feat: multi-cluster management with pool-based load balancing

- Add ClusterPool entity for grouping clusters into named pools
- Support 3 deployment modes: manual cluster, pool load-balanced, default fallback
- Pool strategies: least-apps (fewest deployed apps) and round-robin
- Add pool CRUD API endpoints (admin) and public pool listing
- Frontend deploy page: 3-mode cluster selector (Default/Manual/Pool)
- Frontend app detail: shows assigned cluster and pool info
- Admin pools management page with cluster selection and strategy picker
- Application entity extended with poolId field

backend/src/clusters/clusters.controller.ts

@@ -12,6 +12,7 @@ import { AuthGuard } from '@nestjs/passport';
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { ClustersService } from './clusters.service';
 import { CreateClusterDto, UpdateClusterDto } from './dto/cluster.dto';
+import { CreateClusterPoolDto, UpdateClusterPoolDto } from './dto/cluster-pool.dto';
 import { RolesGuard } from '../common/guards/roles.guard';
 import { Roles } from '../common/decorators/roles.decorator';
 import { UserRole } from '../common/enums';
@@ -20,44 +21,103 @@ import { UserRole } from '../common/enums';
 @ApiBearerAuth()
 @Controller('clusters')
 @UseGuards(AuthGuard('jwt'), RolesGuard)
-@Roles(UserRole.ADMIN)
 export class ClustersController {
   constructor(private readonly clustersService: ClustersService) {}
 
+  // ─── Public endpoints (any authenticated user) ────────────────────
+
+  @Get('public')
+  @ApiOperation({ summary: 'List available clusters (public info, no kubeconfig)' })
+  async findAllPublic() {
+    return this.clustersService.findAllPublic();
+  }
+
+  @Get('pools/public')
+  @ApiOperation({ summary: 'List active cluster pools with resolved cluster names' })
+  async findAllPoolsPublic() {
+    return this.clustersService.findAllPoolsPublic();
+  }
+
+  // ─── Cluster admin endpoints ──────────────────────────────────────
+
   @Post()
+  @Roles(UserRole.ADMIN)
   @ApiOperation({ summary: 'Register a new Kubernetes cluster (Admin only)' })
   async create(@Body() dto: CreateClusterDto) {
     return this.clustersService.create(dto);
   }
 
   @Get()
+  @Roles(UserRole.ADMIN)
   @ApiOperation({ summary: 'List all clusters (Admin only)' })
   async findAll() {
     return this.clustersService.findAll();
   }
 
   @Get(':id')
+  @Roles(UserRole.ADMIN)
   @ApiOperation({ summary: 'Get cluster details (Admin only)' })
   async findOne(@Param('id') id: string) {
     return this.clustersService.findOne(id);
   }
 
   @Patch(':id')
+  @Roles(UserRole.ADMIN)
   @ApiOperation({ summary: 'Update cluster configuration (Admin only)' })
   async update(@Param('id') id: string, @Body() dto: UpdateClusterDto) {
     return this.clustersService.update(id, dto);
   }
 
   @Post(':id/test')
+  @Roles(UserRole.ADMIN)
   @ApiOperation({ summary: 'Test connectivity to a registered cluster (Admin only)' })
   async testConnection(@Param('id') id: string) {
     return this.clustersService.testClusterById(id);
   }
 
   @Delete(':id')
+  @Roles(UserRole.ADMIN)
   @ApiOperation({ summary: 'Remove a cluster (Admin only)' })
   async delete(@Param('id') id: string) {
     await this.clustersService.delete(id);
     return { message: 'Cluster deleted' };
   }
+
+  // ─── Cluster Pool admin endpoints ─────────────────────────────────
+
+  @Post('pools')
+  @Roles(UserRole.ADMIN)
+  @ApiOperation({ summary: 'Create a cluster pool for load balancing (Admin only)' })
+  async createPool(@Body() dto: CreateClusterPoolDto) {
+    return this.clustersService.createPool(dto);
+  }
+
+  @Get('pools')
+  @Roles(UserRole.ADMIN)
+  @ApiOperation({ summary: 'List all cluster pools (Admin only)' })
+  async findAllPools() {
+    return this.clustersService.findAllPools();
+  }
+
+  @Get('pools/:id')
+  @Roles(UserRole.ADMIN)
+  @ApiOperation({ summary: 'Get cluster pool details (Admin only)' })
+  async findOnePool(@Param('id') id: string) {
+    return this.clustersService.findOnePool(id);
+  }
+
+  @Patch('pools/:id')
+  @Roles(UserRole.ADMIN)
+  @ApiOperation({ summary: 'Update cluster pool (Admin only)' })
+  async updatePool(@Param('id') id: string, @Body() dto: UpdateClusterPoolDto) {
+    return this.clustersService.updatePool(id, dto);
+  }
+
+  @Delete('pools/:id')
+  @Roles(UserRole.ADMIN)
+  @ApiOperation({ summary: 'Delete a cluster pool (Admin only)' })
+  async deletePool(@Param('id') id: string) {
+    await this.clustersService.deletePool(id);
+    return { message: 'Cluster pool deleted' };
+  }
 }

