Enroll a cluster

Each cluster you want in Fleet needs an agent (default) or another connectivity mode. Community clusters enroll the same way as paid clusters.

1. Register in Fleet

In the Fleet console, Clusters → add a name and slug. Optional tags (customer, region, site). Mode agent is the default. Copy the one-time fleet_enroll_* token. The response also has a webhook URL and secret for Inbox.

2. Cluster console

On that Lattice cluster, Settings → Fleet management (admin):

Settings → Fleet management: Fleet URL, one-time enroll token, local API, Save Fleet enrollment

Close

1. Fleet URL (https://fleet.example.com)
2. Enroll token
3. Local API (http://127.0.0.1:8080 if the agent is on the API host)
4. Save — you get a systemd env snippet

GET /api/v1/fleet/status is the same data, readonly.

3. Start the agent

On the cluster node:

sudo /opt/lattice-fleet/scripts/fleet-install \
  --mode agent \
  --fleet-url https://fleet.example.com \
  --enroll-token fleet_enroll_… \
  --local-api http://127.0.0.1:8080

Install after the cluster is up, on one control-plane VM. Current --mode agent does not change permissions on that machine’s Lattice files. On Fleet 0.1.0-beta.18 and 0.1.0-beta.17 that chmod hid the paid entitlement, so HA on the site failed until you fixed the files — upgrade the agent from this archive. If that VM is down, DHCP at the site still works; enroll on another node when you want the Fleet console back.

Replace an agent. --mode agent --force with a new enroll token starts a new identity. A leftover /var/lib/lattice/fleet-agent.key is discarded so the new token is used.

Config: /etc/lattice/fleet-agent.env. Unit: lattice-fleet-agent.service. After first connect the agent writes fleet_agent_… to /var/lib/lattice/fleet-agent.key and the cluster API token to /var/lib/lattice/fleet-agent.local-token. Remove the enroll token. Heartbeat file: /var/lib/lattice/fleet-agent-status.json. Fleet Overview should show agent connected. Restarting the agent does not need a new enroll. The agent key cannot mint a new cluster token.

Optional TLS to Fleet: FLEET_CA_FILE (extra PEM roots) and FLEET_CA_HASH (SHA-256 pin of the Fleet server cert; colons optional).

Other modes

Agent egress through a corporate proxy: FLEET_HTTP_PROXY (and optional FLEET_PROXY_USER / FLEET_PROXY_PASSWORD). Local API calls stay direct.

Upgrades

Deploy a new lattice-fleet-agent binary and restart. Existing FLEET_AGENT_KEY reconnects. Rotate enroll tokens only when replacing agent identity. Fleet Overview flags version skew.