Managed Clusters
A managed cluster connects Linux infrastructure that your organization already operates to ACTIVATE. An agent on each registered node reports health and resource information, detects supported schedulers, and maintains an outbound tunnel to the platform.
ACTIVATE can then provide shared access, sessions, monitoring, and optional Linux identity management without provisioning or owning the machines. Your organization remains responsible for the hardware, operating system, scheduler, storage, network, backups, and capacity.
Choose the Right Integration
Managed clusters and existing clusters both connect infrastructure that ACTIVATE did not provision, but they serve different operating models.
| Capability | Managed Cluster | Existing Cluster |
|---|---|---|
| Ownership in ACTIVATE | One organization-owned resource | A connection definition for a user's access |
| Setup | Register an ACTIVATE agent on each node you want to manage or observe | Configure SSH connection details and credentials |
| Visibility | Node inventory, metrics, filesystems, and supported scheduler data | Connection and job-submission capabilities |
| Identity | Optionally synchronize ACTIVATE users, groups, SSH keys, home-directory setup, and sudo membership | Use accounts and authentication already configured on the cluster |
| Sessions | Run through a selected registered node's platform tunnel | Connect through the user's workspace and HPC Connect |
Choose a managed cluster when an organization administrator and Linux administrator will operate one shared integration. Choose an existing cluster when users need an SSH connection profile and identity is managed outside ACTIVATE.
Architecture
Every registered node makes outbound HTTPS and WebSocket connections to the ACTIVATE control plane over TCP port 443. Heartbeats carry node inventory and metrics. A persistent tunnel can carry SSH and managed sessions back to a selected node without requiring a public inbound route to that node.
The agent also exposes Prometheus metrics on TCP port 9100 on every registered node. Restrict that listener to trusted monitoring systems and cluster networks.
A small cluster can use one machine for several roles. Larger or security-sensitive environments can separate them.
| Node role | Register it when | What ACTIVATE uses it for |
|---|---|---|
| Login node | Users will open terminals or use CLI SSH through this node | SSH destination and, while its tunnel is connected, tunneled SSH |
| Scheduler controller | You want scheduler data in ACTIVATE | Slurm partitions and jobs, or PBS jobs |
| Session node | Users will launch browser desktop or VS Code sessions | Host for managed sessions over its live tunnel |
| Other node | You want its health, filesystems, or access settings managed | Node metrics, inventory, and optional access management |
Choose a Deployment Profile
Start with the smallest profile that meets your goal. Add access-management settings only after the basic connection works.
| Profile | Register | Enable | Best for |
|---|---|---|---|
| Monitoring only | Scheduler controller and any nodes you want to observe | No access-management settings | Inventory, health, and scheduler visibility without changing Linux identity configuration |
| Tunnel access with existing identities | Login node, session node if needed, and scheduler controller | Usually no identity settings | Sites where usernames, home directories, and SSH keys already exist |
| ACTIVATE-managed identity and access | Every node where users must resolve, sign in, or receive sudo membership | User Population plus the settings required by your policy | Centralized ACTIVATE users, groups, SSH keys, home-directory setup, and sudo membership |
Responsibilities and Handoffs
Agree on ownership before registration, especially because the agent runs as root and access-management options alter system configuration.
| Role | Responsibilities |
|---|---|
| ACTIVATE organization administrator | Create the resource, configure connections and access, grant permissions, select the session node, and coordinate agent updates |
| Linux or HPC administrator | Approve and install the agent, which runs as root; validate NSS/PAM/SSH/sudo changes; manage the scheduler; and restore host configuration during offboarding |
| Network or security administrator | Permit outbound platform traffic, restrict the metrics listener, and approve any direct SSH path or package downloads |
| End user | Maintain their ACTIVATE SSH public key, use the assigned access level, and follow site job and session policies |
The ACTIVATE administrator should hand the Linux administrator the intended node roles, deployment profile, access settings, and rollback plan. After validation, give users the cluster name, their access level, the supported login method, and the site's scheduler and session guidance.
Setup Journey
- Plan the topology, check prerequisites, and register a pilot node.
- Configure Linux identity and grant access, if required.
- Complete the pilot acceptance checks before registering the remaining nodes.
- Share connection, session, workflow, and job instructions with users.
- Follow the operations and offboarding guide for monitoring, updates, troubleshooting, and removal.