Architecture
Three console layers sit on one physical hub. Workload clusters are never K3s agents of the hub — they register to OCM over WireGuard and receive platform bits via ManifestWork.
Layers
| Layer | Object | Role |
|---|---|---|
| Infrastructure | Hub inventory host | K3s, OCM, DCM, Harbor, console, controllers — not a ManagedCluster |
| Site | FleetSite | Logical datacenter: DNS zones, WAN exposure, region metadata |
| Cluster | ManagedCluster + FleetClusterJoin | Standalone K3s data plane, fleet.site label, capabilities, ingress |
Network planes
Each node has a management LAN address for the K3s API, etcd, and Calico. Greenfield clusters also run wg-umkim — a /32 on the fleet overlay so the hub reaches spoke NodePorts without public routing. DCM service providers listen on NodePorts on that overlay IP.
Controllers on the hub
| Controller | Role |
|---|---|
| fleet-site | Sites, FleetClusterJoin bootstrap, edge ConfigMaps, provider jobs; backup/restore CRs (unstable) |
| fleet-edge | FleetAppRoute reconcile: hub Traefik fragments, spoke Ingress ManifestWorks, ACME |
| fleet-edge-route-sync | Polls DCM catalog instances → creates/updates/prunes FleetAppRoute |
| fleet-failover-controller | Standby failover: patches FleetAppRoute.status.activeCluster |
| fleet-console-auth | Session RBAC, org quotas, proxy to DCM and fleet-site APIs |
Deep dives live on the docs site: fleet model, network planes, hub install lifecycle.