Documentation Index Fetch the complete documentation index at: https://mintlify.com/loft-sh/vcluster/llms.txt
Use this file to discover all available pages before exploring further.
RBAC (Role-Based Access Control) configuration controls permissions, policies, and security settings for both the vCluster control plane and workloads running within the virtual cluster.
RBAC Rules Virtual cluster Role configuration for the host cluster namespace. Enable or disable the Role.
Completely overwrite the default Role rules. overwriteRules : - apiGroups : [ "" ] resources : [ "pods" ] verbs : [ "get" , "list" , "watch" ]
Add additional rules to the Role. extraRules : - apiGroups : [ "apps" ] resources : [ "deployments" ] verbs : [ "get" , "list" , "create" , "update" , "delete" ]
Virtual cluster ClusterRole configuration. Enable or disable the ClusterRole. auto automatically determines if required.
Completely overwrite the default ClusterRole rules.
Add additional rules to the ClusterRole. extraRules : - apiGroups : [ "" ] resources : [ "nodes" ] verbs : [ "get" , "list" , "watch" ]
rbac.enableVolumeSnapshotRules
Enable RBAC rules for volume snapshots. Enable volume snapshot RBAC rules. auto enables when volume snapshot syncing is configured.
Service Accounts controlPlane.advanced.serviceAccount
vCluster control plane service account. Deploy the service account.
Custom name for the service account.
Image pull secrets for the service account. imagePullSecrets : - name : my-registry-secret
Service account annotations. annotations : eks.amazonaws.com/role-arn : arn:aws:iam::123456789012:role/vcluster-role
controlPlane.advanced.workloadServiceAccount
Service account for workloads running in the virtual cluster. Deploy the workload service account.
Custom name for the workload service account.
Image pull secrets for workloads.
Workload service account annotations.
Resource Quotas Resource quota for the virtual cluster. Enable resource quota. auto enables if limitRange is enabled.
Resource quota values. quota : requests.cpu : 10 requests.memory : 20Gi requests.storage : 100Gi requests.ephemeral-storage : 60Gi limits.cpu : 20 limits.memory : 40Gi limits.ephemeral-storage : 160Gi services.nodeports : 0 services.loadbalancers : 1 count/endpoints : 40 count/pods : 20 count/services : 20 count/secrets : 100 count/configmaps : 100 count/persistentvolumeclaims : 20
Scope selector for resource quota.
Resource quota annotations.
Limit Range LimitRange for the virtual cluster. Enable limit range. auto enables if resourceQuota is enabled.
Default resource limits. default : cpu : "1" memory : 512Mi ephemeral-storage : 8Gi
Default resource requests. defaultRequest : cpu : 100m memory : 128Mi ephemeral-storage : 3Gi
Network Policies NetworkPolicy configuration for isolating virtual cluster traffic. Enable NetworkPolicy deployment.
Fallback DNS server if virtual cluster doesn’t have one.
Network policies for the control plane. Ingress rules for control plane. ingress : - from : - podSelector : matchLabels : app : allowed-client ports : - protocol : TCP port : 8443
Egress rules for control plane.
Network policies for workloads. Public outgoing connections for workloads. Enable workload public egress.
cidr
string
default: "0.0.0.0/0"
Allowed destination CIDR.
Excluded CIDRs. Default: except : - 100.64.0.0/10 - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16
Ingress rules for workloads.
Egress rules for workloads.
NetworkPolicy annotations.
Central Admission policies.centralAdmission
Define validating or mutating webhooks to enforce within the virtual cluster (PRO feature). Validating webhooks to enforce.
Mutating webhooks to enforce.
Security Context controlPlane.statefulSet.security
Security context for the control plane. Pod-level security context. podSecurityContext : runAsNonRoot : true fsGroup : 1000
Container-level security context. Default: containerSecurityContext : allowPrivilegeEscalation : false runAsUser : 0 runAsGroup : 0
Example: Custom RBAC Rules rbac : role : enabled : true extraRules : - apiGroups : [ "" ] resources : [ "configmaps" ] verbs : [ "get" , "list" , "watch" , "create" , "update" ] clusterRole : enabled : true extraRules : - apiGroups : [ "" ] resources : [ "nodes" , "persistentvolumes" ] verbs : [ "get" , "list" , "watch" ]
Example: Resource Quotas and Limits policies : resourceQuota : enabled : true quota : requests.cpu : 20 requests.memory : 40Gi limits.cpu : 40 limits.memory : 80Gi count/pods : 50 count/services : 30 limitRange : enabled : true default : cpu : "2" memory : 1Gi defaultRequest : cpu : 200m memory : 256Mi max : cpu : "4" memory : 8Gi min : cpu : 50m memory : 64Mi
Example: Network Isolation policies : networkPolicy : enabled : true fallbackDns : 1.1.1.1 controlPlane : # Only allow access from specific pods ingress : - from : - podSelector : matchLabels : access : vcluster ports : - protocol : TCP port : 8443 workload : # Restrict public egress publicEgress : enabled : true cidr : 0.0.0.0/0 except : - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 # Custom ingress rules ingress : - from : - namespaceSelector : matchLabels : name : allowed-namespace
Example: Service Account with AWS IAM controlPlane : advanced : serviceAccount : enabled : true name : vcluster-sa annotations : eks.amazonaws.com/role-arn : arn:aws:iam::123456789012:role/vcluster-role workloadServiceAccount : enabled : true name : vcluster-workload-sa annotations : eks.amazonaws.com/role-arn : arn:aws:iam::123456789012:role/workload-role imagePullSecrets : - name : ecr-registry-secret
Example: Pod Security Standards controlPlane : statefulSet : security : podSecurityContext : runAsNonRoot : true runAsUser : 10000 runAsGroup : 10000 fsGroup : 10000 seccompProfile : type : RuntimeDefault containerSecurityContext : allowPrivilegeEscalation : false readOnlyRootFilesystem : true runAsNonRoot : true capabilities : drop : - ALL
Use Cases Multi-Tenant Resource Isolation Enforce resource limits per virtual cluster:
policies : resourceQuota : enabled : true quota : requests.cpu : 10 requests.memory : 20Gi count/pods : 30 limitRange : enabled : true
Strict Network Isolation Isolate virtual cluster traffic:
policies : networkPolicy : enabled : true workload : publicEgress : enabled : false
Cluster-Wide Resource Access Grant ClusterRole permissions:
rbac : clusterRole : enabled : true extraRules : - apiGroups : [ "" ] resources : [ "nodes" , "namespaces" ] verbs : [ "get" , "list" , "watch" ]
