet, e.g. 10.1.0.100 volumeRefList: type: array items: $ref: '#/components/schemas/configVolumeRef' description: |- The volumes to be attached to the app-instance. The order here is critical because they are presented to the VM or container in the order they are listed, e.g., the first VM image will be the root disk. Note that since the name volumeRef was used before and deprecated python protobuf seems to require that we use a different name. metaDataType: title: metadata type to use for app if provided inside userData allOf: - $ref: '#/components/schemas/configMetaDataType' profileList: type: array items: type: string description: >- profile_list is a set of strings which can be used to control which sets of applications are run. Combined with the activate flag above. If the profile list is empty it means wildcard; application will be started independent of the global or local profile specified for the device. startDelayInSeconds: type: integer format: int64 description: >- start_delay_in_seconds - Applicable only when EVE boots up fresh and starts applications for the first time after boot up. This is the amount of time that EVE waits (after boot finish) before starting each application. Default value 0 -> start application immediately. Non-Zero value -> After EVE is ready to start application instance, wait for the given amount of time before starting the respective application instance. service: type: boolean title: >- service - run app instance as a service container in the host/dom0 will override default capabilities with configuration defined in org.mobyproject.config label of image provided by linuxkit cloudInitVersion: type: integer format: int64 description: >- All changes to the cloud-init config are tracked using this version field - once the version is changed cloud-init tool restarts in a guest. snapshot: title: SnapshotConfig is used to track the snapshots of the app instance allOf: - $ref: '#/components/schemas/configSnapshotConfig' patchRef: title: >- PatchEnvelopeRef is used to track all patch envelopes used by the app instance allOf: - $ref: '#/components/schemas/configPatchEnvelopeRef' designatedNodeId: type: string description: >- Designated Node Id is used for cluster nodes to determine placement of the AppInstance when an EdgeNodeCluster config is present. See affinity below to set the desired node affinity. eg. Preferred or Required. vmResolution: type: string description: Custom resolution applies to VM that is running in FML mode only. runtimeType: title: >- AppRuntimeType - to indicate the types of Application Runtime Deployment allOf: - $ref: '#/components/schemas/configAppRuntimeType' affinity: description: |- Affinity is used for cluster nodes to determine preferred or required node scheduling for app instances. Node Id for scheduling is defined in designated_node_id. allOf: - $ref: '#/components/schemas/configAffinityType' description: >- The complete configuration for an Application Instance When changing key fields such as the drives/volumeRefs or the number of interfaces, the controller is required to issue a purge command i.e., increase the purge counter. Otherwise there will be an error (The controller can also issue a purge command to re-construct the content of the first drive/volumeRef without any changes.) Some changes such as ACL changes in the interfaces do not require a restart, but all other changes (such as fixedresources and adapters) require a restart command i.e., an increase to the restart counter. The restart counter can also be increased to cause an application instance restart without any other change to the application instance. configNetworkConfig: type: object properties: id: type: string type: $ref: '#/components/schemas/commonNetworkType' ip: title: network ip specification allOf: - $ref: '#/components/schemas/commonipspec' dns: type: array items: $ref: '#/components/schemas/commonZnetStaticDNSEntry' entProxy: title: enterprise proxy allOf: - $ref: '#/components/schemas/commonProxyConfig' wireless: title: wireless specification allOf: - $ref: '#/components/schemas/configWirelessConfig' mtu: type: integer format: int64 description: >- Maximum transmission unit (MTU) to set on the associated network adapter(s). This is the largest IP packet that the underlying link can and is allowed to carry. This does not include the L2 header size (e.g. Ethernet header or a VLAN tag size). The value is a 16-byte unsigned integer, representing the MTU size in bytes. The minimum accepted value for the MTU is 1280 (RFC 8200, "IPv6 minimum link MTU"). If not defined (zero value), EVE will set the default MTU size, which depends on the network adapter type. Ethernet and WiFi adapters default to 1500 bytes, while cellular modems typically receive their MTU value from the network provider (which EVE will use unless user overrides the MTU value). configDatastoreConfig: type: object properties: id: type: string dType: $ref: '#/components/schemas/configDsType' fqdn: type: string apiKey: type: string title: to be deprecated, use cipherData instead password: type: string title: to be deprecated, use cipherData instead dpath: type: string title: depending on datastore types, it could be bucket or path region: type: string title: Applies for some datastore types cipherData: title: contains the encrypted credentials allOf: - $ref: '#/components/schemas/commonCipherBlock' dsCertPEM: type: array items: type: string format: byte title: Uploaded datastore certificate or certificate chain title: |- The DataStoreConfig contains common parameters for a give source of images aka ContentTrees, such as the credentials and server configBaseOSConfig: type: object properties: uuidandversion: $ref: '#/components/schemas/configUUIDandVersion' drives: type: array items: $ref: '#/components/schemas/configDrive' description: |- volumeID will supersede drives. Drives still exist for backward compatibility. Drives will be deprecated in the future. activate: type: boolean baseOSVersion: type: string volumeID: type: string configDeviceOpsCmd: type: object properties: counter: type: integer format: int64 desiredState: type: boolean opsTime: type: string title: 'FIXME: change to timestamp, once we move to gogo proto' description: >- Device Operational Commands Semantic For rebooting device, command=Reset, counter = counter+delta, desiredState = on For poweroff device, command=Reset, counter = counter+delta, desiredState = off For backup at midnight, command=Backup, counter = counter+delta, desiredState=n/a, opsTime = mm/dd/yy:hh:ss Current implementation does support only single command outstanding for each type. In future can be extended to have more scheduled events. configConfigItem: type: object properties: key: type: string value: type: string description: |- Timers and other per-device policy which relates to the interaction with zedcloud. Note that the timers are randomized on the device to avoid synchronization with other devices. Random range is between between .5 and 1.5 of these nominal values. If not set (i.e. zero), it means the default value of 60 seconds. configSystemAdapter: type: object properties: name: type: string description: |- name - Name of the Network Interface. This is the Port Name used in Info / Metrics / flowlog etc. Name cannot be changed. This will be the Network Port name. freeUplink: type: boolean title: DEPRECATED by cost below uplink: type: boolean title: |- uplink - DEPRECATED by PhysicalIO.Usage / PhysicalIO.UsagePolicy this is part of the uplink group deprecate: have a separate device policy object in the API networkUUID: type: string title: |- networkUUID - attach this network config for this adapter if not set, depending on Usage of Adapter, would be treated as an L2 port addr: type: string description: >- addr - if its static network we need ip address If this is specified, networkUUID must also be specified. addr is expected to be in sync with the network object (same subnet etc ). alias: type: string description: |- alias - Device just reflects it back in status / Metrics back to cloud. lowerLayerName: type: string description: |- lowerLayerName - For example, if lower layer is PhysicalAdapter ( physical interface), this should point to logicallabel of the physicalIO. cost: type: integer format: int64 description: >- Cost of sending traffic over the port. Used to prioritize ports and give preference to lower-cost ports (e.g. eth over wwan). 0 is the lowest cost (free); 255 the highest. Can be set for management and app-shared ports. Cost is used for EVE management traffic and for local network instances with multiple ports. For any request towards the controller or for an image download, EVE tries ports in the order of increasing cost, starting with the free ports. Once it finds the lowest cost port with a working connectivity, it may spread the load if there are multiple connected ports of the same cost. For local networking instances with multiple ports, the cost may be used to decide which port to use for a particular destination network (incl. port selection for the default route). Unlike the management traffic, load-balancing is currently not supported for local network instances and the app traffic that is routed through them. sharedLabels: type: array items: type: string title: >- A set of user-defined "shared" labels attached to the adapter. There are no restrictions on the format of an adapter label, it can be any non-empty string. Unlike the logical label (aka port logical name), shared label is not a unique port identifier. Instead, the same shared label can be assigned to multiple ports. Note that EVE automatically assigns "all" label to every port, "uplink" label to every management port and "freeuplink" label to every management port with zero cost. ("automatically assigns" is meant here in imaginary sense, these labels are not supposed to be explicitly added by the controller to SystemAdapters inside EdgeDevConfig). Shared label can be used to: - designate a group of network adapters to be used by a network instances for external connectivity - limit port-forwarding firewall rule to only a subset of network adapters - create a multi-path static IP route (with multiple ports providing access to the routed destination network) allowLocalModifications: type: boolean description: >- Allow the local operator to make (limited) configuration changes to this network adapter. description: |- systemAdapters are higher-level IP-ready network endpoints. systemAdapters give all the required bits to turn the physical IOs and intermediate L2 objects into useful IP endpoints. These endpoints can be further used to connect to controller or can be shared between workload/services running on the node. configPhysicalIO: type: object properties: ptype: $ref: '#/components/schemas/commonPhyIoType' phylabel: type: string title: |- physical label typically printed on box. Example Eth0, Eth1, Wifi0, ComA, ComB phyaddrs: type: object additionalProperties: type: string description: >- The hardware bus address. The key to this map can be of the following (case-insensitive) values: "pcilong": the address is a PCI id of the form 0000:02:00.0 "ifname": the address is a string for a network interface like "eth1" "serial": the address is a Linux serial port alias such as "/dev/ttyS2" "irq": the address is a number such as "5". This can be a comma separated list of integers or even a range of integers. Hence using a string to address this. "ioports": the address is a string such as "2f8-2ff" "usbaddr": the address is a USB of the form of "1:2.3" If the type is PhyIoNet*, then there needs to be an "ifname" physaddr. logicallabel: type: string title: |- logicallabel - provides the ability to model designer to refer the physicalIO port to using more friendly name For example Eth0->Mgmt0 or USBA->ConfigDiskA etc assigngrp: type: string description: >- This is the name used in AppInstanceConfig.adapters to assign an adapter to an application. If assigngrp is not set, the Adapter cannot be assigned to any application. One example is, when the adapter is on the same Pci bus as another device required by Dom0. Even if there is only one device on the its PCIBus, the assignGrp Must be set. title: |- assigngrp Assignment Group, is unique label that is applied across PhysicalIOs EntireGroup can be assigned to application or nothing at all usage: title: |- usage - indicates the role of adapter ( mgmt / blocked / app-direct etc. ) allOf: - $ref: '#/components/schemas/commonPhyIoMemberUsage' usagePolicy: description: |- usagePolicy - Policy Object used to further refine the usage. For example, specify if this should be only used as fallback? Or used as the primary uplink? Allow App traffic? restrict app traffic?? etc.. allOf: - $ref: '#/components/schemas/configPhyIOUsagePolicy' cbattr: type: object additionalProperties: type: string title: |- physical and logical attributes For example in WWAN to which firmware version to load etc vflist: title: |- list of Virtual Functions (VF) for given Physical Function (PF) only applies for PHY_IO_TYPE_PHY_IO_NET_ETH_PF allOf: - $ref: '#/components/schemas/configVfList' parentassigngrp: type: string description: >- Parent Assignment Group is there to reference the parent assignment group in order to make the device dependent on a different device. Currently the concrete reason to do this is to make a usb device dependent on the PCI address the USB controller is using to prevent passthrough of the USB controller in one application while trying to passthrough a USB device on this controller to another application. We only allow these two cases: - children and their parent devices are assigned to the same application instance - parent device stays in host and one or more children (in separate assignment groups) are assigned to one or more application instances title: parentassigngrp title: |- PhysicalIO: Absolute low level description of physical buses and ports that are available on given platform. Collection of these IOs, constitute what we would call as hardware model. Each physical IO is manageable and visible to EVE software, and it can be further configured to either provide IP connectivity or directly be given to workloads configNetworkInstanceConfig: type: object properties: uuidandversion: $ref: '#/components/schemas/configUUIDandVersion' displayname: type: string instType: title: instType - Type of network instance ( local, bridge etc ) allOf: - $ref: '#/components/schemas/configZNetworkInstType' activate: type: boolean description: |- activate - True by default. If set to false ( deactivate), the network instance configuration is downloaded to the device, but the network instance itself is not created on the device. port: description: >- Port(s) providing external connectivity for the network instance. Either a single port referenced by its name (SystemAdapter.Name, aka logical label) or an adapter shared-label matching zero or more network ports (ports containing this label in SystemAdapter.shared_labels). Note that apart from the user-defined adapter labels, EVE automatically assigns shared label "all" to every port, "uplink" to every management port and "freeuplink" to every management port with zero cost. Both physical (e.g. eth0) and logical (e.g. vlan0) ports are allowed. However, EVE may filter out some of the matched ports which are not compatible with the network instance type (e.g. wireless adapters cannot be used with switch NI and ports without IP addresses are not usable for local NIs). Network instance with no assigned port (empty port reference or label not matching any port) is air-gapped, i.e. completely isolated from external networks. With multiple ports assigned, the behaviour depends on the network instance type. Switch network instance will run Rapid Spanning Tree Protocol (RSTP) to avoid bridge loops and the broadcast storm that results from them. Local network instance will apply IP routes configured for the matched ports (either statically or via DHCP) to select the next hop and the output port for a given flow. Traffic not matching any connected, statically-configured, or DHCP-received route, will be routed according to the default route. Unless user configures a static default route with customized output port selection, EVE will pick one of the ports for the default route by periodic connectivity probing, performed for every selected port (skipped if NI has 1 or 0 ports). First, NI ports are filtered down to those with a known gateway IP. Then probing is used to determine connectivity status. For NIs with EVE-provided "uplink" or "freeuplink" labels, i.e. matching only mgmt ports, EVE checks port gateway IP reachability using ICMP ping and controller reachability with TCP connect to :443. For NIs with user-defined shared-labels, possibly also matching app-shared ports, only ICMP ping of the port gateway is performed. EVE then picks port with a working connectivity, preferring the currently used one. Add a static default route (see 'static_routes" below) to customize the output port selection algorithm. allOf: - $ref: '#/components/schemas/configAdapter' stp: description: >- Configuration for the Spanning Tree Protocol (STP), which is run for switch network instance when the port label matches multiple network ports. allOf: - $ref: '#/components/schemas/configSpanningTreeProtocol' cfg: title: |- cfg - Used to pass some feature-specific configuration to the network instance. For Ex: Lisp, StriongSwan etc allOf: - $ref: '#/components/schemas/configNetworkInstanceOpaqueConfig' ipType: title: type of ipSpec allOf: - $ref: '#/components/schemas/configAddressType' ip: description: >- network ip specification Note that ip.gateway must be a valid IP address and can not be all-zeroes. To suppress automatic propagation of the default route into apps, configure network instance as air-gapped (without port) or mark all NI ports as app-shared (not for management) and ensure that they will not get a default route (e.g. set ip.gateway of the attached NetworkConfig(s) to all-zeroes IP). allOf: - $ref: '#/components/schemas/commonipspec' dns: type: array items: $ref: '#/components/schemas/commonZnetStaticDNSEntry' title: static DNS entry, if we are running DNS/DHCP service propagateConnectedRoutes: type: boolean description: >- Enable to use DHCP to automatically propagate routes for port subnets into applications connected to them indirectly through local network instances. This option is only valid for local network instances. For other types of network instances, it will be ignored. staticRoutes: type: array items: $ref: '#/components/schemas/eveconfigIPRoute' description: >- List of IP routes statically added to the network instance routing table. Statically routed subnets are also propagated to connected applications using DHCP, with gateway set to the network instance bridge IP if it is outside of the network instance subnet. IP route gateway may point to an external endpoint (provided that network instance is not air-gapped), or to an IP address of one of the applications connected to the network instance. For an external gateway, user may specify output port label instead of the IP address. EVE will automatically determine the gateway IP address (based on the port config statically configured or received via DHCP). Static routes are handled independently from connected routes. While connected routes are propagated to applications only if enabled by propagate_connected_routes, static routes are always propagated. Both connected and statically configured routes can be propagated at the same time, there are no restrictions for using both. Note that the default route (with the bridge IP as the gateway) is automatically propagated to connected applications, unless network instance is air-gapped (without port) or all NI ports are app-shared (not management) and neither of them has a default route. In both cases, it is possible to enforce default route propagation by configuring a static default route for the network instance. For more info on static and connected routes please refer to: https://wiki.lfedge.org/display/EVE/Connected+and+Static+IP+Route This option is only valid for local network instances. For other types of network instances, it will be ignored. mtu: type: integer format: int64 description: >- Maximum transmission unit (MTU) to set for the network instance and all application interfaces connected to it. This is the largest IP packet that the network instance is allowed to carry. This does not include the L2 header size (e.g. Ethernet header or a VLAN tag size). The value is a 16-byte unsigned integer, representing the MTU size in bytes. The minimum accepted value for the MTU is 1280 (RFC 8200, "IPv6 minimum link MTU"). If not defined (zero value), EVE will set the MTU to the default value of 1500 bytes. On the host side, MTU is set to interfaces by EVE. On the guest (app) side, the responsibility to set the MTU lies either with EVE or with the user/app, depending on the network instance, app type and the type of interfaces used (local or switch, VM or container, virtio or emulated). For container applications running inside an EVE-created shim-VM, EVE initializes the MTU of interfaces during shim-VM boot. Furthermore, interfaces connected to local network instances will have their MTUs automatically updated if there is a change in MTU configuration. To update the MTU of interfaces connected to switch network instances, the user may run an external DHCP server in the network and publish MTU changes via DHCP option 26 (the DHCP client run by EVE inside shim-VM will pick it up and apply it). In the case of VM applications, it is mostly the responsibility of the app/user to set and keep the MTUs up-to-date. If device provides HW-assisted virtualization capabilities, EVE will connect VM with network instances using para-virtualized virtio interfaces, which allow to propagate MTU value from the host to the guest. If the virtio driver used by the app supports the MTU propagation (VIRTIO_NET_F_MTU feature flag is set), the initial MTU values will be set using virtio (regardless of the network instance type). To support MTU update for interfaces connected to local network instances, the app can run a DHCP client and receive the latest MTU via DHCP option 26. For switch network instances, the user can run his own external DHCP server in the network with the MTU option configured. Please note that application traffic leaving or entering the device via a network adapter associated with the network instance is additionally limited by MTU values of NI ports, configured within their NetworkConfig objects (refer to netconfig.proto). If the configured network instance MTU is higher than MTU of any of the NI ports, EVE will flag the network instance with an error and use the lowest MTU among all the NI ports for the network instance instead. This is to prevent apps from sending packets exceeding the path MTU. Packets entering NI via port with a higher MTU and with size exceeding the NI MTU will get fragmented inside EVE (if allowed by IP header). By default (if MTU is not configured by the user, i.e. 