Skip to content
UMKIMDocs

Install the hub

Greenfield hubs use ./scripts/install-hub.sh → hub-install.yml on the hub host. No Ansible-managed spokes are created; workload clusters join later via the console.

Do not use fleet-deploy.yml on this path.

1. Inventory

Section titled “1. Inventory”
Terminal window
cd ~/umkim
./scripts/bootstrap-hub-inventory.sh

Edit before install:

File Set
inventory/hosts.yml Hub hostname; ansible_host = hub WAN IPv4
inventory/host_vars/<hub>.yml fleet_hub_public_ipv4 = same WAN IP (required; do not leave CHANGE_ME)
inventory/group_vars/all/site.yml fleet_edge_domain, fleet_dns.wireguard_hub, fleet_edge_acme_email, LDAP base DN, fleet_hub_inventory_hostname
Terminal window
export INV="-i inventory/hosts.yml -i inventory/hosts-from-hub.yml"
./scripts/preflight-hub-inventory.sh
ansible $INV -m ping hub

Hub group vars live under inventory/group_vars/hub/ (directory). Do not add a sibling hub.yml file.

2. Secrets

Section titled “2. Secrets”

Production is the default (FLEET_PROFILE=production):

Terminal window
cp docs/vault.example.yml inventory/group_vars/all/vault.yml
# replace every REPLACE_ME, or:
./scripts/generate-vault-secrets.sh --encrypt --vault-pass-file ~/.umkim-vault-pass


export ANSIBLE_VAULT_PASSWORD_FILE=~/.umkim-vault-pass
./scripts/preflight-v1.sh

install-hub.sh uses ~/.umkim-vault-pass automatically when present. Lab-only trial: export FLEET_PROFILE=lab (no vault) — see Secrets and vault.

3. Run install

Section titled “3. Run install”
Terminal window
cd ~/umkim
export INV="-i inventory/hosts.yml -i inventory/hosts-from-hub.yml"
export ANSIBLE_VAULT_PASSWORD_FILE=~/.umkim-vault-pass
./scripts/install-hub.sh

hub-install.yml runs preflight, then host prepare → WireGuard → OCM → Harbor (harbor_push_fleet) → platform → console auth (Helm dashboard NodePort dcm_fleet_dashboard_nodeport, default 30912) → DCM → firewall → fleet-site → fleet-edge.

First image push often takes 1–2 hours.

Resume a failed run by tag, for example:

Terminal window
ansible-playbook $INV hub-install.yml -l hub --tags dcm_hub

What gets seeded

Section titled “What gets seeded”
  • Management FleetSite (do not attach workload clusters to it)
  • Demo catalog items and placement policies (dcm_seed_catalog)
  • Empty ManagedCluster list until the first FCJ provisions

Next: Verify hub install. Full step list: Hub install lifecycle.