Connect compute

​

Replacement behavior

​

Prerequisites

• Access to the Stackdome dashboard. Open Clusters under Platform to register compute. During alpha, every signup owns one organization and uses its default project, so there is no role or project-selection step.
• The target cluster runs stackdome-agent. Without the agent, the hub will happily store your credentials and write custom resources that nothing ever reconciles. Install the chart into the stackdome-control-plane namespace on the target cluster before you register it.
• The cluster’s API server is reachable from the hub. The hub opens outbound connections to the URL you register. For a cluster on another machine that means its API port — commonly 6443 — has to be open to the machine running Stackdome, not just to your laptop.
• kubectl access to the target cluster, to create the service account in the next section.
• An https:// URL. Registration rejects any other scheme.

​

Get the credentials

kubectl apply -f - <<'EOF'
apiVersion: v1
kind: ServiceAccount
metadata:
  name: stackdome-admin
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: stackdome-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: stackdome-admin
    namespace: kube-system
---
apiVersion: v1
kind: Secret
metadata:
  name: stackdome-admin-token
  namespace: kube-system
  annotations:
    kubernetes.io/service-account.name: stackdome-admin
type: kubernetes.io/service-account-token
EOF

# CA certificate — leave it base64-encoded, exactly as the Secret stores it.
kubectl -n kube-system get secret stackdome-admin-token -o jsonpath='{.data.ca\.crt}'

# Service account token — decode it to plaintext.
kubectl -n kube-system get secret stackdome-admin-token -o jsonpath='{.data.token}' | base64 -d

400 cluster CA data is not valid: data does not contain any valid RSA or ECDSA certificates

​

Connect it in the dashboard

​

Image registry

​

Naming the registry through the API

​

Verify

​

When it does not connect

• Reachability from the hub, not from you. The URL has to resolve and connect from the machine running Stackdome. Test it there rather than from your laptop:
  curl --silent --show-error --insecure \
    --output /dev/null --write-out '%{http_code}\n' \
    https://203.0.113.10:6443/version
  
  A 401 is a good result — it means you reached a Kubernetes API server and it declined an unauthenticated request. This probe sends no credential; --insecure is used only to separate network reachability from certificate and authentication checks. Never add an authorization header to it. A hang or a connection refusal points at a firewall or cloud security group that does not allow the hub’s IP on that port. A 127.0.0.1 or private address copied straight out of a kubeconfig is the single most common cause.
• CA and token validity. Confirm the Secret was populated and still authenticates from a protected temporary directory on a machine that can reach the cluster. This request verifies the server against the collected CA and gives curl the bearer header through a mode-0600 config file, so the token does not appear in the process argument list:
  umask 077
  diagnostic_dir="$(mktemp -d)"
  trap 'find "$diagnostic_dir" -type f -delete; rmdir "$diagnostic_dir"' EXIT
  trap 'exit 1' HUP INT TERM
  
  kubectl -n kube-system get secret stackdome-admin-token \
    -o jsonpath='{.data.ca\.crt}' | base64 --decode \
    > "$diagnostic_dir/cluster-ca.crt"
  
  {
    printf 'url = "https://203.0.113.10:6443/api"\n'
    printf 'cacert = "%s"\n' "$diagnostic_dir/cluster-ca.crt"
    printf 'header = "Authorization: Bearer '
    kubectl -n kube-system get secret stackdome-admin-token \
      -o jsonpath='{.data.token}' | base64 --decode | tr -d '\r\n'
    printf '"\n'
    printf 'silent = true\nshow-error = true\n'
    printf 'output = "/dev/null"\nwrite-out = "%%{http_code}\\n"\n'
  } > "$diagnostic_dir/curl.conf"
  
  curl --config "$diagnostic_dir/curl.conf"
  
  200 means the CA and credential are good. A certificate error means the endpoint does not present a certificate trusted by the collected CA; stop rather than bypassing verification. 401 means the token is wrong, was pasted still base64-encoded, or has expired because it came from kubectl create token instead of the Secret. 403 means the token authenticates but the ClusterRoleBinding did not apply. The shell trap deletes the CA and credential-bearing config when the diagnostic exits.
• The agent is actually running. Credentials and reachability can both be fine while nothing reconciles. Check the operator on the target cluster:
  kubectl -n stackdome-control-plane get pods
  
• Registration errors are explicit. If the form itself rejects the submission, the message names the cause: cluster CA data is not valid: data does not contain any valid RSA or ECDSA certificates (the value is not a base64-wrapped certificate — most often because it was decoded first), cluster URL must use https scheme, cluster with this api URL already exists, or cluster already exists for org.