'mtu' is zero), EVE uses 1500 as MTU for air-gapped network instances and the lowest MTU among NI ports for NIs with external connectivity. disableFlowlog: type: boolean description: >- Disable flow logging for this network instance. When flow logging is enabled, EVE periodically records all application TCP and UDP flows. A flow record includes the application UUID, VIF name, open/close timestamps, source/destination IP/port/protocol 5-tuple, and packet and byte counters. Additionally, EVE records every DNS request made by an application, including the request time, the hostname being resolved, and the returned IP address(es). The flow logging API can be found in proto/config/flowlog/flowlog.proto If flow logging is not needed, it is recommended to disable this feature as it can potentially generate a large amount of data, which is then uploaded to the controller. Depending on the implementation, it may also introduce additional packet processing overhead. vlanAccessPorts: type: array items: $ref: '#/components/schemas/configVlanAccessPort' description: >- VLAN access ports configured for a switch network instance. For other types of network instances, this option is ignored. This setting applies to physical network ports attached to the network instance. VLAN configuration for application interfaces is applied separately via AppInstanceConfig (see NetworkAdapter.access_vlan_id). forwardLldp: type: boolean description: >- Enables forwarding of LLDP (Link Layer Discovery Protocol) frames across this network instance. LLDP is used by devices to advertise identity and capabilities to directly connected neighbors, and is often required for topology discovery and network management tools. When enabled, LLDP frames (EtherType 0x88cc) are not dropped or suppressed by the forwarding plane. commonCipherContext: type: object properties: contextId: type: string title: cipher context id, key to this structure hashScheme: title: algorithm used to compute hash for certificates allOf: - $ref: '#/components/schemas/evecommonHashAlgorithm' keyExchangeScheme: description: for key exchange scheme, like ECDH etc. allOf: - $ref: '#/components/schemas/commonKeyExchangeScheme' encryptionScheme: description: for encrypting sensitive data, like AES256 etc. allOf: - $ref: '#/components/schemas/commonEncryptionScheme' deviceCertHash: type: string format: byte title: device public certificate hash controllerCertHash: type: string format: byte title: controller certificate hash title: Cipher information to decrypt Sensitive Data configContentTree: type: object properties: uuid: type: string dsId: type: string URL: type: string iformat: $ref: '#/components/schemas/configFormat' sha256: type: string title: The sha is for the top blob of the ContentTree maxSizeBytes: type: string format: uint64 description: |- maxSizeBytes used for capping resource consumption in EVE. maxSizeBytes indicates the maximum download size of content tree. siginfo: $ref: '#/components/schemas/configSignatureInfo' displayName: type: string generationCount: type: string format: int64 description: >- For container ContentTree, sha256 might not be available in config. If the sha256 is not available then it needs to be resolved corresponding to the tag change in generation_count indicates that the resolution of tag is needed generation_count needs to be updated when purge is required for an existing instance. In case of new instance using the same content tree, EVE will get new content tree UUID in the device configuration from the controller. customMetaData: type: string description: >- An arbitrary string. Usage depends on the content purpose. Currently the only usage is with custom application blobs (AppCustom) - this string will appear in the restAPI endpoint available at http://169.254.169.254. So user application can read that data and treat the blob accordingly. dsIdsList: type: array items: type: string description: >- List of DatastoreConfig UUIDs, that must have the same content. In case of network failure, the download process can fallback to the next datastore in the list. designatedNodeId: type: string description: |- To inform the edge-node if the device receiving this content tree is responsible for content tree download or not. title: |- ContentTree describes the top of some content tree. The controller needs to allocate a uuid for it, and that uuid will be sent by EVE in the ZInfoContentTree message configVolume: type: object properties: uuid: type: string origin: description: origin of the volume content. allOf: - $ref: '#/components/schemas/configVolumeContentOrigin' protocols: type: array items: $ref: '#/components/schemas/configVolumeAccessProtocols' title: |- describes all the different ways how this Volume can be offered to Tasks generationCount: type: string format: int64 title: >- change in generationCount indicates that the mutated volume needs to be purged and built from scratch. This is a generalization of the purge command for an application instance maxsizebytes: type: string format: int64 description: |- miscellaneous attributes of the Volume maxSizeBytes Used for capping resource consumption in EVE. maxSizeBytes indicates the maximum size of the volume. readonly: type: boolean displayName: type: string clearText: type: boolean target: $ref: '#/components/schemas/configTarget' designatedNodeId: type: string title: |- To inform the edge-node if the device receiving this Volume is responsible for volume creation, convert PVC, or not description: >- The Volume describes a storage volume which should exist on the device. This can currently either be blank or created from a ContentTree If maxSizeBytes is zero it means unlimited by the controller. In that case EVE needs to determine how much space it can assign and limit any downloaded ContentTree and the created volume based on that calculated size. configBaseOS: type: object properties: contentTreeUuid: type: string title: UUID for ContentTree with BaseOS image retryUpdate: description: >- retry_update Retry the BaseOs update if the update failed previously. 1) If this image is in FAILED state, retry the image update. 2) If this image is already active and fully installed (PartitionState = UPDATED), Do nothing. Just update the baseos_update_counter in Info message. 3) If this image is same as active image, but status is NOT yet UPDATED, or if the update to this image is in progress, wait till the update concludes (Success / Error+rollback) - then trigger the retry as needed. allOf: - $ref: '#/components/schemas/configDeviceOpsCmd' activate: type: boolean title: |- if not set BaseOS will be installed, but not activated baseOsVersion: type: string configVlanAdapter: type: object properties: logicallabel: type: string description: Logical name of this VLAN adapter. interfaceName: type: string description: >- A physical name of the VLAN sub-interface. Note that the interface name is limited in Linux kernel to 15 characters. If not defined, logicallabel will be used instead. lowerLayerName: type: string description: Logical name of the lower layer adapter (bond or physicalIO). vlanId: type: integer format: int64 description: VLAN ID. Valid values are from 1 to 4094. description: |- VlanAdapter represents a single VLAN sub-interface. The parent, which is referenced by lower_layer_name, should be either PhysicalIO or BondAdapter. eveconfigBondAdapter: type: object properties: logicallabel: type: string description: Name of this bond adapter. interfaceName: type: string description: >- A physical name of the bond interface. Note that the interface name is limited in Linux kernel to 15 characters. If not defined, logicallabel will be used instead. lowerLayerNames: type: array items: type: string description: >- Logical names of aggregated PhysicalIOs. For all bonding modes but Active-Backup the order is irrelevant. In the Active-Backup mode (BOND_MODE_ACTIVE_BACKUP), the first PhysicalIO in the list will be considered as the primary port (i.e. only when the primary is off-line will alternate ports be used). bondMode: title: >- A bonding mode specifies the policy indicating how bonding slaves are used during network transmission allOf: - $ref: '#/components/schemas/eveconfigBondMode' mii: description: >- The MII monitor is driver-dependent. It monitors the links from the device to the nearest connected switch. If the failure occurs beyond the nearest connected switch, it cannot be detected by MII monitor. allOf: - $ref: '#/components/schemas/eveconfigMIIMonitor' arp: description: |- The ARP monitor is based on the communication to the target hosts designated by their IP addresses. Even if the link is beyond the nearest connected switch, the APR monitor can detect it. allOf: - $ref: '#/components/schemas/eveconfigArpMonitor' lacpRate: description: |- Option specifying the rate in which EVE will ask LACP link partners to transmit LACPDU packets in 802.3ad mode. allOf: - $ref: '#/components/schemas/eveconfigLacpRate' description: >- BondAdapter aggregates multiple PhysicalIOs into one adapter for redundancy and load-spreading purposes. configEdgeViewConfig: type: object properties: token: type: string title: |- JWT token for signed info, it contains the dispatcher endpoint IP:Port, device UUID, nonce and expiration time dispCertPem: type: array items: type: string format: byte title: dispatcher certificate(s) if it's not well-known CA signed devPolicy: title: policy for device access through edge-view allOf: - $ref: '#/components/schemas/configDevDebugAccessPolicy' appPolicy: title: policy access for apps through edge-view allOf: - $ref: '#/components/schemas/configAppDebugAccessPolicy' extPolicy: title: policy access for external endpoint through edge-view allOf: - $ref: '#/components/schemas/configExternalEndPointPolicy' generationId: type: integer format: int64 title: Generation ID for re-start edgeview without parameter changes configDisksConfig: type: object properties: disks: type: array items: $ref: '#/components/schemas/configDiskConfig' arrayType: $ref: '#/components/schemas/configDisksArrayType' children: type: array items: $ref: '#/components/schemas/configDisksConfig' description: >- For example to use stripe of two pairs of mirrored disks we should define DisksConfig without disks with array_type DISKS_ARRAY_TYPE_RAID0 with two children with properly defined disks inside and with array_type DISKS_ARRAY_TYPE_RAID1 and empty children title: >- DisksConfig is a configuration of disks We expect information about disks to be filled and will try to adjust disks states accordingly All disks defined in disks field expected to have array type defined in array_type To support nested topologies we can use children field configLOCConfig: type: object properties: locUrl: type: string title: If set indicates URL of the Local Operator Console (LOC) datastoreCollectInfoId: type: array items: type: string description: >- several datastores can be specified, but at the current moment only one will be supported this is done to be extensible to allow to specify the datastore or have alternatives in case of failure title: >- UUID of the datastore to upload the collect-info tarball to - only DsHttp and DsHttps is currently possible the directory is specified by dpath in DatastoreConfig and the filename is the standard collect-info.sh filename with the device uuid concatenated, f.e.: eve-info-v34-2025-05-13-08-53-52-5d0767ee-0547-4569-b530-387e526f8cb9.tar.gz configEvePatchEnvelope: type: object properties: displayName: type: string title: Unique name provided by user uuid: type: string title: Unique version: type: string title: arbitrary version from user action: title: way this object should be treated allOf: - $ref: '#/components/schemas/configEVE_PATCH_ENVELOPE_ACTION' artifacts: type: array items: $ref: '#/components/schemas/configEveBinaryArtifact' appInstIdsAllowed: type: array items: type: string title: |- List of application instance ids that should be allowed to access this patch envelope createTime: type: string format: date-time title: Time object created in UTC format eveconfigEdgeNodeCluster: type: object properties: clusterName: type: string title: cluster name, in case it has multiple cluster on the same site clusterId: type: string title: cluster UUID clusterInterface: type: string title: >- Cluster-Interface, for example "mgmt0", this is the logicallabel of the physicalIO clusterIpPrefix: type: string title: >- the 'cluster-prefix' IP address of the 'Cluster-Interface', 10.244.244.2/28 isWorkerNode: type: boolean title: This device is an 'Agent' node joinServerIp: type: string title: Server IP address to join the cluster. E.g. 10.244.244.1 encryptedClusterToken: title: encrypted token string, use edge-node TPM to decrypt allOf: - $ref: '#/components/schemas/commonCipherBlock' clusterType: title: >- Cluster Type for eve to determine component, app, and volume scheduling needs allOf: - $ref: '#/components/schemas/eveconfigClusterType' tieBreakerNodeId: type: string description: |- Node Id for eve to disable all pod scheduling EVE-OS should use this to set kubernetes node labels identifying the tie-breaker node to the kubernetes scheduler. Node labels are used in the node selector specification of kubernetes objects to direct pod scheduling away from a specific node due to node limitations. haScheme: description: High-availability scheme used by the cluster control plane. allOf: - $ref: '#/components/schemas/configHAScheme' loadBalancerService: description: Optional load balancer service configuration. allOf: - $ref: '#/components/schemas/configLoadBalancerService' masterNodeUuids: type: array items: type: string description: |- UUIDs of all designated master/control-plane nodes in the cluster, as known to the controller. Surviving EVE nodes use this list to prune k8s Node objects (and thereby k3s embedded etcd members) for masters the controller has removed (e.g. after a "replace node" operation in the UI). Workers are not listed here. configPNAC: type: object properties: logicallabel: type: string title: >- Logical name of the associated physical Ethernet interface (PhysicalIO.logicallabel) eapIdentity: type: string description: >- EAP identity (optional). Even