Telemetry
Everything the platform sends to RigFabTech, why, and how long RigFabTech keeps it.
The platform sends no content of your apps: no records, files, user names or e-mail addresses.
The daily check-in
The licence agent, in namespace rft-licensing, checks in with the licence service at licensing.rigfab.com
about once a day, as RigFabTech sets for your site.
- After a failed check-in, it tries again after 30 minutes, then 1, 3, 6 and 12 hours.
- The answer brings the licence service's view of your licence and the time from a clock you don't control.
The request sends:
| Field | Example | Why |
|---|---|---|
site | 5b3f7c2e-0000-4000-8000-00000000c0de | Your site's ID, from the licence key |
nonce | 26 random characters | Ties the answer to this request |
agent_version | 18dfd8c | The agent's build, for support |
apps[].name | inspection | The apps installed, to match them with your licence |
The request also carries the secret half of your licence key, as its Authorization header. The licence service
compares it with the hash it keeps and never stores the secret itself.
The binding report
Each check-in made while a licence is installed also carries a binding object. It's the agent's comparison of
this installation with your licence's site and domains, so RigFabTech can see a licence used under other domains or
on two clusters at once.
- It sends your platform's hostnames in clear. They're what the licence is bound to.
- A mismatch is never enforced. It only shows administrators a banner.
| Field | Example | Why |
|---|---|---|
binding.instance_id | 0192f0e4-7b1c-7d3e-8000-00000000c0de | This install's ID, made on the agent's first start, to tell two clusters running at once from one that was rebuilt |
binding.site_id_licensed | 5b3f7c2e-0000-4000-8000-00000000c0de | The site ID your licence names, to compare with the agent's |
binding.site_id_agent | 5b3f7c2e-0000-4000-8000-00000000c0de | The site ID the agent runs as, from the licence key, to compare with the licence's |
binding.site_state | ok | The result of that comparison: ok, mismatch or unregistered |
binding.domain_state | ok | Whether the licence's domains cover your hosts: ok, mismatch, unbound or unknown |
binding.licensed_domains | acme.com, *.acme.com | The domains your licence names, to show what the hosts were compared with |
binding.configured_hosts | *.rft.acme.com | The hosts the platform is configured to serve, which the licence must cover |
binding.observed_hosts[].host | quote.rft.acme.com | A hostname on an Ingress, HTTPRoute or Gateway the agent reads, to cross-check the configured hosts |
binding.observed_hosts[].source | HTTPRoute/rft-quote/quote | The kind, namespace and name of the object the host came from, to find it |
binding.uncovered_hosts | quote.other.net | The hosts the licence's domains don't cover, to fix the licence or the route |
binding.ignored_hosts[].host | quote.rft-quote.svc | A host left out of the comparison, to show it was seen |
binding.ignored_hosts[].reason | internal | Why: ip, internal, reserved or invalid |
binding.ignored_hosts[].source | Ingress/rft-quote/internal | The object the host came from, when it came from one |
binding.first_mismatch_at | 2026-11-02T08:00:00Z | When a mismatch began, to tell a lasting one from a change in progress; sent only while there is one |
Each list holds at most 50 hosts.
The agent reads only the Ingress, HTTPRoute and Gateway objects labelled rigfab.com/managed=true. Your own
workloads' hostnames are sent only if you put that label on their routes.
When you pull
rft itself calls no RigFabTech service.
Images and charts come from registry.rigfab.com, and rft from get.rigfab.com, with credentials tied to your
site. Their request logs show which images, charts and files your site pulled, and from which address.
What RigFabTech keeps
- Each check-in's time, agent build, app names and the ID of its answer: for your contract's term and 12 months after, then deleted or kept only as totals that name no site.
- The latest binding report from each install: for your contract's term and 12 months after, then deleted.
- Your platform and app versions and when your licence key was last used: the latest values only, while you are a customer.
- The request logs of
licensing.rigfab.com,get.rigfab.comandregistry.rigfab.com, which hold the public address each request came from, your site's ID and what it asked for: 400 days.
Optional data
None today. Before any release sends optional usage counters:
- this page will list each one
- the release that adds them will have a setting that turns them off
Without internet access
A missed check-in never stops an app or makes it read-only. After 7 days without one, administrators see a banner. RigFabTech can change that number of days for your site.