Deploy first app

Console path

Catalog → Deploy wizard: Template → Configure → Placement → Review.

1. Creates a catalog-item-instance on the DCM gateway (POST /api/v1alpha1/catalog-item-instances).
2. Password fields with x-secret-bind are written to the spoke first (PUT /fleet/api/v1alpha1/catalog-instance-secrets); DCM only stores existingSecret refs.
3. DCM evaluates Rego placement policies against ManagedCluster labels.
4. The matching service provider materializes the workload on placed clusters.
5. fleet-edge-route-sync creates/updates a FleetAppRoute when routing.mode is hub, site, or dual.
6. fleet-edge-controller programs hub Traefik fragments and spoke Ingress ManifestWorks.

Demo catalog items (for example demo-webapp, whoami-helm) are seeded at hub install. Re-seed:

ansible-playbook $INV fleet-dcm.yml -l hub -t dcm_seed_catalog

For hub-routed apps, ensure wildcard DNS for fleet_edge_domain points at the hub WAN IP.

Deep dive: App deploy and routes.