# Celum

> Operator documentation for Celum — the multi-supervisor Kubernetes management platform.

## Docs

- [Introduction](https://docs.celum.io/get-started/introduction.md): Celum is a multi-supervisor Kubernetes management platform with GitOps cluster lifecycle, OIDC + IAM authorization, and a full operations stack — networking, storage, observability, security, and VMs.
- [Quickstart](https://docs.celum.io/get-started/quickstart.md): Deploy Celum with Docker Compose: the dashboard, API, and database behind your reverse proxy.
- [Authentication & IAM](https://docs.celum.io/get-started/authentication.md): Sign-in with OIDC, signed session cookies, and AWS-style policy authorization with KRN resources.
- [Architecture](https://docs.celum.io/concepts/architecture.md): How the dashboard, API, datastores, and supervisor clusters fit together.
- [Supervisors & clusters](https://docs.celum.io/concepts/supervisors-and-clusters.md): How Celum discovers supervisors from kubeconfigs, what a tenant cluster is, and how the two are addressed.
- [Projects](https://docs.celum.io/concepts/projects.md): A project is a namespace plus its own slice of pod, LoadBalancer, and egress address space — held entirely in Kubernetes.
- [Permissions model](https://docs.celum.io/concepts/permissions-model.md): How a request becomes an action and a KRN, how wildcards match, and why an unmapped route is denied.
- [Clusters overview](https://docs.celum.io/clusters/overview.md): The four cluster models Celum provisions — topology clusters, GitLab-managed guest clusters, vcluster hosted control planes, and Kamaji Talos workers — and the Cluster API engine behind all of them.
- [Create a cluster](https://docs.celum.io/clusters/create.md): Provision a tenant cluster from a form, a Cluster API class, or a reusable template — with a preview before anything is created.
- [Templates & addons](https://docs.celum.io/clusters/templates.md): Cluster templates — reusable blueprints with Go-template variables, rendered and previewed before anything is created — and cluster addons pushed into guest clusters as ClusterResourceSets.
- [Day-2 operations](https://docs.celum.io/clusters/day-2-operations.md): Everything Celum reads inside a running tenant cluster — nodes, events, metrics, Helm releases, exposure, and workloads — without anyone touching kubectl.
- [Hosted control planes](https://docs.celum.io/clusters/hosted-control-planes.md): vcluster instances — full Kubernetes control planes running as pods on the supervisor — and Kamaji Talos workers, which attach real Talos nodes to a hosted control plane.
- [Access & credentials](https://docs.celum.io/clusters/access-and-credentials.md): Retrieving a tenant cluster's kubeconfig, talosconfig, and SSH password — decrypted server-side, gated by dedicated permissions, and always audited.
- [Troubleshooting clusters](https://docs.celum.io/clusters/troubleshooting.md): The triage order for an unhealthy tenant — fleet health, machines, tenant events, then pod events and logs — plus the known patterns that look like failures but aren't.
- [GitOps & Apps overview](https://docs.celum.io/gitops/overview.md): The three routes software takes onto a Celum cluster — the app catalog committed through Git, ArgoCD Applications and ApplicationSets, and direct Helm — and where Flux fits on the supervisor.
- [App catalog](https://docs.celum.io/gitops/app-catalog.md): Authoring reusable Helm app definitions — chart source, a Go-template values file rendered per cluster, render preview, chart validation, the enabled flag, and catalog import/export.
- [ArgoCD](https://docs.celum.io/gitops/argocd.md): Discovering ArgoCD instances across supervisors and their guest clusters, onboarding one onto DNS and SSO, listing Applications in a namespace, and managing ApplicationSets.
- [Repositories & manifests](https://docs.celum.io/gitops/repositories-and-manifests.md): Registering Git sources with a branch, token and default flag, and how adding or removing a cluster's app becomes a real GitLab commit — plus the declared-versus-running distinction.
- [Charts & the mirror](https://docs.celum.io/gitops/charts.md): Searching ArtifactHub for a chart, reading the platform catalogue's pinned and available versions, and using chart mirror status as the first check when a version list is empty or an install cannot pull.
- [Create a VM](https://docs.celum.io/vms/create.md): Provision a KubeVirt virtual machine from a golden image or an ISO, with cloud-init, sysprep, disk layout, and network mode.
- [VM lifecycle](https://docs.celum.io/vms/lifecycle.md): Start, stop, resize, live-migrate, snapshot, clone, move between projects, and delete a virtual machine.
- [VM networking](https://docs.celum.io/vms/networking.md): Publish VM ports through a LoadBalancer or a Gateway, inspect what the guest is listening on, and give a VM a migration-stable address.
- [VM storage & disks](https://docs.celum.io/vms/storage.md): Attach, mount, detach, and delete VM volumes — and understand which of those destroy data.
- [Console & access](https://docs.celum.io/vms/console-and-access.md): Reach a VM through the browser console, and use the guest agent for processes, filesystems, metrics, and logs.
- [Networking overview](https://docs.celum.io/networking/overview.md): The engine model behind a supervisor's network — CNI, BGP, and north-south — and how the Networking page organizes pools, BGP, egress, gateways, and routes.
- [Project networking](https://docs.celum.io/networking/project-networking.md): How per-tenant networking — address slices, egress identity, isolation — is defined on the project and materializes as the objects the Networking page shows.
