Customer-managed compute

With customer-managed compute, your organization manages its own Macs at a Mount Thor site, typically with its own MDM. Mount Thor runs the site. You work with your Macs in the portal, with the mthr CLI, or through the compute API at https://customer-api.mountthor.com/compute/v2. See Compute offerings for how this differs from Mount Thor-managed compute.

Capabilities

Your account can use the capabilities you and Mount Thor agree on:

Capability	Portal	mthr CLI	API
Inventory	Macs card and each Mac’s page	`mthr bm ls`, `mthr bm get`	`GET /compute/v2/baremetalmachines`, `GET /compute/v2/baremetalmachines/{name}`
Problem reports	Report a problem	`mthr bm report`	`POST`, `GET /compute/v2/machineproblemreports`, `GET /compute/v2/machineproblemreports/{name}`
Events			`/compute/v2/eventsubscriptions` and `GET /compute/v2/eventactions`

Anything else, such as creating a machine or a virtual machine, is not offered. The portal doesn’t show it, the CLI refuses it, and the API answers 400 with the reason tenant_compute_customer_managed. So does a capability your account doesn’t have. To add one, ask your Mount Thor contact. To automate these tasks, use a service account.

Choose how to work with your Macs

Portal
mthr CLI
API

See your Macs

Open the Compute page in the portal. It shows Managed by your organization, with what your account can do, and lists your Macs in the Macs card: each Mac’s serial number, hardware, location and status. The list shows 100 Macs at a time. Use Previous and Next to move between pages. To find a Mac, type its serial number, or its first characters, in Find a Mac by serial number.Click a Mac’s serial number to open its page. It shows the Mac’s serial number and, when Mount Thor knows them, its chip, model, CPU cores, memory, storage, class, site and location. Its status reads Managed by your organization because Mount Thor doesn’t track a Mac’s power or health. The page also lists the problem reports filed for that Mac.

Report a problem

Click Report a problem in the Problem reports card, or on the Mac’s page, which fills in its serial number.
From the Compute page, enter the Mac’s Serial number.
Describe what you see and when it started in What’s wrong, up to 4,096 bytes.
Click Send report.

The portal shows Report sent with the report’s reference, and the report appears in Problem reports. Each report alerts Mount Thor’s on-call team.If the portal shows The report couldn’t be confirmed, click Check again before you send it again, so the on-call team isn’t alerted twice.

These commands need mthr 0.3.80 or later. Check your version with mthr --version, and update with mthr update.

Check your account

mthr whoami

whoami shows who manages your Macs and what your account can use, with the commands for each:

Compute:      managed by your organization
Available:    Mac list (mthr bm ls, mthr bm get), problem reports (mthr bm report), event subscriptions (API)

mthr whoami --json adds computeProfile, with computeManagement, state and capabilities.

See your Macs

mthr bm ls
mthr bm get C02XK0AAJG5H

bm ls shows each Mac’s serial number, class and location. Its status reads managed by your org because Mount Thor doesn’t track a Mac’s power or health:

NAME          SERIAL        CLASS   LOCATION            STATUS
c02xk0aajg5h  C02XK0AAJG5H  -       rw01-rk02-tr03-s04  managed by your org

bm get takes the serial number in any case. bm ls reads every page by default. Pass --limit 100 to read the first 100, --page-token TOKEN to continue, or --serial C02XK0AAJG5H to find one Mac. With --json, the CLI prints the API’s fields under bareMetalMachines.The CLI refuses --active, --failed and --wait here. They read a Mac’s state, which Mount Thor doesn’t track.

Report a problem

mthr bm report C02XK0AAJG5H --description "No network link since 09:00 UTC; the Mac is powered on."

The command asks before it sends the report, because each report alerts Mount Thor’s on-call team. Pass --yes to skip the question. The description is required, up to 4,096 bytes. Once the report is sent, the CLI prints:

Report sent. Mount Thor's on-call team has been alerted.
Reference: mpr-… (C02XK0AAJG5H). See it with `mthr bm report get mpr-…`.

List your reports with mthr bm report ls, or one Mac’s with mthr bm report ls --serial C02XK0AAJG5H. Show one with mthr bm report get REPORT_NAME.After a lost connection or a 5xx answer, the CLI reports that the outcome is unknown. Run mthr bm report ls before you send the report again. At your account’s report limit, the command exits with code 10.

Commands your account doesn’t offer

Other compute commands, such as mthr bm allocate or any mthr vm command, exit with code 11 before they send anything:

Error: `mthr bm allocate` isn't available because your organization manages this account's Macs (permission denied)
  Command: mthr bm allocate
  Docs:    https://docs.mountthor.com/compute/customer-managed
  Contact: support@mountthor.com

During your account’s setup, a change exits with code 8 and the message “changes are paused”. Run the command again later.

