Control actions

Cleat can scale a service, roll an update back, force a redeploy, and drain, pause, activate, promote or demote a node.

It will not do any of that by default.

Two layers

An action has to get past both:

1. Allow control actions — per cluster, off by default
2. Confirmation — every action, every time

Read-only is a property of each cluster, not of Cleat. That is the point: a production cluster managed by CI/CD stays shut while a local one you are testing against is open, and a single application-wide switch cannot say that.

Turn it on in View → Swarm → Clusters…, per cluster. Until you do, a cluster shows a READ ONLY chip in its header and offers no cluster-changing actions.

Turning a monitoring tool into something that can change production is an opt-in, not something that happens because you upgraded. Every cluster starts closed — including on upgrade from a version that had the old global switch, where the flags you had set are reset so that removing that switch cannot quietly open anything.

Confirmation tiers

The confirmation dialog shows you the exact command Cleat will run, verbatim. Not a description of it — the command.

Higher-consequence actions ask for more. Scaling a service to zero, demoting a manager, or removing a service asks you to type the target's name, because those are the ones where a misclick is not recoverable by clicking again.

While an action is in flight the dialog will not dismiss — including with Escape — so a stray keypress cannot leave you unsure whether it ran.

What Cleat won't do

There is no restart-task verb in Swarm. The alternatives are service update --force, which restarts every task, or removing one task's container and letting the scheduler replace it. Cleat pre-fills the second as a command for you to run; it does not run it for you.

Convergence

After an accepted action, Cleat polls faster and shows what you asked for beside what is actually running — 2/3 → 5. Never one number pretending to be the other.

If the change has not landed by the end of the window (swarm.converge_watch_sec, 90s), Cleat says so, with the reason from the task error where there is one. A change that quietly never happened is the failure mode this exists to prevent.

The audit trail

Every control action is recorded — what was run, against what, by which cluster, whether it succeeded, and whether it was blocked by read-only mode. The Audit tab shows it, filterable.

The command is recorded with any credentials redacted, and the record is written before the command runs, so an action that crashed the app still left a trace.