Detailed architecture

How the platform is structured: management cluster, Cluster API, providers and system services.

Who is this page for?

If you are new to the Shturval platform, this section structures the composition and connections of the components.

General platform diagram

The Shturval platform is a container orchestration management environment. There are two types of clusters:

ComponentDescriptionRole
Management ClusterKubernetes cluster with platform componentsCreates and manages client clusters, collects logs and metrics, manages access
Client ClustersWorkload ClustersLaunch user applications (workloads)

The management cluster in the classic scenario is not intended to run application loads of users1. Management cluster tasks:

  1. Lifecycle management of client clusters.
  2. Collection of logs and metrics from client clusters.
  3. Access Control - single point of authentication and authorization.
  4. Connection with infrastructure through providers (oVirt, VMware vSphere, OpenStack, etc.).

1 Exception - Stand-alone mode: the management cluster is also used for workloads without separate client clusters. More details: Management cluster operating modes. Resource requirements: open loop, closed loop.

Important: If the management cluster fails, client clusters continue to work, but there is no access to them via kubeconfig. To restore access, restore the management cluster or switch to a backup management cluster. Recovery - in the Disaster Recovery section.

Interaction

Scheme of interaction when managing clusters

Operator (administrator) connects to the management cluster via Web UI or REST API. Management Cluster:

  • Manages client clusters - through the Kube API creates, updates and controls resources (Cluster, Machine, MachineHealthCheck);
  • Authenticates and Authorizes - integration with LDAP (AD, OpenLDAP, SambaDC, FreeIPA, MULTIDIRECTORY) and IdP (Keycloak, Blitz);
  • Sends events to SIEM - data about security events to monitoring and audit systems.

Client clusters are managed by the management cluster via the Kube API. Rights are synchronized centrally; metrics and logs are collected in the management cluster in the Victoria Metrics cluster and displayedenjoy on Grafana dashboards. Client clusters are isolated from direct Internet access if necessary.

Function blocks and services

Diagram of platform functional blocks

The core set of services is formed from the “Management Cluster Service” and critical services groups (“Shturval Repository Services”). Below are the functional blocks and corresponding services:

Function blockDescriptionServices
Control InterfaceGUI and API for working with clusters, services, nodes, repositoriesshturval-frontend, shturval-backend
Access ControlLDAP, OIDC 2.0, RBAC, session managershturval-auth
Cluster Configuration ManagementInfrastructure (providers, IP pools), reports on resources, image analysis, security policiesshturval-backend, shturval-cluster-manager
Configuration of clusters and nodesCreation and configuration of client clusters, nodes, system services; scaling, MachineHealthCheck, Taintsshturval-capi, shturval-cluster-manager, shturval-node-config
Network and ingress trafficCNI (Cilium), virtual IPs, Ingress, DNS cacheshturval-networking, shturval-ingress-controller, shturval-vip, shturval-vip-provider, shturval-caching-dns
MetricsCollection, storage and visualization of metricsshturval-monitoring, shturval-metrics-collector, shturval-dashboards, shturval-cert-expiration
LoggingCollection, aggregation and storage of logsshturval-log-collector, VLogs
Storage and SnapshotsLocal CSI storage, snapshots of critical datashturval-local-csi, shturval-snapshotter
BackupBackups of clusters and namespaces (Velero), basis for DRshturval-backup
Orchestration of servicesInstalling and updating platform servicesshturval-services, shturval-update
Certifications and TrustTLS certificates, root CAshturval-cert-manager, shturval-trust-manager

More details: Cluster services, Access module architecture.

Modular platform on operators

The platform is built on Kubernetes operators and controllers. Management of functions (clusters, nodes, services, access, monitoring) is performed through custom resources (*.shturval.tech) and corresponding operators.

Some of the charts are our own development (shturval-cluster-manager, shturval-backend, shturval-frontend, shturval-auth, shturval-capov, shturval-node-config, shturval-services, shturval-update). The rest are collected from open-source with modifications for integration with the platform. More details: Safe assembly of platform components.

All system services and the Kubernetes version are updated every platform release. More details: Update Kubernetes in the Shturval platform.

Accommodation options

OptionDescriptionWhen to use
On-premiseManagement cluster on its own infrastructure (VMware vSphere, zVirt, oVirt, HostVM, RED Virtualization, ROSA Virtualization, bare metal)Full control, data inside the perimeter
CloudManagement cluster in public cloud (Yandex Cloud, VK Cloud, Selectel)Deploy quickly, scale on demand
HybridManagement cluster in one environment, client ones in others (including bare metal via Shturval v2)Separation of control and workload infrastructure

System requirements for installation depend on the deployment type: open loop, closed loop.

Management cluster operating modes

ModeDescription
NormalThe management cluster manages client clusters; workloads - in client clusters
Stand-aloneThe management cluster is also used for workloads (without separate client clusters)
DRRedundant management cluster for fault tolerance. More details: DR-config

Supported infrastructure providers

Client clusters can be created based on:

  • Shturval v2 - bare metal (physical hosts via SSH)
  • oVirt, zVirt, HostVM, ED Virtualization, ROSA Virtualization
  • VMware vSphere
  • OpenStack, VK Cloud, Selectel
  • Basis Dynamix
  • VMware vCloud Director
  • Yandex Cloud

For more details, see Infrastructure providers.

← Glossary
Types of license →