Run as a service account

With mthr 0.3.81 or later, a service account runs whoami, bm ls, bm get and the bm report commands. The bm commands take the same flags and print the same output as for a person. Select the credential as on Service accounts:

export MOUNTTHOR_SERVICE_ACCOUNT_CREDENTIAL_FILE="$PWD/sa.json"
mthr whoami
mthr bm ls

If the service account’s roles don’t grant a command’s action, the command exits with code 11 and names the action:

Error: this service account's role doesn't grant compute:ListBareMetalMachines (permission denied)
  Command: mthr bm ls
  Try:     an Owner can add it to the service account's role with `mthr iam roles update`, or on the Access page in the portal; `mthr iam roles ls` lists the roles
  Contact: support@mountthor.com

See your Macs

Mount Thor’s inventory lists your Macs at the site. Each Mac’s name is its serial number in lower case:

GET /compute/v2/baremetalmachines/c02xk0aajg5h

A Mac’s record includes serialNumber, its location and computeManagement: COMPUTE_MANAGEMENT_CUSTOMER_MANAGED. It also includes machineClass, hardware details and the Mac’s address in network.ipAddresses when Mount Thor knows them.Mount Thor doesn’t track a Mac’s power or health. Its status state is STATE_UNSPECIFIED with the reason CustomerManaged.The list is paged. Pass pageSize (100 by default, at most 1,000) and, for each following page, the pageToken set to the previous answer’s nextPageToken. An empty nextPageToken means you have read the whole list:

GET /compute/v2/baremetalmachines?pageSize=1000
GET /compute/v2/baremetalmachines?pageSize=1000&pageToken=NEXT_PAGE_TOKEN

To read one Mac, use its lower-case serial with GET /compute/v2/baremetalmachines/{name} rather than walking the list.If the inventory cannot be read, the request answers 503. It never answers with an empty or partial list.

Report a problem

Report a hardware or site problem, such as a Mac that does not power on or has no network link, by its serial number:

POST /compute/v2/machineproblemreports
Content-Type: application/json

{"serial": "C02XK0AAJG5H", "description": "No network link since 09:00 UTC; the Mac is powered on."}

The answer is 201 with the report, whose name starts with mpr-. Each report alerts Mount Thor’s on-call team. Read your reports with GET /compute/v2/machineproblemreports and GET /compute/v2/machineproblemreports/{name}.

description is required, up to 4,096 bytes. Describe what you see and when it started.
Your account can hold a limited number of reports. At the limit, a new report answers 422 with the reason problem_report_limit_reached.
Creating a report is not idempotent. If a create fails with a 5xx answer, list your reports before you retry, so you do not file the same report twice.

Events

If your account has events, Mount Thor can send webhook notifications about your Macs to an HTTPS endpoint you run. Ask your Mount Thor contact to enable events and for the integration details.

Service accounts

A service account works through the API or the mthr CLI, as their tabs show. Every service account can read GET /compute/v2/computeprofile, which says who manages your Macs and which capabilities your account has. For everything else, an owner binds the service account to a custom role with the capability’s actions. See Roles and bindings.

Capability	Actions
Inventory	`compute:ListBareMetalMachines`, `compute:GetBareMetalMachine`
Problem reports	`compute:CreateMachineProblemReport`, `compute:ListMachineProblemReports`, `compute:GetMachineProblemReport`
Events	`compute:CreateEventSubscription`, `compute:ListEventSubscriptions`, `compute:GetEventSubscription`, `compute:UpdateEventSubscription`, `compute:DeleteEventSubscription`, `compute:RotateEventSubscriptionKey`, `compute:ListEventActions`

This role reads your Macs and files problem reports:

mthr iam roles create mac-reports \
  --action compute:ListBareMetalMachines \
  --action compute:GetBareMetalMachine \
  --action compute:CreateMachineProblemReport \
  --action compute:ListMachineProblemReports \
  --action compute:GetMachineProblemReport \
  --reason "Read our Macs and report problems from automation" \
  --ticket ACCESS-301

A call whose action the service account’s roles don’t grant answers 403 with the reason permission_denied. A role can’t add a capability your account doesn’t have: that call still answers 400 with the reason tenant_compute_customer_managed.

Answers you may see

Status	Reason	Meaning
`400`	`tenant_compute_customer_managed`	The operation is not enabled for your account
`403`	`permission_denied`	The service account’s roles don’t grant the operation’s action
`403`	`machine_credential_not_supported`	The operation doesn’t accept a service account credential; call as a person
`404`	`not_found`	No Mac with that serial number is in your account
`422`	`problem_report_limit_reached`	Your account holds the maximum number of problem reports
`429`		Too many requests; retry later
`501`	`unimplemented`	The capability is not available at your site
`503`	`unavailable`	Your account is being set up or changed, or the inventory is briefly unavailable; reads keep working while changes are refused. Retry later

Compute

Platform

API Reference

Customer-managed compute

Capabilities

Choose how to work with your Macs

See your Macs

Report a problem

Check your account

See your Macs

Report a problem

Commands your account doesn’t offer

Run as a service account

See your Macs

Report a problem

Events

Service accounts

Answers you may see

​Capabilities

​Choose how to work with your Macs

​See your Macs

​Report a problem

​Check your account

​See your Macs

​Report a problem

​Commands your account doesn’t offer

​Run as a service account

​See your Macs

​Report a problem

​Events

​Service accounts

​Answers you may see

Capabilities

Choose how to work with your Macs

See your Macs

Report a problem

Check your account

See your Macs

Report a problem

Commands your account doesn’t offer

Run as a service account

See your Macs

Report a problem

Events

Service accounts

Answers you may see