backend/src/clusters/clusters.module.ts

@@ -3,9 +3,10 @@ import { TypeOrmModule } from '@nestjs/typeorm';
 import { ClustersService } from './clusters.service';
 import { ClustersController } from './clusters.controller';
 import { Cluster } from './entities/cluster.entity';
+import { ClusterPool } from './entities/cluster-pool.entity';
 
 @Module({
-  imports: [TypeOrmModule.forFeature([Cluster])],
+  imports: [TypeOrmModule.forFeature([Cluster, ClusterPool])],
   controllers: [ClustersController],
   providers: [ClustersService],
   exports: [ClustersService],

backend/src/clusters/clusters.service.ts

@@ -1,18 +1,25 @@
 import { Injectable, NotFoundException, Logger, BadRequestException } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
-import { Repository } from 'typeorm';
+import { Repository, DataSource, In } from 'typeorm';
 import * as k8s from '@kubernetes/client-node';
 import { Cluster } from './entities/cluster.entity';
+import { ClusterPool } from './entities/cluster-pool.entity';
 import { CreateClusterDto, UpdateClusterDto } from './dto/cluster.dto';
+import { CreateClusterPoolDto, UpdateClusterPoolDto } from './dto/cluster-pool.dto';
 import { ClusterStatus } from '../common/enums';
 
 @Injectable()
 export class ClustersService {
   private readonly logger = new Logger(ClustersService.name);
+  private roundRobinIndex = 0;
+  private poolRoundRobinIndices = new Map<string, number>();
 
   constructor(
     @InjectRepository(Cluster)
     private clustersRepository: Repository<Cluster>,
+    @InjectRepository(ClusterPool)
+    private poolsRepository: Repository<ClusterPool>,
+    private dataSource: DataSource,
   ) {}
 
   /**
@@ -135,8 +142,210 @@ export class ClustersService {
     return result;
   }
 
