Network planes
This content is for 0.1.0. Switch to the latest version for up-to-date documentation.
Each node uses its local management network for K3s and cluster traffic. FCJ clusters also receive a WireGuard overlay address so the hub can reach management services without exposing them directly to the internet.
| Flow | Path |
|---|---|
| Console and control APIs | Operator device → WireGuard → hub |
| Hub-routed workload | Client → hub edge → WireGuard → workload-cluster ingress |
| Site-routed workload | Client → operator-managed site edge → workload-cluster ingress |
The final two paths are optional and depend on a separately reviewed edge configuration. Do not publish hub management NodePorts, Kubernetes APIs, or overlay-only services on the WAN.
See Security and ports and fleet-edge.