when certificate-based authentication is used (e.g., EAP-TLS), an explicit EAP identity may be configured and does not need to match the certificate’s DN or SAN attributes. If no EAP identity is configured and a certificate-based EAP method is used, EVE will derive the identity from the enrolled certificate, preferring the subject common name (CN), or the SAN URI if CN is absent. eapMethod: description: >- EAP method to use for authentication. Currently, only EAP-TLS is supported; additional methods may be added in the future. allOf: - $ref: '#/components/schemas/eveconfigEAPMethod' certEnrollmentProfileName: type: string description: >- Certificate enrollment profile to use for authentication. Relevant only when the selected EAP method requires a certificate (e.g., EAP-TLS). This field references the profile_name of a certificate enrollment profile defined in EdgeDevConfig (currently SCEP profiles only, see scep_profiles). While SCEP is the only supported enrollment protocol today, this field is intended to reference any supported enrollment profile in the future. description: Configuration for Port-based Network Access Control (PNAC). eveconfigSCEPProfile: type: object properties: profileName: type: string description: >- User-assigned logical name for this certificate enrollment profile. Must be unique within the device configuration. Currently, this name is unique among EdgeDevConfig.scep_profiles only. In the future, when additional certificate enrollment protocols are supported, profile names are expected to be unique across all enrollment profile types. scepUrl: type: string title: |- Full SCEP server URL, including scheme, host, and path. Example: https://ca.example.com/scep useControllerProxy: type: boolean description: >- If true, SCEP requests are sent via the controller-provided SCEP proxy. If false, the device connects directly to the SCEP server. The proxy option is intended for deployments where the SCEP server is not reachable from the unauthenticated or provisioning network. scepChallengePassword: description: |- Encrypted SCEP challenge password. Used for one-time or shared-secret–based authorization during certificate enrollment. allOf: - $ref: '#/components/schemas/commonCipherBlock' caCertPem: type: array items: type: string format: byte description: |- Trusted CA certificate chain used for SCEP operations. Required by RFC 8894, Section 2.2. - Each certificate in the chain that is capable of key encryption (typically only the issuing CA) will receive a copy of the encrypted symmetric key used to encrypt the PKCS#7 certificate enrollment request. - The full set of certificates is used to validate the CA signature on SCEP responses. csrProfile: description: |- Certificate Signing Request (CSR) configuration profile. Defines subject attributes, key parameters, and extensions for the certificate enrollment request. allOf: - $ref: '#/components/schemas/eveconfigCSRProfile' description: |- SCEP (Simple Certificate Enrollment Protocol) configuration profile. Defines how a device enrolls for X.509 certificates using SCEP, including server connectivity, trust anchors, and CSR parameters. LocalOperatorConsoleBlob: type: object properties: devId: type: string config: type: string encryptedConfig: type: string title: Local Operator Console Blob ZsrvErrorCode: type: string enum: - zMsgErrorNone - zMsgSucess - NotFound - AlreadyExists - VersionMismatch - RangeError - LargeResult - IncompleteData - InvalidData - FunctionUnsupported - NoMemory - SendFailure - Timeout - BadReqBody - BadReqParam - InvalidFieldFormat - UrlNotFound - ApiVersionNotSupported - Unauthorized - Forbidden - Conflict - NotModified - DependencyConflict - JsonFmtError - ProtoFmtError - CertError - DataBaseConnection - DBError - zMsgAccepted - zMsgCreated - PreConditionFailed - InternalServerError default: zMsgErrorNone description: |- - zMsgErrorNone: common validation errors - IncompleteData: message had fields that weren't filled in - InvalidData: message contained the field that wasn't expected - FunctionUnsupported: this feature unavailable on this version of device - InvalidFieldFormat: message contained the field that wasn't correctly formatted - JsonFmtError: Marshal / Unmarshal errors - DataBaseConnection: generic DB error title: ZedCould internal error code configVmConfig: type: object properties: kernel: type: string ramdisk: type: string memory: type: integer format: int64 title: in kbytes; rounded up to Mbytes for xen maxmem: type: integer format: int64 title: in kbytes; xen only, default equal to 'memory', so no ballooning vcpus: type: integer format: int64 description: The amount of the VCPUs in the VM. maxcpus: type: integer format: int64 description: >- In the case of the Xen hypervisor - the maximal amount of the VCPUs available to the VM. Can be greater than `vcpus` (the VCPUs online on the VM start). If the field is not set, it is initialized by EVE to the value in the `vcpus` field. rootdev: type: string extraargs: type: string bootloader: type: string cpus: type: string description: >- Currently is not handled by EVE. CPU mask of the CPUs assigned to the VM. Represented in the form "d[[,-]d]*". E.g. "0-2" or "0-2,5,6". CPUs start with 0. For example, the mask "0,3" would mean that only physical CPUs 0 and 3 are available for the VM. devicetree: type: string dtdev: type: array items: type: string irqs: type: array items: type: integer format: int64 iomem: type: array items: type: string virtualizationMode: $ref: '#/components/schemas/configVmMode' enableVnc: type: boolean title: Enable VNC access to the edge application vncDisplay: type: integer format: int64 vncPasswd: type: string disableLogs: type: boolean title: Change of the 'disable logs' field can be handled without VM reboot pinCpu: type: boolean description: >- Set if the VM should run in a mode with pinned CPUs. In this case any VCPU thread created by QEMU runs on a dedicated physical CPU. All the other QEMU threads will be limited to run on the physical CPUs defined by CPU mask. The CPU mask is provided with the 'cpus' field, defined above. If the CPU mask is not set, the physical CPUs to be used for running QEMU threads are picked automatically by Pillar: it just takes that amount of available physical CPUs that is defined with the 'vcpus' parameter defined above. vmmMaxmem: type: integer format: int64 title: |- Maximum amount of memory in kbytes allowed for VM monitor to occupy, aka "overhead". E.g. for the qemu-kvm hypervisor the memory limit for one VM instance (guest RAM + VM monitor) is set according to the following equation: `memory` + `vmm_maxmem` enableVncShimVm: type: boolean title: >- Enable VNC access to the shim VM harboring the edge application (for containers only) bootMode: title: 'Boot mode: Legacy or UEFI' allOf: - $ref: '#/components/schemas/configVmBootMode' enforceNetworkInterfaceOrder: type: boolean description: >- Enables enforcement of user-defined ordering for network interfaces. This applies to both virtual interfaces (specified in the "AppInstanceConfig.interfaces" list) and directly assigned network adapters (specified in the "AppInstanceConfig.adapters" list as items of type "PhyIoNetEth", "PhyIoNetWLAN", "PhyIoNetWWAN", and "PhyIoNetEthVF"). Note: Older versions of EVE may not support enforcing the user-defined order of application network interfaces. The controller can check "ZInfoDevice.api_capability" to verify if the configured device supports the API capability "API_CAPABILITY_ENFORCED_NET_INTERFACE_ORDER". Please beware that EVE's ability to influence the order of VM application interfaces is limited. Depending on the application's operating system, achieving the desired network interface order might not be possible. enableOemWinLicenseKey: type: boolean title: The app should receive the Windows license embedded in ACPI tables disableVtpm: type: boolean description: |- Disable vTPM for the VM, this defaults to false according to the proto3 specification. bootOrder: description: >- Boot order configuration for this VM. Controls boot device priority, particularly for USB devices. Priority hierarchy (highest to lowest): 1. LPS API (/api/v1/app-boot-config) - if LPS has a cached config for the app 2. This field (boot_order) - if not BOOT_ORDER_UNSPECIFIED 3. Device property (app.boot.order) - device-wide default Note: LPS config is cached and persisted to disk. This allows boot order to be applied immediately after EVE reboot, before LPS VM is available. If LPS returns 404, the cache is cleared and Controller/Device settings apply. See PROFILE.md for detailed LPS response handling. The setting is passed to OVMF via fw_cfg "opt/eve.bootorder" when the VM starts. Changes take effect on the next VM restart. allOf: - $ref: '#/components/schemas/commonBootOrder' configDrive: type: object properties: image: $ref: '#/components/schemas/eveconfigImage' readonly: type: boolean preserve: type: boolean drvtype: $ref: '#/components/schemas/configDriveType' target: $ref: '#/components/schemas/configTarget' maxsizebytes: type: string format: int64 description: |- maxsizebytes indicates the maximum size of the volume. Initial image size will be resized to the maxsizebytes iff maxsizebytes is greater than the image size. title: XXX the Drive will be deprecated and we will use Volumes instead configNetworkAdapter: type: object properties: name: type: string networkId: type: string addr: type: string hostname: type: string cryptoEid: type: string title: more configuration for getting addr/EID lispsignature: type: string pemcert: type: string format: byte pemprivatekey: type: string format: byte macAddress: type: string title: |- Used in case of P2V, where we want to specify a macAddress to vif, that is simulated towards app acls: type: array items: $ref: '#/components/schemas/configACE' title: firewall accessVlanId: type: integer format: int64 title: >- access port vlan id app interface with access vlan id of zero will be treated as trunk port valid vlan id range: 2 - 4093 vlan id 1 is implicitly used by linux bridges allowToDiscover: type: boolean title: |- allow AppInstance to discover other AppInstances attached to this network instance. Default is false interfaceOrder: type: integer format: int64 description: >- Define the network interface order relative to other virtual network adapters and directly assigned network devices. The numbering is across both the "Adapter" (direct assignments) and the "NetworkAdapter" (virtual interfaces) lists for a given "AppInstanceConfig", thus every entry in these lists, excluding non-networking adapters, must have a unique order number (when the "enforce_network_interface_order" is enabled, see "VmConfig"). Interface with a lower order value should appear inside the application before interface with a higher order value. The implementation of this ordering may depend on the hypervisor. For example, the hypervisor might virtualize the PCI bus and assign lower PCI addresses to interfaces with lower order values. But the actual outcome of interface ordering depends on the application and EVE therefore cannot guarantee desired order. Since this field was introduced in later versions, older EVE versions do not support user-defined interface ordering. For backward compatibility, the user-defined order is applied only if "enforce_network_interface_order" is enabled for the given application (see "VmConfig", file "vm.proto"). configAdapter: type: object properties: type: $ref: '#/components/schemas/commonPhyIoType' name: type: string ethVf: $ref: '#/components/schemas/configEthVF' interfaceOrder: type: integer format: int64 description: >- Define the network interface order relative to other directly assigned network devices and virtual network adapters. Only applies to (assignable) network adapters, i.e. types: "PhyIoNetEth", "PhyIoNetWLAN", "PhyIoNetWWAN" and "PhyIoNetEthVF". The numbering is across both the "Adapter" (direct assignments) and the "NetworkAdapter" (virtual interfaces) lists for a given "AppInstanceConfig", thus every entry in these lists, excluding non-networking adapters, must have a unique order number (when the "enforce_network_interface_order" is enabled, see "VmConfig"). Interface with a lower order value should appear inside the application before interface with a higher order value. The implementation of this ordering may depend on the hypervisor. For example, the hypervisor might virtualize the PCI bus and assign lower