This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

How SPEKTRA Edge works

The mental model: projects, devices, and applications.

SPEKTRA Edge runs containerized applications on fleets of edge devices — hardware sitting in shops, factories, vehicles, or offices, far from a data centre and often on unreliable networks.

You do not administer those devices one at a time. You describe what a device should look like and what should run on it, and the platform makes it so, whether you have one device or ten thousand.

This page gives you the mental model behind that. If you have been through Get started, it explains what was actually happening while you clicked; if you have not, nothing here depends on it.

The shape of the system

There are three sides to it: the tools you work with, the platform itself, and your devices out in the field.

flowchart LR
    %% --- What you use ---
    subgraph YOU["You"]
        DASH["Dashboard"]
        CLI["cuttle CLI"]
        API["Your own code<br/>(gRPC / REST)"]
    end

    %% --- The platform ---
    subgraph PLATFORM["SPEKTRA Edge platform"]
        SVC["Core services<br/>identity, devices, applications,<br/>monitoring, logging, limits"]
    end

    %% --- The edge ---
    subgraph EDGE["Your devices"]
        D1["Device<br/>droplet + pods"]
        D2["Device<br/>droplet + pods"]
    end

    DASH --> SVC
    CLI --> SVC
    API --> SVC
    SVC <-->|"desired state down,<br/>status, metrics, logs up"| D1
    SVC <-->|"desired state down,<br/>status, metrics, logs up"| D2

Everything the dashboard shows you, it reads through the platform API. The cuttle CLI uses that same API, and so can your own code — see Integrate. That means most of what you do in the dashboard can be scripted and automated.

The objects you work with

Four things account for most of what you will do.

flowchart TD
    P["Project<br/><i>your fleet, pinned to a region</i>"]
    D["Device<br/><i>one piece of hardware</i>"]
    A["Distribution<br/><i>an application and where it should run</i>"]
    PO["Pod<br/><i>a running container on a device</i>"]

    P --> D
    P --> A
    A -->|"scheduled onto<br/>matching devices"| PO
    D -->|"hosts"| PO
  • A project is your fleet. It groups devices, applications, and the people who can touch them, and you pick the region it lives in when you create it.
  • A device is one piece of hardware running SPEKTRA Edge OS, or your own Linux machine with the agent installed.
  • A distribution is an application plus a rule for where it should run. You target devices by label rather than by name, so growing the fleet does not mean editing deployment lists.
  • A pod is the actual running container on a device. The droplet runtime on each device starts pods, keeps them running, and reports back.

Devices pull their configuration, they are not pushed to

This is the part that most often surprises people coming from conventional server management.

You never “run a command on a device” in the normal course of operating a fleet. Instead you record the state you want on the platform, and each device continuously pulls that state and makes itself match. A device that was offline when you made a change picks it up when it reconnects; no retry queue, no partial rollout to reconcile by hand.

Two practical consequences:

  • Changes are durable. A device that reboots, or gets replaced, comes back to the state you described.
  • Editing a device by hand does not stick. Changes to the read-only system image are lost on reboot. See how persistence works.

What the platform gives you

You get these as part of the platform, rather than assembling them yourself.

Service What it does for you
iam.edgelq.com Users, groups, and service accounts; projects and organizations; roles and role bindings
devices.edgelq.com Device registration, identity, and configuration
applications.edgelq.com Distributions and pods: what runs where
monitoring.edgelq.com Time-series metrics, alerting policies, and notifications
logging.edgelq.com Log storage and search, including logs forwarded from devices
audit.edgelq.com A record of every API call and resource change
limits.edgelq.com Resource limits, so one project cannot exhaust a shared pool
secrets.edgelq.com Secrets management
proxies.edgelq.com Tunnelled connectivity to devices, which is how remote access works
meta.goten.com Service registration and discovery

Each one has a full API reference under Service APIs. You will also see these names in audit entries, in IAM role definitions, and in cuttle commands.

Regions

The platform runs in multiple regions, and a project belongs to one of them. Pick the region closest to your devices when you create a project: it is the region your devices talk to, so proximity matters for latency and for how quickly a device picks up a change.

Next steps

  • Applications — build an image, deploy it, configure it, and watch it run.
  • Devices — set up hardware and operate it.
  • Build a service — if you want to publish your own service on the platform rather than consume it.

1 - Shared responsibility

Where the platform’s responsibility ends and yours begins.

SPEKTRA Edge runs your containers on your hardware. That splits ownership in a way that is obvious once stated and a frequent source of surprise until then: the platform is responsible for getting your workload running and keeping the device healthy, and you are responsible for what is inside the workload.

This page draws the line. Most questions of the form “does SPEKTRA Edge handle X for me?” are answered by finding X in one of the two columns below.

The division

Area Platform You
Device identity and onboarding Issues device identity, attests hardware, enrolls the device Physically install the device; supply site network details
Device OS Ships, upgrades, and rolls back SPEKTRA Edge OS Choose when to upgrade; test your workload against a version
Connectivity to the platform Maintains the outbound control-plane connection Allow the required egress; keep the clock accurate
Disk encryption Seals the storage key to the TPM and unlocks at boot Keep the recovery passphrase
Deployment Delivers desired state and starts, restarts, and reports on containers Define the distribution, pod template, and labels
The container image Pulls it and runs it Build it; patch it; own its base image and dependencies
Application configuration Delivers config maps and secrets to the container Decide what the values are and how the app reads them
Application identity Authenticate and authorize your application’s own users
Application data in transit Encrypts platform traffic Encrypt your application’s own protocols
Filesystem permissions Provides the mount Match the image’s UID/GID to the mounted directory
Application egress Configure your app’s own proxy, DNS, and TLS trust
Application keys Uses the TPM for device identity and disk encryption Manage your own application keys, including any TPM use
Monitoring Collects device metrics, logs, and audit records Emit useful application logs and metrics
Backups of application data Back up whatever you store on the device

What this means in practice

A few consequences come up often enough to state directly.

Deploying a third-party workload does not normally require anything from us. If the software ships as a container and expects a normal Linux environment, you package it, point a distribution at some labelled devices, and bind-mount its data directory. Platform changes only become necessary when a workload needs something the platform does not expose — unusual hardware, a kernel module, a privileged network mode, or a lifecycle the container model does not cover. If you are unsure, the question to ask is whether the workload needs anything outside its container.

Nothing about your application’s traffic is automatic. The platform’s own connection is encrypted and, where configured, proxied. Your application’s connections are not: they do not inherit the device proxy settings, they are not encrypted on your behalf, and the platform does not terminate TLS for them.

The TPM is not a general-purpose key store for your application. The device TPM is used for device identity and to seal the disk-encryption key, releasing it only when the boot state is as expected. An application that wants to generate or hold its own keys in the TPM has to talk to the TPM itself and speak the relevant protocol. The platform neither manages those keys nor mediates that access. See TPM attestation.

File permissions behave exactly as they would anywhere else. The platform adds no special handling. If the image runs as a non-root UID and the bind-mounted host directory is owned by root, the container cannot write to it — the same as on any Docker host. See Storage.