Self-hosted
DERequest a demo →
Skip to documentation content
ClusterPilot Docs
Product tour Self-hosted
Start with:EvaluateInstallCreate a clusterOperateRecoverAutomate
Documentation/Operate
Operate

Built-in add-ons

Plan curated add-ons from immutable artifacts, run preflight, install through the agent, and require semantic health evidence.

AudiencePlatform and add-on operatorsReading time17 minCommands in contextNo terminal requiredReviewed source9552586 · 1 August 2026

v0.0.5 catalog

CategoryCatalog entries
Delivery and certificatesArgo CD 2.13.1 · Flux 2.4.0 · cert-manager 1.16.2
PolicyOPA Gatekeeper 3.17.1 · Kyverno 1.12.6
Ingressingress-nginx 1.11.3 · Traefik 3.2.1
ObservabilityPrometheus 2.55.1 · Grafana 11.3.1 · Loki 3.2.1 · OpenSearch 2.17.1
Registry, storage, recoveryHarbor 2.12.2 · Rook Ceph 1.15.7 · Velero 1.15.0
Generic installersHelm · manifest · operator

These are catalog baselines, not automatic production approval. The exact chart, manifest, bundle, tool, and image digests in the generated artifact lock are authoritative.

Installation workflow

  1. 01

    Select and configure

    Choose the catalog entry, namespace, approved options, dependencies, storage, DNS, and secret references.

  2. 02

    Resolve immutable artifacts

    Create a plan with digest-pinned images, chart/bundle locks, tool versions, and registry promotion evidence.

  3. 03

    Run preflight

    Validate cluster version, conflicts, capacity, CRDs, storage classes, DNS, ingress, registry access, and required features.

  4. 04

    Install

    The agent acquires and verifies artifacts before namespace/workload mutation, then applies the ordered plan.

  5. 05

    Run health gates

    Require resource readiness and, where defined, a semantic smoke test.

  6. 06

    Accept or repair

    Record evidence, expose dashboard posture only when healthy, or repair the failed gate and retry the eligible plan.

Conflicts and prerequisites

Add-onImportant rule
ingress-nginx / TraefikCatalog conflict: do not install both as the managed ingress controller without an approved coexistence design.
Rook CephRequires the storage-devices capability and a reviewed disk ownership/destruction plan.
VeleroRequires an object-storage profile; backup/restore smoke is meaningful only with an available BackupStorageLocation.
HarborRequires registry credentials through a typed SecretRef and push/pull health evidence.
OpenSearchRole-split releases have explicit cluster-manager/data/optional ingest and Dashboards readiness checks.

Semantic health gates

Health gates go beyond “pods are running.” Examples include Harbor push/pull, Velero backup/restore, Rook Ceph health and PVC bind, Prometheus target discovery, cert-manager request signing, and policy-engine admission denial.

Error codeMeaningNext action
CLUSTER_ADDON_HEALTH_GATE_CHECKER_MISSINGThe plan requested an unsupported semantic checker.Upgrade the control plane or change the approved policy.
CLUSTER_ADDON_HEALTH_GATE_SECRET_REF_REQUIREDA required secret reference is absent.Provide the typed SecretRef; never inline credentials.
CLUSTER_ADDON_HEALTH_GATE_FAILEDThe agent ran the gate and it failed.Inspect redacted command evidence and fix the underlying service.

Clear installation history

The operation history shows the selected version, each step and the final health result.