+  /**
+   * Public cluster list (no sensitive data) — for users to select a cluster.
+   */
+  async findAllPublic(): Promise<Pick<Cluster, 'id' | 'name' | 'region' | 'provider' | 'isDefault' | 'status'>[]> {
+    return this.clustersRepository.find({
+      select: ['id', 'name', 'region', 'provider', 'isDefault', 'status'],
+      where: { status: ClusterStatus.ACTIVE },
+      order: { isDefault: 'DESC', name: 'ASC' },
+    });
+  }
+
+  /**
+   * Get the optimal cluster using load-balancing strategy.
+   * Strategy: 'least-apps' — picks the active cluster with fewest deployed applications.
+   * Falls back to default cluster if only one active cluster exists.
+   */
+  async getOptimalCluster(strategy: 'least-apps' | 'round-robin' = 'least-apps'): Promise<Cluster> {
+    const activeClusters = await this.clustersRepository.find({
+      where: { status: ClusterStatus.ACTIVE },
+    });
+
+    if (activeClusters.length === 0) {
+      throw new NotFoundException('No active clusters available');
+    }
+
+    if (activeClusters.length === 1) {
+      return activeClusters[0];
+    }
+
+    if (strategy === 'round-robin') {
+      const cluster = activeClusters[this.roundRobinIndex % activeClusters.length];
+      this.roundRobinIndex++;
+      this.logger.log(`Round-robin selected cluster "${cluster.name}" (index: ${this.roundRobinIndex - 1})`);
+      return cluster;
+    }
+
+    // least-apps: count applications per cluster
+    const appCounts: { clusterId: string; count: string }[] = await this.dataSource.query(`
+      SELECT "clusterId", COUNT(*) as count
+      FROM applications
+      WHERE "clusterId" IS NOT NULL
+      GROUP BY "clusterId"
+    `);
+
+    const countMap = new Map<string, number>();
+    for (const row of appCounts) {
+      countMap.set(row.clusterId, parseInt(row.count, 10));
+    }
+
+    // Sort by app count ascending (least apps first)
+    activeClusters.sort((a, b) => {
+      const countA = countMap.get(a.id) || 0;
+      const countB = countMap.get(b.id) || 0;
+      return countA - countB;
+    });
+
+    const selected = activeClusters[0];
+    const selectedCount = countMap.get(selected.id) || 0;
+    this.logger.log(`Least-apps selected cluster "${selected.name}" (${selectedCount} apps)`);
+    return selected;
+  }
+
   async delete(id: string): Promise<void> {
     const cluster = await this.findOne(id);
     await this.clustersRepository.remove(cluster);
   }
+
+  // ─── Cluster Pool Methods ─────────────────────────────────────────
+
+  async createPool(dto: CreateClusterPoolDto): Promise<ClusterPool> {
+    // Validate that all cluster IDs exist
+    if (dto.clusterIds.length === 0) {
+      throw new BadRequestException('Pool must contain at least one cluster');
+    }
+    const clusters = await this.clustersRepository.find({
+      where: { id: In(dto.clusterIds) },
+    });
+    if (clusters.length !== dto.clusterIds.length) {
+      const foundIds = clusters.map((c) => c.id);
+      const missingIds = dto.clusterIds.filter((id) => !foundIds.includes(id));
+      throw new BadRequestException(`Clusters not found: ${missingIds.join(', ')}`);
+    }
+
+    const pool = this.poolsRepository.create(dto);
+    const saved = await this.poolsRepository.save(pool);
+    this.logger.log(`Cluster pool "${saved.name}" created with ${dto.clusterIds.length} clusters (strategy: ${dto.strategy})`);
+    return saved;
+  }
+
+  async findAllPools(): Promise<ClusterPool[]> {
+    return this.poolsRepository.find({ order: { createdAt: 'DESC' } });
+  }
+
+  /**
+   * Public pool list — returns pools with resolved cluster names for UI.
+   */
+  async findAllPoolsPublic(): Promise<(ClusterPool & { clusters: Pick<Cluster, 'id' | 'name' | 'region' | 'provider' | 'status'>[] })[]> {
+    const pools = await this.poolsRepository.find({
+      where: { isActive: true },
+      order: { createdAt: 'DESC' },
+    });
+
+    const allClusterIds = [...new Set(pools.flatMap((p) => p.clusterIds))];
+    const clusters = allClusterIds.length > 0
+      ? await this.clustersRepository.find({
+          where: { id: In(allClusterIds) },
+          select: ['id', 'name', 'region', 'provider', 'status'],
+        })
+      : [];
+
+    const clusterMap = new Map(clusters.map((c) => [c.id, c]));
+
+    return pools.map((pool) => ({
+      ...pool,
+      clusters: pool.clusterIds
+        .map((id) => clusterMap.get(id))
+        .filter(Boolean) as Pick<Cluster, 'id' | 'name' | 'region' | 'provider' | 'status'>[],
+    }));
+  }
+
+  async findOnePool(id: string): Promise<ClusterPool> {
+    const pool = await this.poolsRepository.findOne({ where: { id } });
+    if (!pool) {
+      throw new NotFoundException('Cluster pool not found');
+    }
+    return pool;
+  }
+
+  async updatePool(id: string, dto: UpdateClusterPoolDto): Promise<ClusterPool> {
+    const pool = await this.findOnePool(id);
+
+    if (dto.clusterIds && dto.clusterIds.length > 0) {
+      const clusters = await this.clustersRepository.find({
+        where: { id: In(dto.clusterIds) },
+      });
+      if (clusters.length !== dto.clusterIds.length) {
+        const foundIds = clusters.map((c) => c.id);
+        const missingIds = dto.clusterIds.filter((cid) => !foundIds.includes(cid));
+        throw new BadRequestException(`Clusters not found: ${missingIds.join(', ')}`);
+      }
+    }
+
+    Object.assign(pool, dto);
+    return this.poolsRepository.save(pool);
+  }
+
+  async deletePool(id: string): Promise<void> {
+    const pool = await this.findOnePool(id);
+    await this.poolsRepository.remove(pool);
+    this.poolRoundRobinIndices.delete(id);
+  }
+
+  /**
+   * Get the optimal cluster from a specific pool using the pool's strategy.
+   * Only considers ACTIVE clusters within the pool.
+   */
+  async getOptimalClusterFromPool(poolId: string): Promise<Cluster> {
+    const pool = await this.findOnePool(poolId);
+    if (!pool.isActive) {
+      throw new BadRequestException(`Pool "${pool.name}" is not active`);
+    }
+
+    const activeClusters = await this.clustersRepository.find({
+      where: {
+        id: In(pool.clusterIds),
+        status: ClusterStatus.ACTIVE,
+      },
+    });
+
+    if (activeClusters.length === 0) {
+      throw new NotFoundException(`No active clusters in pool "${pool.name}"`);
+    }
+
+    if (activeClusters.length === 1) {
+      return activeClusters[0];
+    }
+
+    if (pool.strategy === 'round-robin') {
+      const idx = this.poolRoundRobinIndices.get(pool.id) || 0;
+      const cluster = activeClusters[idx % activeClusters.length];
+      this.poolRoundRobinIndices.set(pool.id, idx + 1);
+      this.logger.log(`Pool "${pool.name}" round-robin → cluster "${cluster.name}"`);
+      return cluster;
+    }
+
+    // least-apps strategy
+    const appCounts: { clusterId: string; count: string }[] = await this.dataSource.query(`
+      SELECT "clusterId", COUNT(*) as count
+      FROM applications
+      WHERE "clusterId" = ANY($1)
+      GROUP BY "clusterId"
+    `, [pool.clusterIds]);
+
+    const countMap = new Map<string, number>();
+    for (const row of appCounts) {
+      countMap.set(row.clusterId, parseInt(row.count, 10));
+    }
+
+    activeClusters.sort((a, b) => {
+      return (countMap.get(a.id) || 0) - (countMap.get(b.id) || 0);
+    });
+
+    const selected = activeClusters[0];
+    this.logger.log(`Pool "${pool.name}" least-apps → cluster "${selected.name}" (${countMap.get(selected.id) || 0} apps)`);
+    return selected;
+  }
 }

