ServerMind for Kubernetes/Fleet & Multi-Cluster

Fleet & Multi-Cluster

Bring clusters under management by import, registration token or a secretless ServiceAccount join. The agent dials out to the hub, and the hub keeps no standing credentials to your clusters.

Outbound-only

Three Ways to Join a Cluster

Import cluster

Paste a kubeconfig once. The hub checks the install can succeed, applies the agent with server-side apply, then discards the kubeconfig.

Registration token

For clusters the hub cannot reach. Mint a token, run the pre-rendered Helm command on the cluster, and the agent presents it once.

Secretless join

The agent presents a short-lived, audience-bound ServiceAccount token, verified against the cluster’s OIDC issuer. Nothing to mint or paste.

Cluster Identity

Private keyGenerated on the managed cluster. Only a CSR is sent, and the hub reads nothing from it but the public key.

Certificate identityStamped by the hub as spiffe://servermind/spoke/<cluster>, client-auth only

Lifetime90 days by default; 24 hours for a cluster bound to its ServiceAccount identity

RenewalThe agent renews between 60% and 50% of the lifetime, so no certificate is held past half its life

Serial pinningOnly the certificate issued last is recognised. Rotation retires the previous ones.

RemovalDeleting a cluster from the registry ends its enrollment. The old certificate cannot re-enroll it.

Registration Tokens & Import

Raw token shown once in the console, together with a ready-to-run Helm command
Only a SHA-256 hash is stored
Console TTL choices: 1 hour, 24 hours or 7 days
Tokens can be bound to one cluster name; a bound token presented for another name is refused
An unbound token can enroll a new name only. It cannot take over an existing cluster.
Import mints its own single-use, 1-hour token bound to that cluster
Revoking a token does not affect clusters that already joined with it
Kubeconfigs that point at link-local or cloud metadata addresses are refused

Provision New Clusters

SSH: k3s or RKE2

The hub connects over SSH to bare metal or VMs and installs k3s or RKE2
The SSH private key is referenced as a Kubernetes Secret and never passes through the API
Join tokens and kubeconfigs are withheld from every API read
Retry a failed build; nodes that are already Ready are skipped

Cluster API (Docker infrastructure)

Renders a standard Cluster API object graph and applies it to your management cluster
kubeadm or k3s control planes, on Docker infrastructure
Preview the rendered YAML without applying anything
Opt-in auto-import installs the agent once the control plane is initialized

Across the Fleet

Fleet inventory

Every cluster grouped by region, with node counts, CPU and memory totals, health and a Kubernetes version-skew rollup. Region, zone and labels are yours to set.

Workload placement

One policy names a bundle, a cluster selector and a spread: all matching clusters, exactly N, one per region, or a named list. Pause freezes scheduling without removing anything.

Multi-cluster Services

ServiceExport and ServiceImport (KEP-1645) propagated to every peer in the same cluster set. Port conflicts between exporters are surfaced, not hidden.

Fleet add-ons

Every Helm release the agents see, rolled up per chart with the widest version spread first. Releases not seen for an hour are flagged stale.

← ServerMind for Kubernetes Workloads & Live Operations →