Skip to content

Commit f2827ab

Browse files
committed
Update to reflect the new config structure, and behavior
Signed-off-by: Ryan Swanson <ryan.swanson@loft.sh>
1 parent 03b353f commit f2827ab

20 files changed

Lines changed: 906 additions & 12795 deletions

File tree

configsrc/vcluster/main/default_values.yaml

Lines changed: 72 additions & 72 deletions
Large diffs are not rendered by default.

configsrc/vcluster/main/vcluster.schema.json

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1246,7 +1246,7 @@
12461246
"properties": {
12471247
"afterInactivity": {
12481248
"type": "string",
1249-
"description": "AfterInactivity specifies after how long of inactivity the tenant cluster will be deleted.\nUses Go duration format (e.g., \"720h\" for 30 days).\n+optional"
1249+
"description": "AfterInactivity specifies after how long of inactivity the virtual cluster will be deleted.\nUses Go duration format (e.g., \"720h\" for 30 days).\n+optional"
12501250
}
12511251
},
12521252
"additionalProperties": false,
@@ -2532,7 +2532,7 @@
25322532
},
25332533
"mappings": {
25342534
"$ref": "#/$defs/FromHostMappings",
2535-
"description": "Mappings define Host Gateway namespace/name to tenant-facing namespace/name placement."
2535+
"description": "Mappings define control plane Gateway namespace/name to tenant-facing namespace/name placement."
25362536
},
25372537
"allowedRoutes": {
25382538
"$ref": "#/$defs/GatewayAllowedRoutesConfig",
@@ -2548,7 +2548,7 @@
25482548
},
25492549
"sanitize": {
25502550
"$ref": "#/$defs/GatewayImportSanitize",
2551-
"description": "Sanitize configures sensitive host field sanitization."
2551+
"description": "Sanitize configures sensitive control plane field sanitization."
25522552
}
25532553
},
25542554
"additionalProperties": false,
@@ -2561,7 +2561,7 @@
25612561
"type": "string"
25622562
},
25632563
"type": "object",
2564-
"description": "ByName is a map of host-object-namespace/host-object-name: virtual-object-namespace/virtual-object-name.\nThere are several wildcards supported:\n1. To match all objects in host namespace and sync them to different namespace in vCluster:\nbyName:\n \"foo/*\": \"foo-in-virtual/*\"\n2. To match specific object in the host namespace and sync it to the same namespace with the same name:\nbyName:\n \"foo/my-object\": \"foo/my-object\"\n3. To match specific object in the host namespace and sync it to the same namespace with different name:\nbyName:\n \"foo/my-object\": \"foo/my-virtual-object\"\n4. To match all objects in the vCluster host namespace and sync them to a different namespace in vCluster:\nbyName:\n \"\": \"my-virtual-namespace/*\"\n5. To match specific objects in the vCluster host namespace and sync them to a different namespace in vCluster:\nbyName:\n \"/my-object\": \"my-virtual-namespace/my-object\""
2564+
"description": "ByName is a map of control-plane-object-namespace/control-plane-object-name: tenant-object-namespace/tenant-object-name.\nThere are several wildcards supported:\n1. To match all objects in a control plane namespace and sync them to a different namespace in the tenant cluster:\nbyName:\n \"foo/*\": \"foo-in-virtual/*\"\n2. To match a specific object in the control plane namespace and sync it to the same namespace with the same name:\nbyName:\n \"foo/my-object\": \"foo/my-object\"\n3. To match a specific object in the control plane namespace and sync it to the same namespace with a different name:\nbyName:\n \"foo/my-object\": \"foo/my-virtual-object\"\n4. To match all objects in the vCluster namespace and sync them to a different namespace in the tenant cluster:\nbyName:\n \"\": \"my-virtual-namespace/*\"\n5. To match specific objects in the vCluster namespace and sync them to a different namespace in the tenant cluster:\nbyName:\n \"/my-object\": \"my-virtual-namespace/my-object\""
25652565
}
25662566
},
25672567
"additionalProperties": false,
@@ -2582,23 +2582,23 @@
25822582
},
25832583
"httpRoutes": {
25842584
"$ref": "#/$defs/EnableSwitchWithPatches",
2585-
"description": "HTTPRoutes configures HTTPRoute sync to the host cluster."
2585+
"description": "HTTPRoutes configures HTTPRoute sync to the control plane cluster."
25862586
},
25872587
"gateways": {
25882588
"$ref": "#/$defs/EnableSwitchWithPatches",
2589-
"description": "Gateways configures tenant-created Gateway sync to the host cluster."
2589+
"description": "Gateways configures tenant-created Gateway sync to the control plane cluster."
25902590
},
25912591
"tlsRoutes": {
25922592
"$ref": "#/$defs/EnableSwitchWithPatches",
2593-
"description": "TLSRoutes configures TLSRoute sync to the host cluster."
2593+
"description": "TLSRoutes configures TLSRoute sync to the control plane cluster."
25942594
},
25952595
"backendTLSPolicies": {
25962596
"$ref": "#/$defs/EnableSwitchWithPatches",
2597-
"description": "BackendTLSPolicies configures BackendTLSPolicy sync to the host cluster."
2597+
"description": "BackendTLSPolicies configures BackendTLSPolicy sync to the control plane cluster."
25982598
},
25992599
"referenceGrants": {
26002600
"$ref": "#/$defs/EnableAutoSwitchWithPatches",
2601-
"description": "ReferenceGrants configures ReferenceGrant sync to the host cluster. Enabled may be \"auto\", \"true\", or \"false\"."
2601+
"description": "ReferenceGrants configures ReferenceGrant sync to the control plane cluster. Enabled may be \"auto\", \"true\", or \"false\"."
26022602
}
26032603
},
26042604
"additionalProperties": false,
@@ -4609,7 +4609,7 @@
46094609
},
46104610
"additionalProperties": false,
46114611
"type": "object",
4612-
"description": "Sleep holds configuration for automatically putting the tenant cluster to sleep."
4612+
"description": "Sleep holds configuration for automatically putting the virtual cluster to sleep."
46134613
},
46144614
"SleepAuto": {
46154615
"properties": {
@@ -4824,7 +4824,7 @@
48244824
"properties": {
48254825
"schedule": {
48264826
"type": "string",
4827-
"description": "Schedule specifies a scheduled time in Cron format, see https://en.wikipedia.org/wiki/Cron for a tenant cluster snapshot to be taken\n+optional"
4827+
"description": "Schedule specifies a scheduled time in Cron format, see https://en.wikipedia.org/wiki/Cron for a virtual cluster snapshot to be taken\n+optional"
48284828
},
48294829
"timezone": {
48304830
"type": "string",
@@ -5075,11 +5075,11 @@
50755075
},
50765076
"gatewayClasses": {
50775077
"$ref": "#/$defs/EnableSwitchWithPatchesAndSelector",
5078-
"description": "GatewayClasses defines if gateway classes should get synced from the host cluster to the virtual cluster, but not back."
5078+
"description": "GatewayClasses defines if gateway classes should get synced from the control plane cluster to the tenant cluster, but not back."
50795079
},
50805080
"gateways": {
50815081
"$ref": "#/$defs/FromHostGateways",
5082-
"description": "Gateways defines if selected host Gateways should get synced from the host cluster to the virtual cluster, but not back."
5082+
"description": "Gateways defines if selected control plane Gateways should get synced from the control plane cluster to the tenant cluster, but not back."
50835083
},
50845084
"runtimeClasses": {
50855085
"$ref": "#/$defs/EnableSwitchWithPatchesAndSelector",
@@ -5306,7 +5306,7 @@
53065306
},
53075307
"gatewayApi": {
53085308
"$ref": "#/$defs/GatewayAPIEnableSwitchWithPatches",
5309-
"description": "GatewayAPI defines Gateway API resources created within the virtual cluster that should get synced to the host cluster."
5309+
"description": "GatewayAPI defines Gateway API resources created within the tenant cluster that should get synced to the control plane cluster."
53105310
},
53115311
"services": {
53125312
"$ref": "#/$defs/EnableSwitchWithPatches",