PCI addresses to interfaces with lower order values. But the actual outcome of interface ordering depends on the application and EVE therefore cannot guarantee desired order. Since this field was introduced in later versions, older EVE versions do not support user-defined interface ordering. For backward compatibility, the user-defined order is applied only if "enforce_network_interface_order" is enabled for the given application (see "VmConfig", file "vm.proto"). description: |- Adapter bundles corresponding to a subset of what is in ZioBundle When used by a NetworkInstanceConfig the name is the logicallabel for the network adapter. configInstanceOpsCmd: type: object properties: counter: type: integer format: int64 opsTime: type: string commonCipherBlock: type: object properties: cipherContextId: type: string title: cipher context id initialValue: type: string format: byte title: Initial Value for Symmetric Key derivation cipherData: type: string format: byte title: encrypted sensitive data clearTextSha256: type: string format: byte title: sha256 of the plaintext sensitive data title: Encrypted sensitive data information configVolumeRef: type: object properties: uuid: type: string generationCount: type: string format: int64 mountDir: type: string title: |- Indicates volume mount point inside container if mount_dir is empty then it will be mounted on /mnt title: >- Reference to a Volume specified separately in the API If a volume is purged (re-created from scratch) it will either have a new UUID or a new generationCount configMetaDataType: type: string enum: - MetaDataDrive - MetaDataNone - MetaDataOpenStack - MetaDataDriveMultipart default: MetaDataDrive title: Type of cloud-init data to provide to application configSnapshotConfig: type: object properties: activeSnapshot: type: string description: >- active_snapshot is the id of the snapshot which is expected to be used by the application. It may be empty if no snapshot expected to be used. rollbackCmd: description: >- rollback_cmd is used to trigger a rollback to the snapshot with the active_snapshot id. The counter inside the InstanceOpsCmd is incremented when a snapshot is used for a rollback. It should not be decreased. The counter's semantics is the same as the one used in the restart/purge commands. It's necessary for the cases, when the state of the device is behind the controller because it hasn't yet managed to fetch the latest declarative statement. Only increasing the counter will trigger the rollback. allOf: - $ref: '#/components/schemas/configInstanceOpsCmd' maxSnapshots: type: integer format: int64 description: >- max_snapshots is the maximum number of snapshots that can be stored for the application instance. If the number of snapshots exceeds the max_snapshots, the oldest snapshot will be deleted. It's so even if the oldest snapshot is the active one. As an example, let's consider the following scenario: The value of max_snapshots is 1. Then a snapshot is created. VM continues working. Then a rollback to the snapshot created earlier is requested, so the first snapshot becomes active. EVE performs the rollback. Then the controller requests a new snapshot be created. EVE is configured to store only 1 snapshot, hence the first one should be deleted. snapshots: type: array items: $ref: '#/components/schemas/configSnapshotDesc' description: >- snapshots is the list of snapshots of the application instance. It is used to synchronize the list of snapshots between the controller and the device. This can be used to provide an id of a new snapshot or to delete an existing snapshot. To provide a new snapshot id, the controller should send a message with the new snapshot id in the snapshots list. The id is generated by Controller in this case. (It can be also generated by EVE, if the snapshot creation is triggered locally. In this case the ID will be returned in the ZInfoApp.snapshots[].id field, see the `info.proto` file). Worth noting that the snapshot creation is not triggered by the appearance of the snapshot id in the available_snapshots list. The snapshot creation will be triggered by the behaviour defined in the snapshot type field. To delete a snapshot, the controller should send a message that does not contain the snapshot id in the available_snapshots list. The device will delete the snapshot with the absent id. title: The snapshot information for an Application Instance configPatchEnvelopeRef: type: object properties: name: type: string title: |- one of them should be non-empty non-empty name overrides the id id: type: string configAppRuntimeType: type: string enum: - APP_RUNTIME_TYPE_UNSPECIFIED - APP_RUNTIME_TYPE_DOCKER default: APP_RUNTIME_TYPE_UNSPECIFIED description: |- AppRuntimeType - to indicate the types of Application Deployment For instance, the need to gather of docker container metrics and logs from the agent inside applications on EVE device. configAffinityType: type: string enum: - AFFINITY_TYPE_PREFERRED - AFFINITY_TYPE_REQUIRED default: AFFINITY_TYPE_PREFERRED description: >- - AFFINITY_TYPE_PREFERRED: Preferred - designated_node_id is preferred for placement but if the node is unhealthy, app can run on other nodes. - AFFINITY_TYPE_REQUIRED: Required - designated_node_id is required to be healthy for app instance to boot, app will not failover to other nodes. title: Type of app instance affinity commonNetworkType: type: string enum: - NETWORKTYPENOOP - V4 - V6 - CryptoV4 - CryptoV6 - CryptoEID - V4Only - V6Only - DualV4V6 default: NETWORKTYPENOOP commonipspec: type: object properties: dhcp: $ref: '#/components/schemas/commonDHCPType' subnet: type: string title: subnet is CIDR format...x.y.z.l/nn gateway: type: string domain: type: string ntp: type: string title: |- ntp and more_ntp are used as a union to specify several NTP servers via IP address or FQDN this is for historical reasons when we only allowed to specify one NTP server moreNtp: type: array items: type: string dns: type: array items: type: string dhcpRange: description: |- for IPAM management when dhcp is turned on. If none provided, system will default pool. allOf: - $ref: '#/components/schemas/commonipRange' dhcpOptionsIgnore: title: |- Even if DhcpType is Client, EVE still accepts static IP config and will merge it with the DHCP-provided one by default use the following option to override this behavior allOf: - $ref: '#/components/schemas/commonDhcpOptionsIgnore' title: Common for IPv4 and IPv6 commonZnetStaticDNSEntry: type: object properties: HostName: type: string Address: type: array items: type: string title: These are list of static mapping that can be added to network commonProxyConfig: type: object properties: networkProxyEnable: type: boolean title: enable network level proxy in the form of WPAD proxies: type: array items: $ref: '#/components/schemas/commonProxyServer' title: dedicated per protocol information exceptions: type: string title: exceptions separated by commas pacfile: type: string title: |- or pacfile can be in place of others base64 encoded networkProxyURL: type: string title: Direct URL for wpad.dat download proxyCertPEM: type: array items: type: string format: byte title: >- Uploaded proxy certificate or certificate chain for MITM this may be needed either in explicit (has ProxyServer items), automatic (networkProxyEnable) or transparent (network layer not aware of proxy) configWirelessConfig: type: object properties: type: $ref: '#/components/schemas/evecommonWirelessType' cellularCfg: type: array items: $ref: '#/components/schemas/configCellularConfig' wifiCfg: type: array items: $ref: '#/components/schemas/configWifiConfig' configDsType: type: string enum: - DsUnknown - DsHttp - DsHttps - DsS3 - DsSFTP - DsContainerRegistry - DsAzureBlob - DsGoogleStorage default: DsUnknown commonPhyIoType: type: string enum: - PhyIoNoop - PhyIoNetEth - PhyIoUSB - PhyIoCOM - PhyIoAudio - PhyIoNetWLAN - PhyIoNetWWAN - PhyIoHDMI - PhyIoNVMEStorage - PhyIoSATAStorage - PhyIoNetEthPF - PhyIoNetEthVF - PhyIoUSBController - PhyIoUSBDevice - PhyIoCAN - PhyIoVCAN - PhyIoLCAN - PhyIoOther default: PhyIoNoop commonPhyIoMemberUsage: type: string enum: - PhyIoUsageNone - PhyIoUsageMgmtAndApps - PhyIoUsageShared - PhyIoUsageDedicated - PhyIoUsageDisabled - PhyIoUsageMgmtOnly default: PhyIoUsageNone description: |- PhyIoMemberUsage - Indicates how each adaptor must be used by Eve. - PhyIoUsageMgmtAndApps: Used by both management and apps. - PhyIoUsageShared: Shared by multiple apps - PhyIoUsageDedicated: used by only one app - PhyIoUsageDisabled: Adapter Blocked. Do not use the Adapter. - PhyIoUsageMgmtOnly: Used for Management traffic only. Cannot be used by Apps. configPhyIOUsagePolicy: type: object properties: freeUplink: type: boolean title: |- Given additional details for EVE software to how to treat this interface. Example policies could be limit use of LTE interface or only use Eth1 only if Eth0 is not available etc Note that this is the static information from the model. Current configuration is in systemAdapter configVfList: type: object properties: vfCount: type: integer format: int64 title: how many Virtual Functions (VF) will be created data: type: array items: $ref: '#/components/schemas/configEthVF' title: optional configuration for given Virtual Function (VF) configZNetworkInstType: type: string enum: - ZNetInstFirst - ZnetInstSwitch - ZnetInstLocal - ZnetInstCloud - ZnetInstMesh - ZnetInstHoneyPot - ZnetInstTransparent - ZNetInstLast default: ZNetInstFirst configSpanningTreeProtocol: type: object properties: portsWithBpduGuard: type: string description: >- Ports matched by this adapter label (logical or shared) will have the BPDU guard enabled. It makes sense to enable the guard on ports which are expected to be leafs and therefore not participate in STP, or where the downstream bridges are not fully trusted. description: >- Configuration for the Spanning Tree Protocol (STP), which is run for switch network instance when the port label matches multiple network ports. configNetworkInstanceOpaqueConfig: type: object properties: oconfig: type: string lispConfig: $ref: '#/components/schemas/configNetworkInstanceLispConfig' type: $ref: '#/components/schemas/configZNetworkOpaqueConfigType' description: |- Network Instance Opaque config. In future we might add more fields here but idea is here. This is service specific configuration. configAddressType: type: string enum: - First - IPV4 - IPV6 - CryptoIPV4 - CryptoIPV6 - Last default: First eveconfigIPRoute: type: object properties: destinationNetwork: type: string description: >- Destination network address in the CIDR format: / It is allowed to submit default route with all-zeroes destination network address 0.0.0.0/0 or ::/0. gateway: type: string description: >- Gateway IP address. This must be a valid IP address and can not be all-zeroes. At least one of 'gateway' or 'port' (see below) must be defined (both can be set). This can be an external gateway IP or an IP address of one of the app instances connected to the network instance. port: type: string description: >- Output device port for the routed traffic. Either a single NI port referenced by its name (SystemAdapter.Name, aka logical label) or an adapter shared-label matching zero or more NI ports (multipath routing). Can be used additionally to or instead of `gateway` to determine the next hop and the output network interface for the destination network. At least one of 'gateway' or 'port' must be defined. Since 'port' refers to one or more physical network adapters, it is not applicable to routes where gateway points to another application instance running on EVE. If shared label is used, EVE will pick (at most) one of the matched ports to be used for route at a given time. Port is selected based on connectivity status, port costs, wwan signal strength, etc. - see config options below. Note that load-balancing across multiple ports is not yet supported. Also please note that if `gateway` is defined, only ports with subnets containing the gateway IP will be considered. probe: description: >- Periodically probe remote endpoint to determine connectivity status of every port selected for the route (by the 'port' label, see above). One of the ports with a working connectivity is then picked for the route. If there are multiple connected ports, other port selection criteria are considered (port costs, wwan signal strength, etc., see other options of IPRoute). Probing effectively provides