Functionality

What the platform can do: cluster management, security, monitoring, and automation.

Cluster and infrastructure management #

• Single point of management. Shturval manages multiple workload clusters (called client clusters in platform terminology) from the management cluster: it creates clusters, controls Cluster API resources, and connects to infrastructure through providers.
• Deploy clusters across environments. You can create clusters on bare metal via Shturval v2, in oVirt and oVirt-like environments (zVirt, HostVM, RED Virtualization, ROSA Virtualization), VMware vSphere, OpenStack, VK Cloud, and Selectel, Basis Dynamix, VMware vCloud Director, and Yandex Cloud, as well as hybrid configurations where physical hosts are added to a cluster through an additional node group.
• On-premises, cloud, and hybrid. The management cluster can run on your own infrastructure, in a public cloud, or in a hybrid setup where client clusters run in other environments.
• Open and closed loops. The platform supports installation and operation in an open loop and without Internet access.
• Built-in installation and mirror utilities. The platform includes its own installer, plus utilities for preparing the mirror and working with the mirror after installation.
• Multiple installation methods. Install the platform through a browser-based installation wizard, command-line flags, or a YAML manifest with installation parameters.
• Flexible licensing. Community Edition (the free version) is limited to 10 worker nodes for the entire platform. Enterprise can be licensed by vCPU, worker nodes, physical hosts, or an unlimited scheme by agreement.
• Node and node group management. The platform provides worker node groups, taints and tolerations, vertical and horizontal scaling, autoscaling, NodeConfig, and MachineHealthCheck to recover failed nodes.
• Visual lifecycle. The dashboard shows deployment status, conditions, Kubernetes version, node groups, services, events, logs, certificates, metering, and service availability.
• Safe, straightforward updates. Each cluster is updated independently when it suits your business. Updates can be scheduled or started manually, and update stages are shown in the GUI.
• Built-in Swagger UI. The platform GUI includes Swagger UI with interactive OpenAPI documentation for the Shturval Backend API: paths, methods, parameters, example requests, and response schemas match the current swagger.json. The platform API is also fully compatible with the vanilla Kubernetes API.

For business, this means fewer disparate tools, clearer cluster ownership, and easier infrastructure scaling without changing the management model.

Security and compliance #

• Container image scanning. A Trivy-based module checks images for vulnerabilities, generates severity reports, and supports sources such as the native Trivy database, FSTEC BDU, domestic OS BDU, and NVD.
• Configuration and compliance checks. The interface provides reports on CIS Kubernetes Benchmark, NSA Kubernetes recommendations, and Pod Security Standards, as well as Kyverno policy analysis results.
• Security policies. With Kyverno, you can manage ClusterPolicy and Policy resources and control typical risks such as privileged containers, missing requests or limits, use of the default namespace, NodePort, and other practices.
• Audit and event export. A local log collection module collects pod stdout, journald, audit.log, and Kubernetes events, stores them in VLogs, and can forward audit data to external systems: Elasticsearch, syslog, or SIEM.
• Closed loop for Enterprise. Enterprise and Enterprise ML support installation and updates in a closed loop.
• Compatibility with overlay security tools. The platform is compatible with Kaspersky Endpoint Security for Linux (KESL), Kaspersky Container Security (KCS), Positive Technologies Container Security (PT CS), and Luntry.

As a result, security teams get reports, policies, auditing, and event export into existing security monitoring workflows.

Observability: monitoring and logs #

• Metrics and dashboards. The platform collects, stores, and visualizes metrics through monitoring modules. From cluster and platform dashboards, you can open Grafana with many prebuilt dashboards.
• Alerts. The alerting section shows alerts based on metrics and logs. You can configure delivery via email, Telegram, or webhook.
• Logs in the GUI. Cluster logs appear on the Logs tab directly in the platform GUI.
• Events and services on the dashboard. The dashboard shows Kubernetes object events, service status, certificate validity, and availability of key system components.

This reduces time spent finding failure causes: administrators see cluster status, metrics, events, logs, and alerts in related sections of the interface.

Backup and restore #

• Backups of Kubernetes resources and PersistentVolumes. The Velero-based shturval-backup module creates backups of Kubernetes resources and PersistentVolumes.
• Recovery and migration. The module supports recovery after failures, full cluster or individual resource recovery, and migration between clusters.
• Scheduled backups. Use CronSchedule for regular backups.
• S3-compatible storage. Backups are stored in S3-compatible storage, which can be cloud-based or on-premises.

From a business perspective, this reduces data loss risk and downtime during disasters.

Access control and multi-tenancy #

• RBAC at multiple levels. Permissions are assigned at the platform, tenant, cluster, and namespace levels, then synchronized to the management cluster and client clusters.
• Enterprise authentication. Authentication is handled by the Shturval Auth (shturval-auth) module; configure LDAP and OIDC in LDAP and OIDC and External authentication providers.
• Unified model for services. Authorization applies not only to interface operations but also to access to Grafana, Kubeflow profiles, and Argo CD projects.
• Tenants. A tenant groups clusters and namespaces for unified access control; permissions assigned to a tenant apply to all nested objects.
• Session Manager. You can manage user sessions in the platform and in Grafana, Kubeflow, and Argo CD.
• Console access. The kubectl-shturval-plugin authenticates to the platform, loads kubeconfig for one or all clusters available to the user, and lets you work with them through kubectl. Download plugin configuration from the GUI, generate it from the console, or pass parameters directly to the kubectl shturval login command.

This simplifies access management in large organizations and reduces the risk of leftover permissions after projects end.

Application delivery and GitOps #

• Argo CD as part of the platform. The shturval-cd module provides GitOps delivery of custom applications from Git and synchronizes the actual cluster state with the desired state in the repository.
• SSO to Argo CD. Open Argo CD from the client cluster dashboard or from a namespace; platform user credentials are used for authorization.
• Projects from the namespace interface. Create Argo CD projects from the cluster namespace GUI.
• Open Kubeflow from a namespace. In Enterprise ML, the namespace dashboard for a namespace created through a Kubeflow profile includes a Kubeflow button to open the Kubeflow interface.
• Repositories and rollout workflows. Connect private registries, use the built-in Argo CD role model, and deploy Argo Rollouts.

Customers get a more predictable release process: the desired application state lives in the repository, and the platform provides single sign-on to GitOps tools.

Modules and operators out of the box #

• Operator architecture. The platform is built on Kubernetes operators and controllers: clusters, nodes, services, access, and monitoring are managed through custom resources.
• Shturval repository. By default, the Helm charts platform services repository is connected: monitoring, logging, backup, security, networking, storage, certificates, application delivery, and service updates.
• Core infrastructure modules. The platform includes networking based on Cilium, Ingress, virtual IP addresses, CoreDNS/NodeLocalDNS, local storage, OpenStack CSI (Cinder), Yandex Cloud CSI, and snapshots.
• Extensible workload scenarios. Argo CD and Argo Rollouts support application delivery. Enterprise ML provides Kubeflow and MLflow for ML pipelines.
• GPU workloads. For GPU clusters, the platform supports automatic NVIDIA runtime configuration on nodes and NVIDIA GPU Operator to prepare Kubernetes for GPU workloads.

Business benefits #

• Lower operating costs. Cluster, node, service, access, log, and metric management are consolidated in one platform.
• Faster infrastructure for teams. Administrators create client clusters on supported providers, connect services, and grant access using a single model.
• Controlled security. Image scanning, compliance reports, Kyverno policies, auditing, and SIEM export help keep risks visible.
• Operational transparency. Dashboards, alerts, events, logs, metering, and reports show cluster status and support fact-based decisions.