Authentication Setup

Mounting a volume requires a TLS certificate issued by the MASS cluster, unless the volume's access mode is Open. Complete this once before your first mount.

Step 1 — Set the cluster endpoint

mass-ctl config set manager-endpoint https://<head-node-ip>:30083

Run this once; all subsequent commands use it automatically. You can also pass --manager-endpoint per command.

Step 2 — Obtain a certificate

Choose the scenario that fits your use case.

Scenario A — Personal access (your account only)

mass-ctl login --username <your-username>
# Enter your password when prompted

A client certificate valid for 24 hours is issued and saved to ~/.config/boostx-sds/certs.

For a longer-lived certificate — up to 168 hours (7 days):

mass-ctl login --username <your-username> --validity-hours 168

Useful options:

Flag	Purpose
--source	Pick the auth source when the same username exists in several, e.g. local, ldap:0, oidc:0
--cn	Certificate name, if it differs from the username
--auto-renew	Stay in the foreground and renew the certificate before it expires
--cert-dir	Write the certificate somewhere other than the default

Scenario B — Persistent machine access (all users on this server)

Use this when a server needs storage access shared by every user on the host — the machine gets a long-lived certificate, so access keeps working without anyone re-authenticating.

First authenticate the registration request, then register the machine:

mass-ctl login --username <your-username>
sudo mass-ctl machine register

Registration does not change your active login. The machine certificate is stored per host at /etc/boostx-sds/certs, and is used only when you point at it explicitly. The command prints the exact mount command:

sudo mass-ctl mount --volume-id <id> --mount-point <mp> \
  --cert /etc/boostx-sds/certs/client.crt \
  --key /etc/boostx-sds/certs/client.key \
  --ca /etc/boostx-sds/certs/ca.crt --allow-other

info

--allow-other is required for a machine mount: the mount is shared by every user on the host, so it must be accessible to users other than the one who issued the command.

The machine appears in the Dashboard under Identity & Access → Machines, active immediately — there is no approval step.

How mount finds a certificate

For a private volume, certificates are resolved in this order:

1. The path given by --cert / --key / --ca
2. The paths saved in the CLI configuration
3. Auto-discovery in the default certificate directory — the newest still-valid certificate wins

A volume whose access mode is Open can be mounted with no certificate at all.

Signing out

mass-ctl logout

This clears your user session. A machine certificate is stored separately and is not affected.