automatic fail-over between ports. If 'port' is not defined or references only a single port (e.g. directly by the logical label), probing is skipped (nothing to fail-over to anyway). If probing is not enabled, EVE picks the port based on other remaining criteria, such as cost, wwan network signal, etc. (and eventually possibly making a random choice). allOf: - $ref: '#/components/schemas/configPortProbe' preferLowerCost: type: boolean description: >- When EVE is deciding which port to use for multipath route and multiple ports have working connectivity (or probing is disabled), port can be selected based on the cost (see SystemAdapter.cost). If this option is enabled, EVE will prefer ports with lower costs. preferStrongerWwanSignal: type: boolean description: >- When EVE is deciding which port to use for multipath route and there are multiple candidates among cellular modems, it might make sense to consider the current cellular network signal strength. If this option is enabled, EVE will prefer cellular ports with better signal (only among cellular ports). configVlanAccessPort: type: object properties: vlanId: type: integer format: int64 title: VLAN ID from the range <1,4094> accessPort: type: string description: >- Physical network adapter used as the access port for the given VLAN. Either a single NI port referenced by its name (SystemAdapter.Name, aka logical label) or an adapter shared-label matching zero or more NI ports. description: >- VLAN Access Port config applied to physical port(s) attached to a Switch Network Instance. evecommonHashAlgorithm: type: string enum: - HASH_ALGORITHM_INVALID - HASH_ALGORITHM_SHA256_16BYTES - HASH_ALGORITHM_SHA256_32BYTES default: HASH_ALGORITHM_INVALID commonKeyExchangeScheme: type: string enum: - KEA_NONE - KEA_ECDH default: KEA_NONE title: Security Key Exchange Method commonEncryptionScheme: type: string enum: - SA_NONE - SA_AES_256_CFB default: SA_NONE title: Encryption Scheme for Cipher Payload configFormat: type: string enum: - FmtUnknown - RAW - QCOW - QCOW2 - VHD - VMDK - OVA - VHDX - CONTAINER - ISO - PVC default: FmtUnknown configSignatureInfo: type: object properties: intercertsurl: type: string signercerturl: type: string signature: type: string format: byte description: |- XXX this will be deprecated when all deployed instances of EVE no longer expect it. 5.6.X depend on it. 5.7.1 does not. configVolumeContentOrigin: type: object properties: type: $ref: '#/components/schemas/configVolumeContentOriginType' downloadContentTreeID: type: string configVolumeAccessProtocols: type: string enum: - VAP_NONE - VAP_9P default: VAP_NONE title: The protocol that the task will use to access the Volume configTarget: type: string enum: - TgtUnknown - Disk - Kernel - Initrd - RamDisk - AppCustom default: TgtUnknown eveconfigBondMode: type: string enum: - BOND_MODE_UNSPECIFIED - BOND_MODE_BALANCE_RR - BOND_MODE_ACTIVE_BACKUP - BOND_MODE_BALANCE_XOR - BOND_MODE_BROADCAST - BOND_MODE_802_3AD - BOND_MODE_BALANCE_TLB - BOND_MODE_BALANCE_ALB default: BOND_MODE_UNSPECIFIED description: >- A bonding mode specifies the policy indicating how bonding slaves are used during network transmission. - BOND_MODE_UNSPECIFIED: BOND_MODE_UNSPECIFIED : if bonding mode is not explicitly specified, then by default Round-Robin policy is applied (BOND_MODE_BALANCE_RR). - BOND_MODE_BALANCE_RR: BOND_MODE_BALANCE_RR : transmit packets in sequential order from the first available slave through the last. This mode provides load balancing and fault tolerance. This is the default bonding mode. - BOND_MODE_ACTIVE_BACKUP: BOND_MODE_ACTIVE_BACKUP : only one slave in the bond is active. A different slave becomes active if, and only if, the active slave fails. The bond's MAC address is externally visible on only one port to avoid confusing the switch. This mode provides fault tolerance. - BOND_MODE_BALANCE_XOR: BOND_MODE_BALANCE_XOR : packet source and destination MAC addresses are used to calculate hash and select the output slave interface accordingly. This algorithm will place all traffic destined to a particular network peer on the same slave. This mode provides load balancing and fault tolerance. - BOND_MODE_BROADCAST: BOND_MODE_BROADCAST: transmits everything on all slave interfaces. This mode provides fault tolerance. - BOND_MODE_802_3AD: BOND_MODE_802_3AD : IEEE 802.3ad Dynamic link aggregation. Creates aggregation groups that share the same speed and duplex settings. Utilizes all slaves in the active aggregator according to the 802.3ad specification. Requires that upstream networks equipment supports and has the IEEE 802.3ad Dynamic link aggregation properly configured. - BOND_MODE_BALANCE_TLB: BOND_MODE_BALANCE_TLB : adaptive transmit load balancing. Channel bonding that does not require any special switch support. The outgoing traffic is distributed according to the current load (computed relative to the speed) on each slave. Incoming traffic is received by the current slave. If the receiving slave fails, another slave takes over the MAC address of the failed receiving slave. This mode provides (TX) load balancing and fault tolerance. - BOND_MODE_BALANCE_ALB: BOND_MODE_BALANCE_ALB : adaptive load balancing. Includes BOND_MODE_BALANCE_TLB plus receive load balancing (RLB) for IPV4 traffic, and does not require any special switch support. The receive load balancing is achieved by ARP negotiation. This mode provides load balancing and fault tolerance. eveconfigMIIMonitor: type: object properties: interval: type: integer format: int64 description: >- Specifies the MII link monitoring frequency in milliseconds. This determines how often the link state of each bond slave is inspected for link failures. updelay: type: integer format: int64 description: >- Updelay specifies the time, in milliseconds, to wait before enabling a bond slave after a link recovery has been detected. The updelay value should be a multiple of the monitoring interval; if not, it will be rounded down to the nearest multiple. The default value is 0. downdelay: type: integer format: int64 description: >- Specifies the time, in milliseconds, to wait before disabling a bond slave after a link failure has been detected. The downdelay value should be a multiple of the monitoring interval; if not, it will be rounded down to the nearest multiple. The default value is 0. description: |- MIIMonitor : MII link monitoring parameters. Defined for BondAdapter. eveconfigArpMonitor: type: object properties: interval: type: integer format: int64 description: >- Interval specifies the ARP link monitoring frequency in milliseconds. ipTargets: type: array items: type: string description: >- IpTargets specifies the IPv4 addresses to use as ARP monitoring peers. These are the targets of ARP requests sent to determine the health of links. description: |- ArpMonitor : ARP-based link monitoring parameters. Defined for BondAdapter. eveconfigLacpRate: type: string enum: - LACP_RATE_UNSPECIFIED - LACP_RATE_SLOW - LACP_RATE_FAST default: LACP_RATE_UNSPECIFIED description: |- Option specifying the rate in which EVE will ask LACP link partners to transmit LACPDU packets in 802.3ad mode. - LACP_RATE_UNSPECIFIED: Default LACP rate is Slow. - LACP_RATE_SLOW: Request LACP partner to transmit LACPDUs every 30 seconds. - LACP_RATE_FAST: Request LACP partner to transmit LACPDUs every 1 second. configDevDebugAccessPolicy: type: object properties: allowDev: type: boolean title: device side of edge-view access is allowed or not title: Dev debug policy applicable to edge-view configAppDebugAccessPolicy: type: object properties: allowApp: type: boolean title: app side of edge-view access is allowed or not title: App debug policy applicable to edge-view configExternalEndPointPolicy: type: object properties: allowExt: type: boolean title: external of device side of edge-view access is allowed or not title: >- External Endpoint applicable to edge-view To mean the entity external to the device, e.g. a local-profile server on the LAN outside of mgmt or app-shared ports. since it's not part of EVE, and not part of EVE applications. In the EdgeView code, if tcp session setup is to an address we don't have, it identifies the request as 'external' configDiskConfig: type: object properties: disk: $ref: '#/components/schemas/evecommonDiskDescription' oldDisk: title: >- define old disk here to replace it with new one defined in disk, omit it to not use replacement allOf: - $ref: '#/components/schemas/evecommonDiskDescription' diskConfig: $ref: '#/components/schemas/configDiskConfigType' title: >- DiskConfig describe desired configuration of disk If we want change state to online/offline we should define its state If we want to add disk we should define it here and set DiskConfigType to online or offline If we want to remove disk we should set its state to unused or appdirect If we want to replace disk we should fill old_disk to be replaced with disk Progress of operation is expected to be available in info messages configDisksArrayType: type: string enum: - DISKS_ARRAY_TYPE_UNSPECIFIED - DISKS_ARRAY_TYPE_RAID0 - DISKS_ARRAY_TYPE_RAID1 - DISKS_ARRAY_TYPE_RAID5 - DISKS_ARRAY_TYPE_RAID6 default: DISKS_ARRAY_TYPE_UNSPECIFIED title: DisksArrayType is the desired configuration of disks in DisksConfig configEVE_PATCH_ENVELOPE_ACTION: type: string enum: - STORE - ACTIVATE default: STORE configEveBinaryArtifact: type: object properties: format: title: base64 or binary blob only - secret type is invalid allOf: - $ref: '#/components/schemas/configEVE_OPAQUE_OBJECT_CATEGORY' inline: $ref: '#/components/schemas/eveconfigInlineOpaqueBase64Data' volumeRef: $ref: '#/components/schemas/eveconfigExternalOpaqueBinaryBlob' encryptedInline: description: |- There is an intended skip in field IDs here to handle the existing artifactMetaData and metadata_cipher_data fields. allOf: - $ref: '#/components/schemas/configEncryptedInlineOpaqueBase64Data' encryptedVolumeref: $ref: '#/components/schemas/configEncryptedExternalOpaqueBinaryBlob' artifactMetaData: type: string title: If metadata_cipher_data is set then artifactMetaData can be ignored metadataCipherData: description: >- Optional encryption for EveBinaryArtifact.artifactMetaData CipherBlock.cipherData should contain the encrypted serialized copy of an EncryptionBlock structure with EncryptionBlock.user = ENCRYPTION_BLOCK_USER_BINARY_ARTIFACT_METADATA and EncryptionBlock.encrypted_data set to the EveBinaryArtifact.artifactMetaData text. allOf: - $ref: '#/components/schemas/commonCipherBlock' eveconfigClusterType: type: string enum: - CLUSTER_TYPE_UNSPECIFIED - CLUSTER_TYPE_K3S_BASE - CLUSTER_TYPE_REPLICATED_STORAGE - CLUSTER_TYPE_HA default: CLUSTER_TYPE_UNSPECIFIED title: >- - CLUSTER_TYPE_K3S_BASE: cluster with only native kubernetes orchestration for user applications - CLUSTER_TYPE_REPLICATED_STORAGE: cluster with orchestration by EVE APIs for user applications - CLUSTER_TYPE_HA: deprecated configHAScheme: type: string enum: - HA_SCHEME_UNSPECIFIED - HA_SCHEME_K3S_EMBEDDED default: HA_SCHEME_UNSPECIFIED title: >- - HA_SCHEME_K3S_EMBEDDED: k3s embedded ETCD/raft HA scheme with 3, 5, etc control plane nodes configLoadBalancerService: type: object properties: interfaces: type: array items: $ref: '#/components/schemas/configLoadBalancerInterface' eveconfigEAPMethod: type: string enum: - EAP_METHOD_UNSPECIFIED - EAP_METHOD_TLS default: EAP_METHOD_UNSPECIFIED title: Supported EAP methods eveconfigCSRProfile: type: object properties: commonName: type: string description: X.509 Distinguished Name (DN) attributes. organization: type: string organizationalUnit: type: string country: type: string state: type: string locality: type: string sanDns: type: array items: type: string description: X.509 Subject Alternative Name (SAN) attributes. sanIp: type: array items: type: string sanUri: type: array items: type: string sanEmail: type: array items: type: string renewPeriodPercent: type: integer format: int64 description: |- Certificate renewal settings. Percentage of the certificate validity period after which the device should attempt renewal (e.g., 80 = renew after 80%). keyType: description: Key algorithm and parameters used to generate the private key. allOf: - $ref: '#/components/schemas/eveconfigKeyType' hashAlgorithm: description: |- Hash algorithm used for signing operations (CSR generation, SCEP messages, etc.). allOf: - $ref: '#/components/schemas/eveconfigHashAlgorithm' description: |- Certificate