Verify hub install

./scripts/verify-fleet.sh --layer 1 --suite hub
# or legacy:
./scripts/verify-hub-install.sh

Expect:

• kubectl get fleetsite shows the management site
• kubectl get managedclusters is empty until the first workload cluster provisions
• Harbor, DCM, console, fleet-site, and fleet-edge controllers are running

Console access

Reach the console over the WireGuard overlay (management NodePorts are not exposed on the WAN by default):

30912/fleet/login

./scripts/wg-dev-client.sh my-laptop
# import the generated wg-umkim.conf

Create an LLDAP user in group fleet-admins. Break-glass: localadmin + vault password. More clients: WireGuard clients.

Hub teardown (full reinstall)

Wipes the management hub and all console-provisioned clusters (K3s reset on cluster nodes). Inventory and vault are kept.

./scripts/teardown-hub.sh --confirm

Then re-run ./scripts/install-hub.sh and verification.