Skip to content
UMKIMDocs

FleetApp Helm installs

Experimental: v0.2 is a proof of concept. A successful Helm install is not proof that the application is healthy, reachable, or durable.

FleetApp installs an OCI Helm chart onto one Ready cluster that you select. There is no placement engine, catalog scheduler, or service-provider path. The hub itself is not a valid target.

Publish a chart to the hub library once (FleetChart / Harbor charts), then install it many times. Publishing is not an install.

Library (publish)

Section titled “Library (publish)”

Use the console Apps → Library tab, umkim chart add (see umkim CLI), POST /fleet/api/v1alpha1/charts, or scripts/fleet-chart.sh.

Sources:

  • Upload a Helm .tgz
  • An oci:// URL on the Helm OCI allowlist
  • An http(s):// URL to a .tgz

imagePolicy is external (spokes pull upstream images), proxy (metadata only — expects Harbor proxy projects for upstream registries; the publish job does not rewrite chart image references), or copy (best-effort helm template + skopeo into Harbor mirror, original chart name unchanged). Copied images keep their upstream path under the mirror project.

Seeded hub charts (whoami, pet-clinic-helm, llama-cpp-helm, rocky-10-vm) appear in the library after Harbor publish and fleet-site-controller import. For GPU inference, compose values from deploy/llama-cpp-helm/ in the UMKIM repo or use Fleet Llama profiles; see fleet-llm.

Deleting a library row removes the FleetChart record only. Harbor artifacts stay until an operator prunes them.

Create (install)

Section titled “Create (install)”

Use the console Apps page, authenticated POST /fleet/api/v1alpha1/apps, umkim app create, or playbooks/flows/app-install.yml. The controller path is /api/v1alpha1/apps; clusterName is required.

Field Meaning
clusterName Ready FleetClusterJoin / ManagedCluster name
chart oci://… URL or short name under Harbor charts

Optional: version, releaseName, namespace, values / valuesYaml, and route.mode (none, hub, site).

Short chart names expand to the hub Harbor prefix (for example whoami → oci://<hub-overlay>:30443/charts/whoami). Charts must match the helm_chart_oci_prefixes allowlist.

The cluster must already be Ready.

Update (patch)

Section titled “Update (patch)”

PATCH /fleet/api/v1alpha1/apps/{name} updates version, valuesYaml, namespace, and route. The controller runs helm upgrade --install when the spec hash changes. Returns 409 while phase is Installing or Deleting. Console Apps → Edit and umkim app update call this API.

llama-cpp-helm profiles

Section titled “llama-cpp-helm profiles”

GET /llama-profiles lists FleetLlamaProfile CRs; legacy GET /charts/llama-cpp-helm/profiles returns the same ids for the install picker. GET /llama-profiles/{name}/values returns merged Helm YAML (runtime + profile + Harbor ghcr-proxy image).

Install via console profile picker or umkim app create --llama-profile qwen35-2b-ud-4g. Optional hub LiteLLM registration uses llmBackend on create/patch (console checkbox or umkim app create|update --llm-backend true|false). See Fleet Llama profiles and fleet-llm.

Rocky Linux 10 guest (rocky-10-vm)

Section titled “Rocky Linux 10 guest (rocky-10-vm)”

Install chart rocky-10-vm on a cluster with the KubeVirt platform. Console vCPU, memory, and disk fields write Helm values. Use route.mode: none.

cpu: 2
memory: 2Gi
disk:
  size: 20Gi
  storageClass: local-path
  volumeMode: Filesystem

See Fleet KubeVirt and charts/rocky-10-vm/README.md in the UMKIM repo.

Routing

Section titled “Routing”

Per-app route.mode must match the site’s exposure model. See fleet-edge and site exposure examples.

Mode Result Hub required for public URL?
none Chart-only; no FleetAppRoute No
hub Hub Traefik publishes hubHost to this cluster’s Service Yes
site Spoke ingress publishes siteHost; needs port_forward or reverse_proxy ingress No

For route.mode: site, siteHost defaults to <release>.<zone> only for port_forward ingress. reverse_proxy clusters must set siteHost explicitly.

requireAuth opts the route into ingress-auth when that stack is ready. See ingress auth.

Hub-routed apps stop when the hub is unavailable. site and none apps can remain reachable when site ingress is healthy.

Verify

Section titled “Verify”

After phase Ready, check the Helm release on the spoke (fleet-system/fleet-kubeconfig-<cluster>). scripts/verify-fleet-app.sh with FLEET_APP_CLUSTER set. Llama lifecycle: verify-fleet-llama-app-lifecycle.sh. See Verification.

Section titled “Related”