fleet-site
fleet-site-controller runs on the hub in namespace fleet-console. It implements registry FleetSite CRs and FleetClusterJoin greenfield provisioning.
| CR | Purpose |
|---|---|
FleetSite |
Registry site: edge, DNS zones, siteId, region, orgId |
FleetClusterJoin |
Cluster bootstrap → validate → provision |
FleetAcme |
Singleton Let’s Encrypt: hub + per-cluster |
FleetIngressAuth |
Singleton Authelia / LLDAP forward-auth |
FleetLLM |
Singleton hub LiteLLM proxy |
FleetInstanceBackup / FleetInstanceRestore |
Catalog instance backup Jobs |
Apply CRDs: ansible-playbook fleet-site-crd.yml -l hub.
Identity on mutating APIs
Section titled “Identity on mutating APIs”When FLEET_SITE_REQUIRE_IDENTITY is true (default), mutating calls without X-Fleet-Subject-* return 401. Enrollment routes do not require identity headers.
Org-scoped create rules: see Multi-tenancy.