Signing Request (CSR) configuration profile. Defines subject identity, extensions, cryptographic parameters, and renewal behavior for certificate enrollment. configVmMode: type: string enum: - PV - HVM - Filler - FML - NOHYPER - LEGACY default: PV description: |- For now we need to tell the device which virtualization mode to use. Later we might use a single one for all VMs (on any particular ISA). If we end up keeping this we should make the names be less tied to a particular hypervisor. configVmBootMode: type: string enum: - VM_BOOT_MODE_UNSPECIFIED - VM_BOOT_MODE_LEGACY - VM_BOOT_MODE_UEFI default: VM_BOOT_MODE_UNSPECIFIED title: Boot mechanisms supported by the BIOS of the Virtual Machine commonBootOrder: type: string enum: - BOOT_ORDER_UNSPECIFIED - BOOT_ORDER_USB - BOOT_ORDER_NOUSB default: BOOT_ORDER_UNSPECIFIED description: >- BootOrder controls boot device priority for VMs. Used by both Controller API (VmConfig.boot_order) and LPS API (AppBootConfig.usb_boot). - BOOT_ORDER_UNSPECIFIED: Default boot order (no modification). The actual behavior depends on whether a custom OVMF.fd is used: if custom OVMF.fd is provided, its precooked boot order applies; otherwise, USB has priority according to the UEFI standard. - BOOT_ORDER_USB: Enable USB boot priority - OVMF will prioritize USB devices in boot order. - BOOT_ORDER_NOUSB: Disable USB boot - OVMF will deprioritize USB devices in boot order. eveconfigImage: type: object properties: uuidandversion: $ref: '#/components/schemas/configUUIDandVersion' name: type: string title: >- it could be relative path/name as well; appended to the datastore dpath sha256: type: string iformat: $ref: '#/components/schemas/configFormat' siginfo: title: if its signed image allOf: - $ref: '#/components/schemas/configSignatureInfo' dsId: type: string sizeBytes: type: string format: int64 description: |- sizeBytes indicates the maximum download size of an image. A value of 0 will indicate the unlimited download. title: XXX the Image will be deprecated and we will use ContentTree instead configDriveType: type: string enum: - Unclassified - CDROM - HDD - NET - HDD_EMPTY default: Unclassified description: >- - HDD_EMPTY: this type is allocate the empty disk of maxsizebytes specified title: XXX the DriveType will be deprecated when we deprecate Drive configACE: type: object properties: matches: type: array items: $ref: '#/components/schemas/configACEMatch' title: |- multiple matches here is for various fields of 6 tuples for example 1) host=www.example.com & port=http 2) ip=8.8.8.8 & port=53 & proto=UDP 3) adapter=uplink && port=8080 && proto=TCP actions: type: array items: $ref: '#/components/schemas/configACEAction' description: |- Expect only single action...repeated here is for future work. name: type: string id: type: integer format: int32 dir: $ref: '#/components/schemas/configACEDirection' configEthVF: type: object properties: index: type: integer format: int64 mac: type: string vlanId: type: integer format: int64 title: Information regarding Virtual Function (VF) customisation configSnapshotDesc: type: object properties: id: type: string description: >- id of the snapshot. The format of the ID is a standard UUIDv4. Should be unique within the app instance. Generated by the Controller in the case the snapshot creation is requested by the Controller, or by EVE in the case the snapshot creation is triggered locally. Corresponds to the ZInfoApp.snapshots[].id field (see the `info.proto` file). type: description: type of the snapshot creation trigger. allOf: - $ref: '#/components/schemas/eveconfigSnapshotType' title: A descriptor of the snapshot instance commonDHCPType: type: string enum: - DHCPNoop - Static - DHCPNone - Client default: DHCPNoop title: |- - Static: Statically configure the DHCP for port - DHCPNone: Don't run any DHCP, we are in passthrough mode for app - Client: Run the DHCP client on this port commonipRange: type: object properties: start: type: string end: type: string commonDhcpOptionsIgnore: type: object properties: ntpServerExclusively: type: boolean description: >- When true, statically configured NTP servers are used exclusively, ignoring any NTP servers provided by DHCP. If true and no static NTP servers are set, no NTP servers will be used. For DHCP (IPv4), this applies to option 42. For DHCPv6 (IPv6), this applies to option 56. ipAddressesExclusively: type: boolean description: >- When true, statically configured IP addresses are used exclusively, ignoring any IP addresses provided by DHCP. If true and no static IP addresses are set, the interface will have no IP assigned. dnsConfigExclusively: type: boolean description: >- When true, statically configured DNS servers and domain name(s) are used exclusively, ignoring any DNS-related configuration provided by DHCP. If true and no static DNS servers are set, no DNS servers will be used. Similarly, if no static domain name(s) are set, no domain name(s) will be used. For DHCP (IPv4), this applies to option 6 (DNS servers), option 15 (single domain name), and option 119 (search domains). For DHCPv6 (IPv6), this applies to option 23 (DNS servers) and option 24 (domain search list). gatewaysExclusively: type: boolean description: >- When true, statically configured gateway addresses are used exclusively, ignoring any routers provided by DHCP. If true and no static routers are set, no gateway will be used. For DHCP (IPv4), this applies to option 3. For DHCPv6 (IPv6), this applies to option 24. description: |- DhcpOptionsIgnore specifies which DHCP-provided options should be ignored by the device, allowing static configuration to override DHCP where applicable. Currently supported options include: - IP addresses - NTP servers - DNS servers and domains - Router (gateway) addresses This allows flexible merging or exclusive use of static config fields. For full DHCP option references: - DHCP: https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml - DHCPv6: https://www.iana.org/assignments/dhcpv6-parameters/dhcpv6-parameters.xhtml commonProxyServer: type: object properties: proto: $ref: '#/components/schemas/commonproxyProto' server: type: string port: type: integer format: int64 evecommonWirelessType: type: string enum: - TypeNOOP - WiFi - Cellular default: TypeNOOP configCellularConfig: type: object properties: APN: type: string description: >- APN string - by default it is "internet". TO BE DEPRECATED: Fill connection arguments inside access_points instead. If access_points is non-empty, then APN field is ignored. probe: description: |- Optional cellular connectivity probing. By default it is enabled. allOf: - $ref: '#/components/schemas/configCellularConnectivityProbe' locationTracking: type: boolean description: >- Some LTE modems have GNSS receiver integrated and can be used for device location tracking. Enable this option to have location info periodically obtained from this modem and published to controller and to applications. accessPoints: type: array items: $ref: '#/components/schemas/configCellularAccessPoint' description: |- Parameters to apply for connecting to cellular networks. Configured separately for every SIM card inserted into the modem. activatedSimSlot: type: integer format: int64 description: |- Select SIM card slot to activate. Currently, EVE support only single-standby SIM card mode. 0 - unspecified (leave the currently activated) 1 - activate the first SIM slot 2 - activate the second SIM slot etc. configWifiConfig: type: object properties: wifiSSID: type: string keyScheme: $ref: '#/components/schemas/commonWiFiKeyScheme' identity: type: string title: to be deprecated, use cipherData instead password: type: string title: to be deprecated, use cipherData instead crypto: $ref: '#/components/schemas/WifiConfigcryptoblock' priority: type: integer format: int32 cipherData: $ref: '#/components/schemas/commonCipherBlock' configNetworkInstanceLispConfig: type: object properties: LispMSs: type: array items: $ref: '#/components/schemas/configZcServicePoint' LispInstanceId: type: integer format: int64 allocate: type: boolean exportprivate: type: boolean allocationprefix: type: string format: byte allocationprefixlen: type: integer format: int64 experimental: type: boolean title: various configuration to dataPlane, lispers.net vs Zededa title: Lisp NetworkInstance config configZNetworkOpaqueConfigType: type: string enum: - ZNetOConfigVPN - ZNetOConfigLisp default: ZNetOConfigVPN configPortProbe: type: object properties: enableGwPing: type: boolean description: >- Use ICMP ping towards the port's gateway IP to determine connectivity status. This probing is performed much more frequently than the custom_probe and provides faster fail-over. On the other hand, it generates more traffic through the probed ports. Use gw_ping_max_cost (see below) to limit which ports it is enabled for based on the port cost. Avoid using this probe method if the gateway router is configured to drop/ignore ICMP pings and therefore this probe method would return false negatives. gwPingMaxCost: type: integer format: int64 description: >- Ports exceeding this cost will have the gateway probing disabled to reduce traffic generated by probing (only less-frequent custom_probe will be performed). customProbe: description: >- User-defined method to use to determine the port connectivity status. Run additionally to gateway pings (if enabled). allOf: - $ref: '#/components/schemas/commonConnectivityProbe' description: Configuration for port connectivity probe. configVolumeContentOriginType: type: string enum: - VCOT_UNKNOWN - VCOT_BLANK - VCOT_DOWNLOAD default: VCOT_UNKNOWN evecommonDiskDescription: type: object properties: name: type: string logicalName: type: string serial: type: string title: |- DiskDescription describes disk we can use different data to locate disk in the system configDiskConfigType: type: string enum: - DISK_CONFIG_TYPE_UNSPECIFIED - DISK_CONFIG_TYPE_EVEOS - DISK_CONFIG_TYPE_PERSIST - DISK_CONFIG_TYPE_ZFS_ONLINE - DISK_CONFIG_TYPE_ZFS_OFFLINE - DISK_CONFIG_TYPE_APPDIRECT - DISK_CONFIG_TYPE_UNUSED default: DISK_CONFIG_TYPE_UNSPECIFIED title: DiskConfigType is the desired configuration of disks configEVE_OPAQUE_OBJECT_CATEGORY: type: string enum: - UNKNOWN - BASE64 - BINARYBLOB - SECRET default: UNKNOWN eveconfigInlineOpaqueBase64Data: type: object properties: base64Data: type: string title: base64 encoded data fileNameToUse: type: string title: |- file name to be used for storing this data same file name shall be advertised to application agent base64MetaData: type: string title: any arbitrary metadata encoded to base64 string eveconfigExternalOpaqueBinaryBlob: type: object properties: imageName: type: string title: Name of the image uploaded into data store fileNameToUse: type: string title: |- file name to be used for storing this data in EVE the same file name shall be advertised to application agent if it's empty EVE will use image name blobMetaData: type: string title: can be image type or size encoded into a single string imageId: type: string title: |- Target field of Volume set to AppCustom refers to UUID of a volume configEncryptedInlineOpaqueBase64Data: type: object properties: cipherData: title: Encrypted serialized copy of InlineOpaqueBase64Data allOf: - $ref: '#/components/schemas/commonCipherBlock' configEncryptedExternalOpaqueBinaryBlob: type: object properties: cipherData: title: Encrypted serialized copy of ExternalOpaqueBinaryBlob allOf: - $ref: '#/components/schemas/commonCipherBlock' configLoadBalancerInterface: type: object properties: interfaceName: type: string addressCidrs: type: array items: type: string eveconfigKeyType: type: string enum: - KEY_TYPE_UNSPECIFIED - KEY_TYPE_RSA_2048 - KEY_TYPE_RSA_3072 - KEY_TYPE_RSA_4096 - KEY_TYPE_ECDSA_P256 - KEY_TYPE_ECDSA_P384 - KEY_TYPE_ECDSA_P521 default: KEY_TYPE_UNSPECIFIED description: |- Supported key types (algorithm and parameters). - KEY_TYPE_RSA_2048: RSA key types. - KEY_TYPE_ECDSA_P256: ECDSA key types. eveconfigHashAlgorithm: type: string enum: - HASH_ALGORITHM_UNSPECIFIED - HASH_ALGORITHM_SHA256 - HASH_ALGORITHM_SHA384 - HASH_ALGORITHM_SHA512 default: HASH_ALGORITHM_UNSPECIFIED description: Supported hash algorithms for signing. configACEMatch: type: object properties: type: type: string description: |- Supported ACE match types: * "ip": value should be an IP address of a remote endpoint. The match is satisfied for outbound and inbound flow if the destination and the source