Hub install lifecycle

This page explains the order of the hub workflow. Use Install the hub for the supported commands.

1. Validate the generated inventory and encrypted vault.
2. Prepare the host and establish the WireGuard management overlay.
3. Initialize the K3s and OCM hub.
4. Build and publish fleet images in Harbor from this checkout (no sibling repos required).
5. Install platform services, console authentication, and fleet controllers.
6. Apply the hub firewall, deploy fleet-site and fleet-edge controllers, and reconcile FleetSite.

The workflow can take substantial time while images build. For a known failed subsystem, inspect its state first and use a narrowly scoped playbook tag rather than rerunning a full install.

Default hub teardown (./scripts/teardown-hub.sh --confirm) deletes console-managed workload clusters (cleanupKubernetes=true) and wipes the hub stack. Use --skip-cluster-delete for a hub-only reset while spokes keep independent K3s. Inventory and encrypted vault under inventory/ are kept. See scripts/teardown-hub.sh.

Completion does not certify public routing, backup, recovery, or tenant isolation. Verify those properties in the actual deployment before use.