Install

First login and bootstrap administration

Create the first administrator, verify session security and establish the initial team and role boundary.

AudiencePlatform administratorsReading time10 minutesCommands in contextNo terminal requiredReviewed source9552586 · 1 August 2026

Before opening the UI

✓
The production URL uses the approved TLS name and trust chain
✓
/health and /ready pass; /health/clock reports acceptable time posture
✓
No bootstrap administrator already exists unless this is a documented restore
✓
The bootstrap operator uses a dedicated named account and approved password channel
✓
The environment owner is present to record recovery ownership

01
Open the ClusterPilot URL
When bootstrap state is incomplete, the UI presents the one-time administrator setup instead of the normal login.
02
Create the named administrator
Use a unique login and environment-approved password. Do not create a shared “admin” identity.
03
Sign in again
Confirm the normal login path, session cookie posture and displayed workspace.
04
Verify permissions
Open the current actor/permission view. The bootstrap account should resolve to platform_admin for the intended workspace.

Headless bootstrap state

GET /api/v1/auth/bootstrap-state
POST /api/v1/auth/bootstrap-admin
POST /api/v1/auth/login
GET  /api/v1/auth/me
GET  /api/v1/auth/permissions

Role	Use	Do not use for
platform_admin	Bootstrap, settings, identity, release and high-impact administration	Daily cluster observation
ops	Approved lifecycle operations and incident response	Identity or platform-wide security administration
developer	Scoped workload and developer-facing reads allowed by policy	Destructive infrastructure operations
tester	Validation and read-oriented QA workflows	General administration
service_principal	Scoped machine API keys	Human login; destructive permissions are not granted by default