IP address matches the given value, respectively. Can be combined with any other match type to further narrow down the selection criteria. * "host": value should be a domain name of a remote endpoint. It can be either a fully qualified, or a partially qualified domain name (FQDN or PQDN). A packet is matched if it is destined to or originated from an IP address that was obtained by a DNS query for that exact domain or any of its subdomains. For example, match of type "host" with value "domain.com" will also apply to the endpoint "subdomain.domain.com". Can be combined with other match types except for "eidset". * "eidset": special match type for the overlay network. Matches IPs of all applications deployed in the same network as well as all IPs with statically configured DNS entries (under the config field NetworkInstanceConfig.Dns). For this type, value field is not used. Can be combined with other match types except for "host". * "protocol": value should specify the protocol to match. Protocol can be one of "tcp", "udp", "icmp", or "all", or it can be a numeric value, representing one of these protocols or a different one. A protocol name from /etc/protocols is also allowed. Protocol match can be combined with any other match type (often combined with port numbers). * "lport": value should be an application local port number. For filtering actions, this is the source port for outbound traffic and destination port for inbound traffic. For PORTMAP action, this represents application port as exposed to the external network (i.e., if :2222 is mapped to :22, lport refers to 2222). lport can be combined with any other match type. It is actually required to combine "lport" and "protocol" inside the same ACE. In other words, port without protocol is not valid. * "fport": value should be a remote endpoint port number (foreign port). Used for filtering actions, but not for PORTMAP (do not confuse with "lport", which is still used to represent the forwarded port - the forwarded port is still considered as local). "fport" can be combined with any other match type. It is actually required to combine "fport" with "protocol" inside the same ACE. In other words, port without protocol is not valid. * "adapter": value should be an adapter shared label (SystemAdapter.shared_labels). It can be used for an inbound ACE to apply the rule only to packets arriving via one of the matched network adapters. Typically used to activate a given port-forwarding rule (PORTMAP) for only a subset of network adapters. When not specified, the rule applies to every port attached to the network instance (i.e. equivalent to setting "adapter" to the pre-defined shared label "all"). Adapter label cannot be used for outbound ACE. This is because the EVE firewall is applied before routing, and the output network adapter is not yet known. value: type: string configACEAction: type: object properties: drop: type: boolean limit: type: boolean title: limit action, and its associated parameter limitrate: type: integer format: int64 limitunit: type: string limitburst: type: integer format: int64 portmap: type: boolean title: port map action, and its associated parameter appPort: type: integer format: int64 configACEDirection: type: string enum: - BOTH - INGRESS - EGRESS default: BOTH eveconfigSnapshotType: type: string enum: - SNAPSHOT_TYPE_UNSPECIFIED - SNAPSHOT_TYPE_APP_UPDATE - SNAPSHOT_TYPE_IMMEDIATE default: SNAPSHOT_TYPE_UNSPECIFIED title: Type of the snapshot creation trigger commonproxyProto: type: string enum: - PROXY_HTTP - PROXY_HTTPS - PROXY_SOCKS - PROXY_FTP - PROXY_OTHER default: PROXY_HTTP configCellularConnectivityProbe: type: object properties: disable: type: boolean description: If true, then probing is disabled. probeAddress: type: string description: >- IP/FQDN to periodically probe using 3 pings per iteration to determine connectivity status. This field is now deprecated and replaced with custom_probe (see below). To maintain backward-compatibility, EVE will check both probe_address and custom_probe and will use whichever has non-zero value (if any), but preferring custom_probe. customProbe: description: >- User-defined probe for cellular connectivity testing. Only IP address is allowed as ConnectivityProbe.probe_address (and port if needed), not hostname. The probing algorithm is more complex that just testing reachability of a remote endpoint and the goal is to minimize generated traffic, probing time and false negatives (that would trigger undesired re-connect). EVE will periodically check the modem status, accessibility of DNS server(s) and potentially also proxies in the local network, and only as the last resort (if connectivity state is still unclear) it will probe the remote endpoint. If custom_probe is not defined, EVE will try to ping "8.8.8.8" (Google public DNS). It is recommended to use custom probe for private LTE networks where public DNS servers might not be allowed by the firewall (and hence ping would fail even with a working connectivity). allOf: - $ref: '#/components/schemas/commonConnectivityProbe' description: >- CellularConnectivityProbe is used to periodically check the connectivity status of a cellular network by probing a remote endpoint. Whenever the probe fails, the cellular connection is automatically restarted. If the probe keeps failing even after the restart, the failure is reported in ZCellularStatus.probeError. The connectivity probing interval is 5 minutes and currently it is not configurable. configCellularAccessPoint: type: object properties: simSlot: type: integer format: int64 description: |- SIM card slot to which this configuration applies. 0 - unspecified (apply to currently activated or the only available) 1 - config for SIM card in the first slot 2 - config for SIM card in the second slot etc. apn: type: string description: |- Access Point Network to connect into. By default it is "internet". Applies to the default bearer. To modify the attach bearer APN, use attach_apn instead. authProtocol: description: >- Authentication protocol used by the network. Applies to the default bearer. To modify the authentication protocol for the attach bearer, use attach_auth_protocol instead. allOf: - $ref: '#/components/schemas/evecommonCellularAuthProtocol' cipherData: description: >- Cipher data may contain encrypted user credentials (inside cellular_net_* fields of EncryptionBlock). EncryptionBlock allows separate configuration of credentials for the attach and default bearers. allOf: - $ref: '#/components/schemas/commonCipherBlock' preferredPlmns: type: array items: type: string description: >- The set of cellular network operators that modem should preferably try to register and connect into. Network operator should be referenced by PLMN (Public Land Mobile Network) code, consisting of 3-digits MCC (Mobile Country Code) and 2 or 3-digits MNC (Mobile Network Code), separated by a dash, e.g. "310-260". If empty, then modem will select the network automatically based on the SIM card config. forbidRoaming: type: boolean description: If true, then modem will avoid connecting to networks with roaming. preferredRats: type: array items: $ref: '#/components/schemas/evecommonRadioAccessTechnology' description: >- The list of preferred Radio Access Technologies (RATs) to use for connecting to the network. Order matters, first is the most preferred, second is tried next, etc. Not listed technologies will not be tried. If empty, then modem will select RAT automatically. ipType: description: The IP addressing type to use for the default bearer. allOf: - $ref: '#/components/schemas/commonCellularIPType' attachApn: type: string description: >- Access Point Name (APN) for the attach (initial) bearer. This field is optional. If not specified, EVE will not send any attach bearer configuration to the modem. Instead, the modem will use one of its pre-installed profiles (see CellularProfile) to determine the configuration. attachIpType: description: |- The IP addressing type to use for the attach bearer. Leave undefined if attach_apn is not specified. allOf: - $ref: '#/components/schemas/commonCellularIPType' attachAuthProtocol: description: |- Authentication protocol used for the attach bearer. Leave undefined if attach_apn is not specified. allOf: - $ref: '#/components/schemas/evecommonCellularAuthProtocol' description: >- CellularAccessPoint contains config parameters for connecting to a cellular network. commonWiFiKeyScheme: type: string enum: - SchemeNOOP - WPAPSK - WPAEAP default: SchemeNOOP WifiConfigcryptoblock: type: object properties: identity: type: string password: type: string configZcServicePoint: type: object properties: zsType: $ref: '#/components/schemas/configZcServiceType' NameOrIp: type: string Credential: type: string title: |- This is way to tell the device if there is service in cloud somewhere, what type it is how to access it commonConnectivityProbe: type: object properties: probeMethod: description: Method to use to determine the connectivity status. allOf: - $ref: '#/components/schemas/commonConnectivityProbeMethod' probeEndpoint: description: |- Endpoint to probe using the selected probing mechanism to determine the connectivity status. allOf: - $ref: '#/components/schemas/commonProbeEndpoint' description: Configuration for user-defined connectivity-testing probe. evecommonCellularAuthProtocol: type: string enum: - CELLULAR_AUTH_PROTOCOL_NONE - CELLULAR_AUTH_PROTOCOL_PAP - CELLULAR_AUTH_PROTOCOL_CHAP - CELLULAR_AUTH_PROTOCOL_PAP_AND_CHAP default: CELLULAR_AUTH_PROTOCOL_NONE description: >- CellularAuthProtocol defines the authentication protocol used for cellular connection. - CELLULAR_AUTH_PROTOCOL_NONE: No authentication. - CELLULAR_AUTH_PROTOCOL_PAP: Password Authentication Protocol. - CELLULAR_AUTH_PROTOCOL_CHAP: Challenge-Handshake Authentication Protocol. - CELLULAR_AUTH_PROTOCOL_PAP_AND_CHAP: Both PAP and CHAP. evecommonRadioAccessTechnology: type: string enum: - RADIO_ACCESS_TECHNOLOGY_UNSPECIFIED - RADIO_ACCESS_TECHNOLOGY_GSM - RADIO_ACCESS_TECHNOLOGY_UMTS - RADIO_ACCESS_TECHNOLOGY_LTE - RADIO_ACCESS_TECHNOLOGY_5GNR default: RADIO_ACCESS_TECHNOLOGY_UNSPECIFIED description: |2- - RADIO_ACCESS_TECHNOLOGY_GSM: Global System for Mobile Communications (2G). - RADIO_ACCESS_TECHNOLOGY_UMTS: Universal Mobile Telecommunications System (3G). - RADIO_ACCESS_TECHNOLOGY_LTE: Long Term Evolution (4G). - RADIO_ACCESS_TECHNOLOGY_5GNR: 5G New Radio. commonCellularIPType: type: string enum: - CELLULAR_IP_TYPE_UNSPECIFIED - CELLULAR_IP_TYPE_IPV4 - CELLULAR_IP_TYPE_IPV4_AND_IPV6 - CELLULAR_IP_TYPE_IPV6 default: CELLULAR_IP_TYPE_UNSPECIFIED description: >- The IP addressing type to use for a given attach or default bearer. - CELLULAR_IP_TYPE_UNSPECIFIED: IP type is not specified. When unspecified, EVE will not enforce an IP type in the bearer configuration. The modem will instead use its built-in profiles (see CellularProfile) to determine the appropriate IP type for the network. - CELLULAR_IP_TYPE_IPV4: IPv4 only. - CELLULAR_IP_TYPE_IPV4_AND_IPV6: IPv4 and IPv6. - CELLULAR_IP_TYPE_IPV6: IPv6 only. configZcServiceType: type: string enum: - zcloudInvalidSrv - mapServer - supportServer default: zcloudInvalidSrv title: |- - mapServer: mapping service for zededa overlay service - supportServer: if device has support feature enabled, this is cloud service from device can be reached commonConnectivityProbeMethod: type: string enum: - CONNECTIVITY_PROBE_METHOD_UNSPECIFIED - CONNECTIVITY_PROBE_METHOD_ICMP - CONNECTIVITY_PROBE_METHOD_TCP default: CONNECTIVITY_PROBE_METHOD_UNSPECIFIED description: |- User-defined method to use to determine the connectivity status. - CONNECTIVITY_PROBE_METHOD_UNSPECIFIED: Connectivity probing method is not specified and therefore will not be used. - CONNECTIVITY_PROBE_METHOD_ICMP: Use ICMP ping against the probed endpoint to determine the connectivity status. - CONNECTIVITY_PROBE_METHOD_TCP: Try to establish TCP connection with the probed endpoint to determine the connectivity status. commonProbeEndpoint: type: object properties: host: type: string description: IP address or FQDN. port: type: integer format: int64 description: |- TCP port required for CONNECTIVITY_PROBE_METHOD_TCP. Leave empty for CONNECTIVITY_PROBE_METHOD_ICMP. description: >- Address of a remote endpoint to probe in order to determine connectivity status. securitySchemes: BearerToken: type: http description: Bearer token for user session scheme: bearer ````