backend/src/clusters/dto/cluster-pool.dto.ts

@@ -0,0 +1,50 @@
+import { IsString, IsOptional, IsBoolean, IsArray, IsIn } from 'class-validator';
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+
+export class CreateClusterPoolDto {
+  @ApiProperty({ example: 'production-pool' })
+  @IsString()
+  name: string;
+
+  @ApiPropertyOptional({ example: 'Load-balanced pool for production workloads' })
+  @IsOptional()
+  @IsString()
+  description?: string;
+
+  @ApiProperty({ example: 'least-apps', enum: ['least-apps', 'round-robin'] })
+  @IsIn(['least-apps', 'round-robin'])
+  strategy: 'least-apps' | 'round-robin';
+
+  @ApiProperty({ example: ['uuid-1', 'uuid-2'], description: 'Array of cluster IDs in this pool' })
+  @IsArray()
+  @IsString({ each: true })
+  clusterIds: string[];
+}
+
+export class UpdateClusterPoolDto {
+  @ApiPropertyOptional({ example: 'production-pool-v2' })
+  @IsOptional()
+  @IsString()
+  name?: string;
+
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsString()
+  description?: string;
+
+  @ApiPropertyOptional({ enum: ['least-apps', 'round-robin'] })
+  @IsOptional()
+  @IsIn(['least-apps', 'round-robin'])
+  strategy?: 'least-apps' | 'round-robin';
+
+  @ApiPropertyOptional({ description: 'Array of cluster IDs in this pool' })
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  clusterIds?: string[];
+
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsBoolean()
+  isActive?: boolean;
+}

backend/src/clusters/entities/cluster-pool.entity.ts

@@ -0,0 +1,40 @@
+import {
+  Entity,
+  PrimaryGeneratedColumn,
+  Column,
+  CreateDateColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+
+export type PoolStrategy = 'least-apps' | 'round-robin';
+
+@Entity('cluster_pools')
+export class ClusterPool {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column()
+  name: string;
+
+  @Column({ nullable: true })
+  description: string;
+
+  @Column({ default: 'least-apps' })
+  strategy: PoolStrategy;
+
+  /**
+   * Array of cluster UUIDs that belong to this pool.
+   * Only active clusters from this list will be considered for load balancing.
+   */
+  @Column({ type: 'jsonb', default: [] })
+  clusterIds: string[];
+
+  @Column({ default: true })
+  isActive: boolean;
+
+  @CreateDateColumn()
+  createdAt: Date;
+
+  @UpdateDateColumn()
+  updatedAt: Date;
+}