Operational introduction
Experimental and unsupported: this is a proof-of-concept learning path, not a production platform. Review security and release limitations before creating infrastructure.
This introduction follows a demo lab from hub install through the first site and cluster, hub-routed apps and Authelia, teardown, a YAIDAP lab site, high availability, cluster operations, KubeVirt, GPU passthrough, and hub LiteLLM.
Use it for the full path, with verify checkpoints and screenshots. For the short public onboarding path (hub → first app only), stay on Introduction. For a screenshot tour of the console, see the console walkthrough.
Story arc
Section titled “Story arc”| Phase | Focus | Page |
|---|---|---|
| A1–A7 | Hub install, ingress auth, first site/cluster, hub-routed apps, Authelia, teardown | Hub and first workload |
| B1–B8 | YAIDAP site, single-node and HA clusters, site-routed apps, node add/remove/replace | Lab site, HA, and ops |
| B9–B13 | KubeVirt + Multus, GPU passthrough clusters, hub LiteLLM, llama.cpp inference | Lab site, HA, and ops |
Demo lab
Section titled “Demo lab”Command blocks on the following pages use this lab’s hostnames, addresses, cluster names, VIPs, and domains. Change them when your lab differs.
| Item | Example |
|---|---|
| Hub | umkim-hub (linux@wg.otthol.hu), WAN CHANGE_ME, Harbor/WG overlay 10.10.0.1 |
| Release pins | UMKIM 0.2; K3s channel v1.36; YAIDAP main (VERSIONS.md) |
| Hub DNS zone | demo.otthol.hu (wildcard *.demo.otthol.hu) |
| Sites | management (hub registry), Phase A intro-hub, Phase B homelab |
| Jumphost | linux@jump.otthol.hu:30200 |
| Lab LAN | 172.16.10.0/24 (lab.local) |
| Hypervisors / BM | virt01 172.16.10.2, virt02 172.16.10.3, virt03 172.16.10.4 (bare metal), virt04 172.16.10.6 (GPU) |
| Clusters | lab-single-0 (virt03, overlay 10.10.0.10), lab-ha-0 (VIP 172.16.10.100, overlay 10.10.0.12), lab-gpu-pt-0 (guest 172.16.10.141, overlay 10.10.0.14) |
| HA control planes | lab-ha-0-cp1 172.16.10.101, cp2 172.16.10.102, cp5 172.16.10.144 |
| Site zone / PF | homelab.otthol.hu; OpenWRT DNAT WAN → 172.16.10.100:30080 / :30443 |
| LiteLLM | https://llm.api.demo.otthol.hu/v1 (FleetLLM) |
What you have at the end
Section titled “What you have at the end”- A verified hub (console login over WireGuard, Harbor, OCM, fleet controllers).
- At least one Ready site and cluster (registry/noop and/or YAIDAP-provisioned).
- A public or hub-gateway app route, plus an Authelia-protected route.
- Optional HA cluster with add/remove worker and control-plane replace.
- Optional GPU clusters with llama.cpp backends registered on hub LiteLLM and a successful chat completion.
Conventions
Section titled “Conventions”| Marker | Meaning |
|---|---|
| Console | Fleet console UI after umkim login or browser session |
| CLI | Equivalent umkim command (v0.2 flags; hosts and addresses are the demo lab above) |
| Verify | Checkpoint before the next step |
This introduction creates FleetSite, FleetClusterJoin (cluster create posts a JSON API body the hub stores as that CR), FleetChart, FleetApp, FleetAppRoute, FleetIngressAuth, FleetAcme, and FleetLLM, plus OCM ManagedCluster. Spoke port-forward certificates use Traefik TLS-ALPN. Hub certificates use HTTP-01.
Secrets (vault passwords, bootstrap bundles, LLM API keys, WireGuard private keys, session cookies) stay off the public site and are marked REDACTED where a flag still needs a path.