Playbook and tag map
| Phase | Playbook(s) | What runs |
|---|---|---|
| 1a | host-prepare.yml |
OS prep, NM routing |
| 1b | wireguard.yml |
Overlay mesh to hub |
| 2–3 | ocm.yml (hub); spokes.yml (lab only) |
K3s + Calico + clusteradm |
| Flows | playbooks/flows/site-create.yml, cluster-create.yml |
Greenfield FCJ via API |
| Harbor | harbor.yml |
Registry; harbor_push_fleet |
| Platform | fleet-platform.yml |
OLM + cert-manager |
| DCM | fleet-dcm.yml |
Control plane + SP ManifestWorks |
| Hub install | hub-install.yml |
Greenfield through fleet-edge |
| Hub firewall | hub-firewall.yml |
WAN rules |
| Console | fleet-console-auth-crd.yml, fleet-console-auth.yml |
Auth + dashboard |
| Spoke ingress | fleet-spoke-ingress.yml, fleet-edge.yml |
Traefik NodePort; hub routes |
| Edge controllers | fleet-edge-crd.yml, fleet-edge-controller.yml |
FleetAppRoute stack |
| Fleet site | fleet-site-crd.yml, fleet-site-controller.yml |
FCJ provisioning |
| Backup | fleet-backup.yml |
Hub MinIO + spoke Velero |
| Full lab | fleet-deploy.yml |
Maintainer chain (not greenfield default) |
Prefer playbook tags when repairing a narrow subsystem. Cleanup: fleet-cleanup.yml.