Skip to content
UMKIMDocs
Search limited to 0.1.0. Switch to the latest version for up-to-date results.

Hub install lifecycle

This content is for 0.1.0. Switch to the latest version for up-to-date documentation.

  1. Inventory and secrets — bootstrap-hub-inventory.sh copies examples/inventory/hub-only/. Operator sets hub WAN IP, DNS zones (fleet_edge_domain), and encrypts vault.yml.

  2. Preflight — playbooks/preflight.yml validates inventory, vault keys, and hub public IP.

  3. Host prepare — OS baseline, routing, packages (host-prepare.yml).

  4. WireGuard server — Hub wg0; overlay CIDR and hub /32 fixed (wireguard.yml).

  5. OCM hub — Single K3s server: Flannel off, Calico CNI, built-in Traefik/servicelb disabled. clusteradm init (ocm.yml).

  6. Harbor — Registry on the hub WireGuard IP; harbor_push_fleet builds and pushes all fleet/* images (often 1–2 hours).

  7. Fleet platform — OLM and cert-manager on the hub (fleet-platform.yml).

  8. Console auth and UI — Helm CRDs, LLDAP (production), fleet-console-auth chart, dashboard NodePort (fleet-console-auth.yml).

  9. DCM control plane — Postgres, NATS, fleet/control-plane monolith, Traefik gateway (fleet-dcm.yml). Seeds demo catalog.

  10. Hub firewall — nftables / firewalld for WAN SSH, HTTP/S, WireGuard UDP 51820 (hub-firewall.yml).

  11. Fleet-site stack — CRDs, controller, seeds management FleetSite, optional ACME/Authelia seed.

  12. Fleet-edge stack — FleetAppRoute CRD, controllers, hub Traefik static routes.

Verify with ./scripts/verify-hub-install.sh or ./scripts/verify-fleet.sh --layer 1 --suite hub.