Prerequisites

Hub host

• Rocky Linux 9, passwordless sudo for the Ansible SSH user (default linux)
• 4+ vCPU, 8+ GiB RAM, 100+ GiB disk
• Public IPv4; WAN TCP 22, 80, 443 and UDP 51820 (WireGuard)

Packages on the controller host

Typically the hub itself runs Ansible:

sudo dnf install -y ansible-core git python3-pip python3-libselinux httpd-tools podman containernetworking-plugins
pip install netaddr
git clone https://github.com/rborso/umkim.git ~/umkim
cd ~/umkim
ansible-galaxy collection install -r requirements.yml
ssh-keygen -t rsa -b 4096

Sibling build sources

Harbor fleet/* images are built from local sibling clones on the Ansible controller:

cd ~
git clone https://github.com/rborso/fleet-olm-subscription-sp.git
git clone https://github.com/rborso/fleet-helm-release-sp.git
git clone https://github.com/rborso/control-plane.git
git clone https://github.com/rborso/k8s-container-service-provider.git
git clone https://github.com/rborso/kubevirt-service-provider.git

Pins live in inventory/group_vars/all/fleet_git_pins.yml (copied from examples/inventory/hub-only/ on bootstrap). See Versions and pins.

DNS before first hub-routed app

Point wildcard DNS *.<fleet_edge_domain> at the hub WAN IP (fleet_hub_public_ipv4).

Do not use a filled maintainer inventory

Always bootstrap from the hub-only example:

cd ~/umkim
./scripts/bootstrap-hub-inventory.sh

Then set hub WAN IP, edge domain, and vault secrets. Details: Install the hub.