package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
"scripts": {
66
"docusaurus": "docusaurus",
77
"start": "docusaurus start",
8+
"start-no-open": "docusaurus start --no-open",
89
"prebuild": "npm run validate-glossary",
910
"build": "docusaurus build",
1011
"postbuild": "node scripts/fix-llms-doubled-docs-path.js",

platform/reference/platform-annotations.mdx

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -291,18 +291,6 @@ When `true`, the platform will not deploy or manage kiosk on this cluster.
291291

292292
Base64-encoded certificate authority data for verifying the regional cluster endpoint certificate.
293293

294-
### sleepmode.loft.sh/request-mirror-controller-allowlist {#sleepmode-loft-sh-request-mirror-controller-allowlist}
295-
296-
**Type:** Annotation
297-
298-
**Example:** `sleepmode.loft.sh/request-mirror-controller-allowlist: "gateway.networking.k8s.io/istio,gateway.networking.k8s.io/traefik"`
299-
300-
**Used on:** Cluster
301-
302-
**Set by:** User-configurable
303-
304-
Comma-separated list of GatewayClass.spec.controllerName values to treat as request-mirror-supporting for HTTPRoutes in tenant clusters on this connected cluster, even when the GatewayClass status does not advertise the HTTPRouteRequestMirror feature.
305-
306294
## Project management {#project-management}
307295

