Install the hub

This content is for 0.1.0. Switch to the latest version for up-to-date documentation.

Unsupported evaluation software. The production profile enables stricter configuration checks; it does not make UMKIM v0.1.0 production-supported.

The public release path installs a hub first, then creates workload clusters through FleetClusterJoin. Start from the generated hub-only inventory rather than an existing populated inventory.

Prepare inventory and vault

./scripts/bootstrap-hub-inventory.sh
./scripts/generate-vault-secrets.sh --encrypt

Set your host, network, DNS, and vault values in the generated files. Keep the encrypted vault and its password file outside version control. Do not use placeholder or evaluation-only defaults for this path.

Preflight and install

export FLEET_PROFILE=production
export ANSIBLE_VAULT_PASSWORD_FILE=/secure/path/to/vault-password
./scripts/preflight-v1.sh
./scripts/install-hub.sh

FLEET_PROFILE=production must be explicit for the production preflight. The preflight validates inventory and secret requirements; it is not a security certification.

The install sequence prepares the host and WireGuard overlay, initializes OCM, builds Harbor fleet images, deploys platform and console components, then deploys DCM, fleet-site, fleet-edge, and firewall configuration.

Use narrow playbook tags for a reviewed repair rather than rerunning a broad installation sequence. See Hub install lifecycle and Secrets and vault.