Skip to main content

Connecting a cluster

Once the server is running and you've signed in, every cluster is added the same way: Discovery → Connect a cluster. The wizard does the work that would otherwise mean copying a chart reference, an image name and a token around by hand.

What the wizard gives you​

The printed command already contains everything it needs:

  • The chart reference (this server's own GHCR namespace — nothing to fill in).
  • This server's CA pin, printed as sha256/<base64> (the hash of the CA's public key), which the agent checks on first contact and again on every rejoin and renewal.
  • A one-time enrollment token, valid for one hour and one use.

Optionally, before you run it: narrow which namespaces the agent reports (Only look at some namespaces), or turn on the node probe, traffic observer and path measurements checkboxes if you want that extra detail from the start (all three are additive and off by default; see Observability intent for what each one actually collects). None of this is a Kubernetes permission boundary — the agent's RBAC stays cluster-wide read-only either way — it's a privacy boundary applied before anything leaves the cluster.

Run the printed command against the target cluster. See Exposing the agent port if you're curious what's actually happening on the wire, or Agent trust model for the enrollment sequence step by step.

The approval code​

A token proves someone was allowed to install an agent — it doesn't prove the agent that showed up is the one you meant. That's what the approval code is for.

When the agent first contacts the server, it generates a short code and prints it only in its own log:

kubectl -n continuum-system logs deploy/continuum-agent | grep -i 'approval code' | grep -oE '[A-Z0-9]{4}-[A-Z0-9]{4}'

That prints just the code itself — K7QM-4TXD, nothing else — piped through grep twice so there's no log line to read or trim by hand. (The UI's copy button next to this command copies exactly this, so most people never type it themselves.) Type or paste the code into the approve dialog (case, dashes and spaces don't matter). Because only someone with access to the cluster can read that log, approving it is confirmation that the agent asking to join really is the one running where you expect.

Five wrong codes reject the request permanently — install again with a fresh token if that happens. The dialog shows how many attempts are left. Every enrollment needs an approval code; there is no setting that skips it.

What happens after approval​

Nodes, namespaces and workloads start flowing into the topology within moments. Application groupings show up as suggestions in the Discovery inbox rather than being decided for you — accept the ones that look right, correct or dismiss the rest.

From here, the User guide covers the rest of the UI: what the Agents page shows you about each connected cluster, how to widen or narrow what an agent shares later, and how the Placement page's recommendations work.