Administrator guide

This guide gathers the tasks of the platform administrator and points, for each one, to the page that details it. French version: ../administration.md.

Roles and consoles

• The platform administrator holds the platform_admin role in the Control Plane. They declare the tenants, activate the licence, read the licence history, the audit and the policy decisions.
• Infrastructure operations (hosts, clusters, services, configurations, operations, backups and disaster recovery) happen in the Platform Manager console, served by navin-manager, or in the Platform Manager space of the portal, which goes through the Control Plane (ADR-0128, docs/architecture/ADRs/en/ADR-0128-console-unique-platform-manager.md).
• Every action takes a policy decision (OPA and OpenFGA) then leaves an audit event, refusals included.

First start

1. Install the platform: installation-handbook.md (prerequisites, profiles, offline bundle).
2. Register the hosts and create the cluster in the Platform Manager: navin-manager/docs/en/operations.md (registration tokens, inventory, system settings).
3. Activate the licence: POST /v1/license/activations with the signed token, or the offline command described in licensing.md. The state is read with GET /v1/license.
4. Connect identity (Keycloak, client federation) and policies: security-hardening.md and docs/security/en/identity-policy-plane.md.
5. Configure the components (EAI_* variables): configuration.md.

Day to day

Task	Where	Page
Start, stop, restart a service, rolling restart	Platform Manager, service page	navin-manager/docs/en/operations.md
Change a configuration, compare and restore a version	Platform Manager, Configurations	navin-manager/docs/en/operations.md
Follow a long operation, abort or retry it	Platform Manager, Operations	navin-manager/docs/en/operations.md
Upgrade the platform	offline bundle then services one by one	upgrade.md
Back up, restore, exercise disaster recovery	Platform Manager, Backups and DR	ha-dr.md, navin-manager/docs/en/backup-recovery.md
Monitor and receive alerts	Prometheus, Alertmanager, Navin Manager (machines and services), portal screens	alerting.md, slo.md
Respond to an incident	SOC, Kill Switch	runbooks.md, docs/security/en/soc-runbook.md
Renew the licence	renewal token	licensing.md
Troubleshoot	logs, states, operations	navin-manager/docs/en/troubleshooting.md

Rules to know

• A restore needs a plan, a dry run and two approvers other than the requester; the restore:execute permission is separate from backup:manage.
• A configuration change creates a version; secrets are never shown, only "set" or not.
• The licence limits neither users, nor agents, nor use cases. After the grace period, only new marketplace installations and distribution upgrades are refused; security, audit, backups and running agents never stop.
• The audit is chained and exported to the WORM evidence store: siem-audit.md.

Compliance

The mapping between control families and their evidence is described in compliance-mapping.md.