Clusters¶
An RG Cluster is a regional, autonomous execution plane built from multiple interchangeable nodes. The nodes communicate over an encrypted private mesh and share a consensus-backed datastore, so the cluster has no single special node and keeps operating when parts of it — or the cloud layer above it — fail. It owns the devices, tunnels, adapters, operations, and audit for the fleet homed to it.
Interchangeable nodes¶
A cluster is composed of several nodes that are deliberately interchangeable: no node is a designated primary whose loss stops the cluster. Devices hold their reverse channels to nodes, adapters run on nodes, and operations execute on nodes, but the cluster's authority lives in shared state rather than in any one machine. This is what allows a device's channel to move to another node on failover and lets capacity be added or a node be drained without redefining the cluster. Interchangeability is the structural reason a cluster tolerates the loss of a node with a bounded, local effect rather than a cluster-wide outage.
Encrypted private mesh and shared state¶
Nodes talk to each other over an encrypted private mesh — a mutually authenticated network between the cluster's own nodes, closed to anything outside it. On top of that mesh sits a consensus-backed datastore that holds the cluster's authoritative state: device identities, allocations, configuration, and the local record. Describing these by role is deliberate — the mesh is defined by what it does (private, encrypted node-to-node transport), and the datastore by its property (consensus-backed, so state stays consistent across nodes). Together they let interchangeable nodes agree on one view of the fleet without a special coordinator, which is the foundation of the cluster's autonomy.
Failure domains¶
The cluster is designed so that each kind of failure has a bounded blast radius rather than cascading.
| Failure domain | Bounded effect |
|---|---|
| Node | Its channels and work move to other nodes; the cluster keeps operating. |
| Region | Only fleets homed to that region are affected; other regions are independent. |
| Provider | A hosting-provider failure is contained to clusters running on it; others continue. |
| Cluster | One cluster's loss affects only its own fleet, not other clusters or the organization's others. |
| Cloud layer | Clusters keep running locally; only global sign-in and registry changes pause. |
| Uplink | A cluster's loss of external connectivity degrades to local-only operation, not a stop. |
Each row is a containment boundary: the platform's job is to make sure a failure at one level does not become a failure at the level above it.
Local-first, cloud-when-available¶
The cluster's operating principle is local-first, cloud-when-available. Everything required to run the fleet — identity, pairing, channels, configuration, adapters, telemetry, RBAC, and audit — is resolved locally within the cluster, so the cluster never waits on the cloud to do its job. When the cloud is reachable, the cluster uses it for what the cloud is for: global accounts, cross-cluster sign-in, registry, and long-term audit replication. When the cloud is unreachable or absent, the cluster continues unaffected on the device data path. This principle is what makes the same cluster architecture serve both a connected regional deployment and a fully air-gapped site with no change in how it operates day to day.