Sveltos: install on mini + bootstrap cluster registration (static SA)

ginjiruu commented

2026-08-12 16:49:43 +00:00

Owner

Sveltos: install on mini + bootstrap cluster registration (static SA)

Sveltos is the fleet-management layer for tofu-rendered infrastructure
(research #31). To start using it we must install it on mini and register the
fleet clusters. This ticket covers the one-time bootstrap; the OIDC migration
is a separate ticket (#36).

Install Sveltos on mini (management cluster)

Deploy Sveltos on mini via the flux-clusters repo (HelmRelease + CRDs) — the
ClusterProfiles are already staged inert in flux-clusters/sveltos/ (PR
#1526) and the CRDs must land before those profiles are wired in (Flux
root build fails on unknown CRDs — the ordering gate documented there).
Sveltos auto-registers the management cluster as mgmt/mgmt — add the
sveltos.io/... labels per the iac cluster registry so mini itself matches
the fleet ClusterProfiles.

Bootstrap fleet cluster registration (static SA, one-time manual)

Mirroring argocd cluster add (Argo CD's bootstrap SA), register each fleet
cluster with a static cluster-admin SA first:

sveltosctl generate kubeconfig --create against the managed cluster
(creates a cluster-admin SA + kubeconfig).
sveltosctl register cluster --namespace=<ns> --cluster=<name> --kubeconfig=<file> --labels=<labels> against the Sveltos management
cluster (mini), with labels from the iac cluster registry
(apps/clusters.yaml, clusters.<name>.sveltos).

Programmatic equivalent (for git/automation):

Secret <cluster>-sveltos-kubeconfig (data.kubeconfig) + SveltosCluster
CR (label sveltos-agent: present) in the management cluster.

Clusters: mini (via mgmt registration), portable, remote. mx2/localhost and
the incoming firewalled cluster: registered when they first host catalog
apps; the firewalled cluster's reachability is T13 (#28).

After bootstrap

Wire ./sveltos into mini's build → the staged ClusterProfiles go live →
delete the now-redundant per-cluster pointer files
(clusters/{mini,portable,remote}/vault-secrets-operator.yaml, the ESO
HelmRelease sets, standard-cluster Kustomizations) — per
plans/sveltos-flux-integration.md.
sveltosctl show addons should list the fleet and the deployed addons.

Deliverables

Sveltos installed on mini, mgmt cluster labelled per registry
portable + remote registered (SveltosCluster Ready) with registry labels
ClusterProfiles live; per-cluster pointers removed
sveltosctl show addons green across the fleet

Depends on / linked

#31 research (pull-mode licensing → push mode + T13 for firewalled)
flux-clusters PR #1526 (staged ClusterProfiles)
T13 #28 (connectivity; only required for the firewalled cluster)
#36 (migrate Sveltos auth to Kanidm SA + OIDC — the follow-on)

## Sveltos: install on mini + bootstrap cluster registration (static SA) Sveltos is the fleet-management layer for tofu-rendered infrastructure (research #31). To start using it we must install it on mini and register the fleet clusters. This ticket covers the one-time bootstrap; the OIDC migration is a separate ticket (#36). ## Install Sveltos on mini (management cluster) - Deploy Sveltos on mini via the flux-clusters repo (HelmRelease + CRDs) — the ClusterProfiles are already staged inert in `flux-clusters/sveltos/` (PR #1526) and the CRDs must land **before** those profiles are wired in (Flux root build fails on unknown CRDs — the ordering gate documented there). - Sveltos auto-registers the management cluster as `mgmt`/`mgmt` — add the `sveltos.io/...` labels per the iac cluster registry so mini itself matches the fleet ClusterProfiles. ## Bootstrap fleet cluster registration (static SA, one-time manual) Mirroring `argocd cluster add` (Argo CD's bootstrap SA), register each fleet cluster with a **static cluster-admin SA** first: 1. `sveltosctl generate kubeconfig --create` against the managed cluster (creates a cluster-admin SA + kubeconfig). 2. `sveltosctl register cluster --namespace=<ns> --cluster=<name> --kubeconfig=<file> --labels=<labels>` against the Sveltos management cluster (mini), with labels from the iac cluster registry (`apps/clusters.yaml`, `clusters.<name>.sveltos`). Programmatic equivalent (for git/automation): - Secret `<cluster>-sveltos-kubeconfig` (data.kubeconfig) + `SveltosCluster` CR (label `sveltos-agent: present`) in the management cluster. Clusters: mini (via mgmt registration), portable, remote. **mx2/localhost and the incoming firewalled cluster**: registered when they first host catalog apps; the firewalled cluster's reachability is T13 (#28). ## After bootstrap - Wire `./sveltos` into mini's build → the staged ClusterProfiles go live → delete the now-redundant per-cluster pointer files (`clusters/{mini,portable,remote}/vault-secrets-operator.yaml`, the ESO HelmRelease sets, standard-cluster Kustomizations) — per `plans/sveltos-flux-integration.md`. - `sveltosctl show addons` should list the fleet and the deployed addons. ## Deliverables - [ ] Sveltos installed on mini, mgmt cluster labelled per registry - [ ] portable + remote registered (SveltosCluster Ready) with registry labels - [ ] ClusterProfiles live; per-cluster pointers removed - [ ] `sveltosctl show addons` green across the fleet ## Depends on / linked - #31 research (pull-mode licensing → push mode + T13 for firewalled) - flux-clusters PR #1526 (staged ClusterProfiles) - T13 #28 (connectivity; only required for the firewalled cluster) - #36 (migrate Sveltos auth to Kanidm SA + OIDC — the follow-on)

ginjiruu referenced this issue

2026-08-12 16:50:02 +00:00

Kanidm: provision per-cluster OAuth2 clients + machine SAs for cluster tooling #35

ginjiruu referenced this issue

2026-08-12 16:50:17 +00:00

Migrate Sveltos cluster auth from static SA to Kanidm SA + OIDC #36

~~ginjiruu referenced this issue 2026-08-12 16:50:32 +00:00~~

Argo CD: in-place migration of cluster auth from static SA to Kanidm SA + OIDC #37

~~ginjiruu referenced this issue 2026-08-12 16:58:27 +00:00~~

Research: short-lived id_token refresh for static cluster credentials #38

ginjiruu added this to the Cluster tooling auth -> Kanidm OIDC (Golden Path) milestone

2026-08-13 01:55:28 +00:00