3. Fleet Hub¶
The fleet hub is the 7KGroup management plane. It is a strictly operational cluster: it does not run client workloads, client Backstage instances, or client Crossplane planes. It manages the fleet and aggregates observability.
Management-plane configuration lives in the 7k-inari-fleet repository and is restricted to 7KGroup platform operators. Client overlays and architecture documentation live in 7k-inari.
3.1 Hosting¶
The management plane runs on a self-hosted Kubernetes cluster on bare-metal servers managed by 7KGroup. See ADR-008: Bare-Metal Management Plane.
The specific Kubernetes distribution (k3s, kubeadm, Talos, etc.) is an implementation detail and will be selected during Phase 1.
3.2 Responsibilities¶
| Function | Component | Purpose |
|---|---|---|
| Management-plane GitOps | ArgoCD | Deploys only management-plane components (Mimir, Loki, Grafana, Keycloak, Vault) |
| Client cluster provisioning | Crossplane | Provisions and manages lifecycle of client EKS/GKE/AKS clusters |
| mTLS certificate authority | Vault PKI | Issues per-client certificates for Alloy |
| Management-plane secret store | Vault KV | Stores management-plane secrets and provisioning credentials |
| Metrics store | Mimir | Multi-tenant Prometheus-compatible long-term metrics |
| Logs store | Loki | Multi-tenant log aggregation |
| Fleet dashboards | Grafana | Cross-client visibility |
| Fallback identity | Keycloak | Directory for clients without an enterprise IdP and 7KGroup operator access |
| Catalog source | Hiroba Catalog Git repo | Read-only mirror or direct reference to github.com/7kgroup/hiroba-catalog |
3.3 What the Fleet Hub Does NOT Do¶
- Run client Backstage instances
- Run client Crossplane control planes
- Execute Cloud Factory XRD logic on behalf of clients
- Store client workload data
- Act as a runtime dependency for client application traffic
3.4 ArgoCD in the Management Plane¶
The management-plane ArgoCD instance manages only the management plane itself. Its configuration is stored in the 7k-inari-fleet repository:
- Mimir
- Loki
- Grafana
- Keycloak
- Vault
- Internal tooling
It does not manage client clusters. Client clusters run their own ArgoCD instances that pull from 7k-inari. See ADR-010: Client-Local ArgoCD.
Cluster Registration¶
The management plane does not hold client cluster kubeconfigs. Client clusters are not registered as ArgoCD destinations in the management plane.
ApplicationSets¶
ApplicationSets in the management plane are limited to generating applications for management-plane components. Client overlays are consumed by client-local ArgoCD instances, not by the management-plane ArgoCD.
3.5 Observability Stack¶
| Data Type | Store | Tenant Isolation |
|---|---|---|
| Metrics | Mimir | X-Scope-OrgID header |
| Logs | Loki | X-Scope-OrgID header |
| Traces | Tempo (optional) | X-Scope-OrgID header |
Authentication from client Alloy agents to the observability stack uses mTLS. See ADR-006: Grafana Alloy.
3.6 Identity Fallback¶
Keycloak provides a fallback identity directory for clients who do not have an enterprise identity provider. Each client Dex instance connects to the same Keycloak realm via Dex's oidc connector, optionally with per-client client IDs or groups.
Keycloak can also federate to an internal 7KGroup user store or external directory as needed.
See ADR-002: CNOE Baseline for how CNOE patterns are used in the fleet hub.