One hub. Independent K3s clusters. Per-site exposure under your control.

What it is

UMKIM is an Ansible-driven multi-cluster fleet. The hub runs Open Cluster Management, Harbor, Traefik, fleet-site / fleet-edge controllers, and the fleet console. Each workload cluster is its own K3s server, joined over an overlay and managed with ManifestWork.

• Hub

  K3s + OCM + Harbor + console + fleet-site / fleet-edge controllers

• Site

  FleetSite — logical location with ingress[] entries and optional hubGateway

• Cluster

  FleetClusterJoin → ManagedCluster — standalone K3s, WireGuard /32, bootstrap bundle

• App

  FleetApp installs an OCI Helm chart on the Ready cluster you select — capability filters help pick, no placement engine

• Edge

  FleetAppRoute stitches public hostnames via hub gateway, site ingress, or none

• CLI

  umkim — sites, ingress, clusters, storage, node ops, charts against the hub API

What you can do with it

Patterns the PoC explores today — with clear limits on what is shipped versus intended.

• Independent K3s data planes

  Each workload cluster runs its own K3s server (not a hub agent). Spokes keep running when the hub is down for site-routed or private workloads. Hub-routed URLs require the hub gateway.

• Named site ingress entries

  Each site declares port_forward and/orreverse_proxy rows under spec.edge.ingress[]. Clusters bind with an ingressId. OptionalhubGateway enables hub-fronted public URLs for that site.

• FleetApp Helm installs

  Publish charts to the hub library (FleetChart), then install onto a named Ready cluster. Route with hub, site, ornone. Filter candidates by GPU, KVM, HA topology, or RWX — you still pick the cluster.

• Cluster and platform operations

  Add/remove/replace nodes, enable single-node local RWX (nfs_local), enable KubeVirt and manage VMs, and track job history from the console Operations tab orumkim CLI.

• Site host provisioning (optional)

  Bind a YAIDAP provisioner on a site jumphost to create VMs, install bare metal, discover hardware, and cluster-apply from native Ansible inventory on the hub. See the YAIDAP docs.

• Auto-configure from a downloaded bundle

  Cluster join issues a bootstrap tarball: download the bundle on the node andbootstrap.sh brings up WireGuard, local K3s, and enrollment instead of hand-wiring every spoke.

• Hub backup and restore

  backup-hub.sh and restore-hub.sh cover K3s state, WireGuard, ACME, and optional Harbor PVCs for disaster-recovery drills.

Operator path

Greenfield path: hub once, then sites and clusters from the console or CLI.

1. Install the hub

   ./scripts/install-hub.sh — WireGuard, OCM, Harbor, console, controllers.

2. Create a registry site

   Console Sites → Create (or umkim site), then add ingress entries (umkim site ingress).

3. Join a workload cluster

   FleetClusterJoin issues a bootstrap tarball; nodes enroll, then Provision registers OCM. Bind a site ingress id when ready.

4. Install an app

   Apps → Library (publish chart) → Apps (FleetApp install on a Ready cluster).

Read the getting started guide →

Stack

Pinned pieces you will actually run — see docs for the full version matrix.

• OS

  Rocky Linux 10 on hub and workload nodes

• K3s

  Independent servers per cluster; Calico CNI

• OCM

  clusteradm hub init / join; ManifestWork for platform pieces

• WireGuard

  Fleet overlay for hub → spoke management reachability

• Harbor

  Hub registry and charts project; fleet/* controller images from this repo

Architecture overview → · Concepts in the docs →