308296
These labels and annotations are used on project resources and project-owned namespaces.
@@ -1023,6 +1011,32 @@ Disables automatic wakeup from ingress traffic. When set, the namespace or vClus
10231011

10241012
Disables metrics-based activity tracking. Only API server activity is tracked.
10251013

1014+
### sleepmode.loft.sh/request-mirror-controller-allowlist {#sleepmode-loft-sh-request-mirror-controller-allowlist}
1015+
1016+
**Type:** Annotation
1017+
1018+
**Example:** `sleepmode.loft.sh/request-mirror-controller-allowlist: "gateway.networking.k8s.io/istio,gateway.networking.k8s.io/traefik"`
1019+
1020+
**Used on:** Cluster
1021+
1022+
**Set by:** User-configurable
1023+
1024+
Comma-separated list of GatewayClass.spec.controllerName values to treat as request-mirror-supporting for HTTPRoutes in tenant clusters on this connected cluster, even when the GatewayClass status does not advertise the HTTPRouteRequestMirror feature.
1025+
1026+
:::note Officially supported GatewayClasses
1027+
Beyond any GatewayClass that advertises the `HTTPRouteRequestMirror` filter feature in its status, the platform officially supports sleep mode activity detection for the following GatewayClass implementations. These are treated as request-mirror-supporting by default, without requiring an entry in the allowlist:
1028+
1029+
| Implementation | Controller name |
1030+
|----------------|-----------------|
1031+
| Envoy Gateway | `gateway.envoyproxy.io/gatewayclass-controller` |
1032+
| kgateway | `kgateway.dev/kgateway` |
1033+
| agentgateway | `agentgateway.dev/agentgateway` |
1034+
| NGINX Gateway Fabric | `gateway.nginx.org/nginx-gateway-controller` |
1035+
| Cilium | `io.cilium/gateway-controller` |
1036+
1037+
Use the allowlist only for GatewayClasses not in this list and that do not advertise the feature.
1038+
:::
1039+
10261040
## Auto sleep status annotations {#sleep-mode-status-annotations}
10271041

10281042
These annotations are set by the platform to indicate auto sleep status. They are read-only.

vcluster/_partials/config/controlPlane.mdx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ Endpoint is the endpoint of the virtual cluster. This is used to connect to the
3131

3232
### `distro` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">object</span> <span className="config-field-default"></span> <span className="config-field-enum"></span> {#controlPlane-distro}
3333

34-
Distro holds virtual cluster related distro options. A distro cannot be changed after vCluster is deployed, with one exception: starting with vCluster 0.25.0, migration from K3s to K8s is supported. For more details, see the [K3s to K8s migration guide](/docs/vcluster/manage/upgrade/distro-migration).
34+
Distro holds virtual cluster related distro options. A distro cannot be changed after vCluster is deployed.
3535

3636
</summary>
3737

@@ -306,7 +306,7 @@ Repository is the repository of the container image, e.g. my-repo/my-image
306306
<details className="config-field" data-expandable="false" open>
307307
<summary>
308308

309-
##### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">v1.35.0</span> <span className="config-field-enum"></span> {#controlPlane-distro-k8s-image-tag}
309+
##### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">v1.36.0</span> <span className="config-field-enum"></span> {#controlPlane-distro-k8s-image-tag}
310310

311311
Tag is the tag of the container image, and is the default version.
312312

@@ -1380,7 +1380,7 @@ Repository is the repository of the container image, e.g. my-repo/my-image
13801380
<details className="config-field" data-expandable="false" open>
13811381
<summary>
13821382

1383-
##### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">3.6.4-0</span> <span className="config-field-enum"></span> {#controlPlane-backingStore-etcd-deploy-statefulSet-image-tag}
1383+
##### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">3.6.8-0</span> <span className="config-field-enum"></span> {#controlPlane-backingStore-etcd-deploy-statefulSet-image-tag}
13841384

13851385
Tag is the tag of the container image, and is the default version.
13861386

vcluster/_partials/config/controlPlane/backingStore.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,7 @@ Repository is the repository of the container image, e.g. my-repo/my-image
213213
<details className="config-field" data-expandable="false" open>
214214
<summary>
215215

