Fleet identity is not cluster OIDC. Tokens on a cluster stay. SSO here is for people who live in the Fleet console.
Roles
| Role | Access |
|---|---|
fleet_admin | Full Fleet console; all clusters; connectivity settings |
fleet_operator | Assigned clusters; probe, break-glass, proxy writes |
fleet_readonly | Assigned clusters; GET / proxy read only |
Scope operators with IdP groups like fleet-cluster:acme (prefix configurable) or grants in the Fleet API (/fleet/v1/cluster-grants). An ISP operator should see only assigned customers.
Connectivity fields (api_base_url, SSH config, tokens) are fleet_admin only so an operator cannot retarget Fleet at an internal URL.
Break-glass
POST /fleet/v1/clusters/{id}/breakglass mints a short-lived cluster operator token. Audited. Fleet revokes it when it can reach the cluster API again. Use it for escalation, not as a standing admin password.
Settings
Fleet admins configure OIDC under Settings. Same pattern as cluster console SSO: issuer, client, redirect, group → role. Bootstrap FLEET_ADMIN_TOKEN remains for recovery.