- [Pools & IPAM](https://docs.celum.io/networking/pools-and-ipam.md): Manage LoadBalancer, VM identity, and Pod IP pools in one table — utilization, conflict signals, and the allocation views underneath.
- [VM identity pools](https://docs.celum.io/networking/vm-identity-pools.md): Give VMs a stable claim address that follows them through live migration — create pools, preview the next address, and re-address stale claims.
- [BGP & Egress](https://docs.celum.io/networking/bgp-and-egress.md): Monitor BGP sessions, reconcile the advertise table against what routers actually see, and manage egress — candidate nodes, HA, and SNAT policies.
- [Gateways & Routes](https://docs.celum.io/networking/gateways-and-routes.md): Run shared Gateways with a single LoadBalancer address, edit listeners and TLS, switch datapath modes, and publish services and tenant APIs.
- [Security overview](https://docs.celum.io/security/overview.md): How the flow store behind every Security tab is fed, what each tab answers, how the since/offset window works, and how to tell an empty view from a quiet network.
- [Topology](https://docs.celum.io/security/topology.md): The traffic graph — node kinds and their listening ports, edge verdicts and policy coverage, the grouping and filter controls, and the coverage blind spots you must know about.
- [Flow analytics](https://docs.celum.io/security/flow-analytics.md): The aggregate views over the flow store — namespace chords, FQDN egress, L7 and DNS breakdowns, byte pairs, policy effectiveness, edge quality and application grouping — and what each one is actually good for.
- [Forensics](https://docs.celum.io/security/forensics.md): Ingress and egress drill-down — who is reaching a service and where a workload phones home — including the arguments each view requires and how to replay a past incident with since and offset.
- [Network policies](https://docs.celum.io/security/policies.md): Authoring CiliumNetworkPolicies through the platform — dry-run against observed traffic, apply, verify coverage, watch for drift — plus per-policy detail and the coverage blind spots to account for.
- [Pipeline & runtime](https://docs.celum.io/security/pipeline-and-runtime.md): Standing up flow collection on a supervisor, extending it to guest clusters and vclusters, running Tetragon, managing platform secrets, and the force-cleanup escape hatches — including exactly what each one destroys.
- [Platform health overview](https://docs.celum.io/platform-health/overview.md): How Celum tracks every platform component — the HelmRelease status model, the install → ready lifecycle, where component state surfaces in the UI, and the triage order when something looks wrong.
- [Monitoring](https://docs.celum.io/platform-health/monitoring.md): The per-supervisor Prometheus stack — install state and versions, the ServiceMonitor inventory, opt-in hardware exporters, and what to read when the release is not ready.
- [Logs](https://docs.celum.io/platform-health/logs.md): Loki and the Alloy collectors — the two components behind platform logs, release state vs runtime state, the tenant log read layer, and the failure modes that keep a green release from shipping logs.
- [Flow telemetry](https://docs.celum.io/platform-health/flow-telemetry.md): ClickHouse and the flow pipeline behind topology, forensics, and policy insights — the ingestion path, schema chart versioning, and why freshness is always the first check.
- [Infrastructure & nodes](https://docs.celum.io/platform-health/infrastructure.md): The per-supervisor node board — capacity, live utilization, disks, NICs, Fibre Channel, GPUs — plus per-node detail, the resource browser, and power profiles on bare metal.
- [Slack notifications](https://docs.celum.io/platform-health/slack-notifications.md): Post guest-cluster deletion approvals — with Approve/Reject buttons clicked in Slack — and cluster health alerts to a channel.
- [Storage overview](https://docs.celum.io/storage/overview.md): The three storage backends a supervisor can run — Rook-Ceph, NFS, and Fibre Channel — how to choose between them, where install and day-2 state live, and the triage order for a Pending PVC.
- [Rook-Ceph](https://docs.celum.io/storage/rook-ceph.md): Install Ceph from local disks or SAN FC LUNs — the disk inventory and wipe flow, the san device class, cluster health, rollback recovery, and the failures that actually happen.
- [NFS & Fibre Channel](https://docs.celum.io/storage/nfs-and-fibre-channel.md): The external storage backends — the NFS CSI driver with its storage classes and test-PVC smoke check, and the Hitachi HSPC driver for dynamic FC volume carving, with its multipath prerequisite.
- [Classes & profiles](https://docs.celum.io/storage/classes-and-profiles.md): StorageClasses and their CDI StorageProfiles — clone strategy, access-mode × volume-mode support, the test-PVC diagnostic, and which class to give VMs and golden images.
- [PVCs & snapshots](https://docs.celum.io/storage/pvcs-and-snapshots.md): The per-namespace claim browser and volume snapshot list, the snapshot controller component, and the full checklist for a claim stuck Pending.
- [Permissions](https://docs.celum.io/reference/permissions.md): Every IAM action Celum defines, grouped by service, with the KRN each is checked against.
- [Environment variables](https://docs.celum.io/reference/environment-variables.md): Every variable the Celum backend and dashboard read, with defaults, fallbacks, and which ones can come from a secret store.
- [Glossary](https://docs.celum.io/reference/glossary.md): The vocabulary Celum uses — supervisors, KRNs, projects, supercidrs, and the rest.