216-
##### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">3.6.4-0</span> <span className="config-field-enum"></span> {#backingStore-etcd-deploy-statefulSet-image-tag}
216+
##### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">3.6.8-0</span> <span className="config-field-enum"></span> {#backingStore-etcd-deploy-statefulSet-image-tag}
217217

218218
Tag is the tag of the container image, and is the default version.
219219

vcluster/_partials/config/controlPlane/backingStore/etcd/deploy.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ Repository is the repository of the container image, e.g. my-repo/my-image
114114
<details className="config-field" data-expandable="false" open>
115115
<summary>
116116

117-
##### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">3.6.4-0</span> <span className="config-field-enum"></span> {#deploy-statefulSet-image-tag}
117+
##### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">3.6.8-0</span> <span className="config-field-enum"></span> {#deploy-statefulSet-image-tag}
118118

119119
Tag is the tag of the container image, and is the default version.
120120

vcluster/_partials/config/controlPlane/distro.mdx

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
## `distro` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">object</span> <span className="config-field-default"></span> <span className="config-field-enum"></span> {#distro}
66

7-
Distro holds virtual cluster related distro options. A distro cannot be changed after vCluster is deployed, with one exception: starting with vCluster 0.25.0, migration from K3s to K8s is supported. For more details, see the [K3s to K8s migration guide](/docs/vcluster/manage/upgrade/distro-migration).
7+
Distro holds virtual cluster related distro options. A distro cannot be changed after vCluster is deployed.
88

99
</summary>
1010

@@ -279,7 +279,7 @@ Repository is the repository of the container image, e.g. my-repo/my-image
279279
<details className="config-field" data-expandable="false" open>
280280
<summary>
281281

282-
##### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">v1.35.0</span> <span className="config-field-enum"></span> {#distro-k8s-image-tag}
282+
##### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">v1.36.0</span> <span className="config-field-enum"></span> {#distro-k8s-image-tag}
283283

284284
Tag is the tag of the container image, and is the default version.
285285

@@ -357,3 +357,8 @@ Security options can be used for the distro init container
357357

358358

359359
</details>
360+
361+
362+
:::tip K3s to K8s migration
363+
Starting with vCluster 0.25.0, migration from K3s to K8s is supported. For more details, see the [K3s to K8s migration guide](/docs/vcluster/manage/upgrade/distro-migration).
364+
:::

vcluster/_partials/config/controlPlane/distro/k8s.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,7 @@ Repository is the repository of the container image, e.g. my-repo/my-image
267267
<details className="config-field" data-expandable="false" open>
268268
<summary>
269269

270-
#### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">v1.35.0</span> <span className="config-field-enum"></span> {#k8s-image-tag}
270+
#### `tag` <span className="config-field-required" data-required="false">required</span> <span className="config-field-type">string</span> <span className="config-field-default">v1.36.0</span> <span className="config-field-enum"></span> {#k8s-image-tag}
271271

272272
Tag is the tag of the container image, and is the default version.
273273

vcluster/_partials/config/controlPlane/standalone/joinNode.mdx

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,16 @@
11

2+
:::warning Security consideration
3+
When `joinNode.enabled` is `true`, the control-plane node also runs kubelet as a worker.
4+
Tenant workloads scheduled onto this node share the machine with the vCluster control-plane
5+
process and its platform credentials. A tenant with sufficient privileges (such as `hostPID`,
6+
hostPath volumes, or `nodes/proxy` access) can read the platform access key from the process
7+
environment.
8+
9+
For production deployments, keep the control-plane node dedicated by setting
10+
`joinNode.enabled: false` and use separate worker nodes for tenant workloads.
11+
:::
12+
13+
214
<details className="config-field" data-expandable="true">
315
<summary>
416

@@ -20,16 +32,7 @@ Enabled defines if the standalone node should be joined into the cluster. If fal
2032

2133
</summary>
2234

23-
:::warning Security consideration
24-
When `joinNode.enabled` is `true`, the control-plane node also runs kubelet as a worker.
25-
Tenant workloads scheduled onto this node share the machine with the vCluster control-plane
26-
process and its platform credentials. A tenant with sufficient privileges (such as `hostPID`,
27-
hostPath volumes, or `nodes/proxy` access) can read the platform access key from the process
28-
environment.
2935

30-
For production deployments, keep the control-plane node dedicated by setting
31-
`joinNode.enabled: false` and use separate worker nodes for tenant workloads.
32-
:::
3336

3437
</details>
3538

0 commit comments

Comments
 (0)