Console and auth

fleet-console-auth gates DCM (/api/v1alpha1) and fleet-site (/fleet/api/v1alpha1) APIs. The SPA uses /fleet/auth/v1alpha1 for login and admin APIs.

ansible-playbook harbor.yml -t harbor_push_fleet -l hub
ansible-playbook fleet-console-auth.yml -l hub

LDAP group → FleetRole (v0.1.0)

lldap group	FleetRole
fleet-admins	dc-admin
fleet-site-admins	site-admin
fleet-cluster-admins	cluster-admin
fleet-org-admins	org-admin (bind with Org/{slug} scope)
fleet-customers	customer (bind with Org/{slug} scope)

Helm auth.bootstrapLdapGroup: fleet-admins grants dc-admin on login.

Break-glass htpasswd user (localadmin / vault password) remains for LDAP outage. Rotate after use in production.

Hub Authelia can share the same LLDAP when console LDAP is enabled.