> For the complete documentation index, see [llms.txt](https://experience-digital-transform.gitbook.io/experience-digital-transformation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://experience-digital-transform.gitbook.io/experience-digital-transformation/cloud-for-dpi/chapter-5/2-establish-management.md).
# 2. Establish Management
We use the initial-installation sequence from Chapter 4: provision the first machines, configure their connectivity and install Kubernetes. The playbooks in `govstack-bootstrap` carry that sequence into this platform installation. [\[9\]](https://git.vanillacore.net/govstack/govstack-bootstrap/src/commit/1195f539afe5a1018be07d2e1865824c225ee407/docs/spoke-lifecycle.md)[\[10\]](https://git.vanillacore.net/govstack/govstack-bootstrap/src/commit/1195f539afe5a1018be07d2e1865824c225ee407/tofu/bootstrap/main.tf)
## Provision and connect the first machines
OpenTofu creates the private network, subnet, router, ports, security groups, boot volumes and gateway and seed VMs. Before applying the infrastructure change, we review its plan against the chosen project, machine sizes and address allocation. After apply, the recorded server and network IDs connect the configuration to the resources in OpenStack. [\[10\]](https://git.vanillacore.net/govstack/govstack-bootstrap/src/commit/1195f539afe5a1018be07d2e1865824c225ee407/tofu/bootstrap/main.tf)
For example, the gateway VM uses the selected flavor and the network port declared for it:
```hcl
# Fields within the gateway VM resource.
name = "${var.name_prefix}-gateway"
flavor_name = var.gateway_flavor_name
network { port = openstack_networking_port_v2.gateway.id }
```
`name_prefix` groups the installation's resource names, `gateway_flavor_name` selects the gateway's machine size, and the declared port supplies its fixed address and security groups. The seed uses its own port and boot volume. These relationships remain visible in the resulting infrastructure state. [\[10\]](https://git.vanillacore.net/govstack/govstack-bootstrap/src/commit/1195f539afe5a1018be07d2e1865824c225ee407/tofu/bootstrap/main.tf)
Ansible then configures forwarding, outbound address translation and WireGuard on the gateway. We check the protected route to the seed and the seed's outbound connectivity. The next stage installs its container runtime and Kubernetes packages, initializes the control plane and configures networking. A responding Management API and a Ready Node establish the starting cluster. [\[9\]](https://git.vanillacore.net/govstack/govstack-bootstrap/src/commit/1195f539afe5a1018be07d2e1865824c225ee407/docs/spoke-lifecycle.md)
Figure 7. The initial machines provide connectivity and the Kubernetes system in which Management services are installed.
## Install the controllers and delivery services
On Management, the provider stage installs Cluster API and CAPO, the Cluster API Provider OpenStack. Their controller dependencies include the OpenStack Resource Controller and cert-manager introduced in Chapter 4. We check that the provider Deployments are available so that they can act on the forthcoming Spoke declarations. [\[9\]](https://git.vanillacore.net/govstack/govstack-bootstrap/src/commit/1195f539afe5a1018be07d2e1865824c225ee407/docs/spoke-lifecycle.md)
The next stages establish Management Argo CD and the cluster bridge. They also install **ApplicationSets**, which generate Argo CD Applications for the Spoke directories in Git. Each directory supplies the declarations for one managed environment. Management Argo CD then delivers its cluster configuration and foundation configuration to the appropriate APIs. [\[9\]](https://git.vanillacore.net/govstack/govstack-bootstrap/src/commit/1195f539afe5a1018be07d2e1865824c225ee407/docs/spoke-lifecycle.md)
Before requesting a Spoke, we check that Management can reach the configured Git sources and that its controllers can authenticate to OpenStack. The machine-image stage builds or verifies the image for the chosen Kubernetes version. With those dependencies in place, the platform can process a complete Spoke request. [\[9\]](https://git.vanillacore.net/govstack/govstack-bootstrap/src/commit/1195f539afe5a1018be07d2e1865824c225ee407/docs/spoke-lifecycle.md)
The optional private Dashboard provides the operator view used later in this chapter. Its installation is included in the [Management walkthrough](https://git.vanillacore.net/giga/content/src/branch/main/chapter-5/lab/walkthroughs/02-management.md), alongside the stage commands and their API, controller and image checks. [\[12\]](https://git.vanillacore.net/govstack-apps/govstack-dashboard/src/commit/f2e6ff3a0b752a0708983407e1176d72faeae702)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://experience-digital-transform.gitbook.io/experience-digital-transformation/cloud-for-dpi/chapter-5/2-establish-management.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
