Skip to content

Update dataplane cr definition to support cluster agent access#141

Merged
VajiraPrabuddhaka merged 1 commit into
openchoreo:mainfrom
yashodgayashan:dataplane
Nov 29, 2025
Merged

Update dataplane cr definition to support cluster agent access#141
VajiraPrabuddhaka merged 1 commit into
openchoreo:mainfrom
yashodgayashan:dataplane

Conversation

@yashodgayashan

Copy link
Copy Markdown
Contributor

Purpose

This pull request updates the DataPlane API documentation to clarify communication modes, deprecate direct Kubernetes API access, and improve configuration examples. The changes emphasize agent-based communication as the recommended approach and introduce new configuration fields for secrets and external integrations. Deprecated fields and modes are clearly marked, and examples have been expanded for better guidance.

Communication Modes and Deprecation Notices

  • Added detailed explanation of agent-based (recommended) and direct Kubernetes API access (deprecated) communication modes in the DataPlane overview, including a prominent deprecation warning for direct API access.

Spec Field Updates and New Configurations

  • Updated the DataPlane spec fields: removed the registry field, added agent, imagePullSecretRefs, and secretStoreRef fields, and marked kubernetesCluster as deprecated and optional when agent-based communication is enabled. Provided new configuration sections for agent-based communication and secret management.

Examples and Usage Patterns

  • Replaced and expanded examples to show agent-based DataPlane configuration, deprecated direct Kubernetes API access (with both mTLS and bearer token authentication), and integration with External Secrets Operator for secret management and image pull credentials. [1] [2]

Related Issues

Include any related issues that are resolved by this PR.

Checklist

  • Updated sidebars.ts if adding a new documentation page
  • Run npm run start to preview the changes locally
  • Run npm run build to ensure the build passes without errors
  • Verified all links are working (no broken links)


OpenChoreo supports two modes of communication with the DataPlane:
- **Agent-based** (Recommended): The control plane communicates with the downstream cluster through a WebSocket agent running in the DataPlane cluster
- **Direct Kubernetes API access** (Deprecated): The control plane connects directly to the Kubernetes API server using client certificates or bearer tokens. This mode is deprecated and will be removed in a future release.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are we deprecating this? What I was thinking is to keep this and supporting the new cluster-agent based method as the default one, in that way I think we have more flexibility. For example if there is someone who already using Tailscale like VPN to access dataplane, we still can support it through this this method. WDYT?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO we can go ahead with cluster gateway and remove the direct access. Even with the VPN this can be achieved


OpenChoreo supports two modes of communication with the DataPlane:
- **Agent-based** (Recommended): The control plane communicates with the downstream cluster through a WebSocket agent running in the DataPlane cluster
- **Direct Kubernetes API access** (Deprecated): The control plane connects directly to the Kubernetes API server using client certificates or bearer tokens. This mode is deprecated and will be removed in a future release.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we remove this? This will still make sense for single-cluster setups.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We will go ahead with cluster gateway architecture going forward and not with the direct access

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For local setups, wouldn’t it be better to keep this?
Ex: quick-start?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Its better to have a one correct way to do a specific task. I can agree to remove deprecation flag for now. WDYT?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shall we do that? we can discuss and decide this later.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed deprecation notice

@VajiraPrabuddhaka VajiraPrabuddhaka merged commit 5b1a1f1 into openchoreo:main Nov 29, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants