ComputePlane Service Reference
A managed, isolated environment for running code-executing (untrusted-code) catalog applications — notebooks, workflow “code” nodes, plugin systems.
This tenant module provisions a single-tenant, Cozystack-managed cluster by
deploying the ordinary apps/kubernetes chart (Kamaji control plane +
KubeVirt-VM worker nodes) with operator-fixed values, sourced from this
package’s own source-only ExternalArtifact
(cozystack-computeplane-application-kubevirt-kubernetes). The tenant gets the
same substrate as any managed kind: Kubernetes cluster, but holds no admin
kubeconfig for it. The security posture (Cozystack-enablement addons, withheld
credentials) is baked into the chart and cannot be overridden; the one
tenant-facing knob is nodeGroups — the module forwards only the documented per-pool fields to the pool chart, so any other NodeGroup field (e.g. talos, version, images) is silently dropped: accepted but inert.
The cluster HelmRelease is named computeplane-cluster and its release name
is derived from it, so Kamaji writes the admin kubeconfig to the Secret
computeplane-cluster-admin-kubeconfig (key super-admin.svc) — the derived
contract consumed by the HelmReleases of placement: ComputePlane
applications. The tenant never sees that Secret: tenant-visible secrets are an
allowlist, and this module’s ApplicationDefinition includes nothing, which
withholds every Secret in the module’s lineage by construction.
Prerequisite: an etcd module must be available to the tenant — its own,
or one inherited from an ancestor tenant (the _namespace.etcd context
propagates down the tenant tree, so enabling a redundant local etcd is not
required). The tenant Kubernetes machinery — including the cluster-autoscaler
that brings up the default scale-from-zero md0 node group — is backed by
that etcd; without it the wrapped chart collapses to its awaiting-etcd
status beacon and the ComputePlane provisions no control plane or workers
(the HelmReleases still report Ready over the empty shell, so check for the
beacon ConfigMap when nothing comes up).
See the full design in cozystack/community design-proposals/compute-plane.
Parameters
Cluster shape
| Name | Description | Type | Value |
|---|---|---|---|
nodeGroups | Worker node groups of the ComputePlane cluster (cluster shape only — the security posture is fixed by the module and cannot be overridden through this knob: the module forwards only the documented per-pool fields to the kubernetes-nodes pool chart, so any other NodeGroup field, e.g. talos/version/images, is silently dropped — accepted but inert). Same structure as the kubernetes application’s nodeGroups. When left empty, the module itself materialises a default scale-from-zero md0 pool with roles: [ingress-nginx] (the wrapped kubernetes chart no longer injects one after the Phase 2 split), so the cluster sits idle until a pending Pod (e.g. the ingress-nginx controller) triggers the cluster-autoscaler. Supplied groups are authoritative (not merged with the default), so at least one of them must carry roles: [ingress-nginx] — enforced at render time. Each supplied pool key must be at most 15 characters so its kubernetes-nodes-computeplane-cluster-<pool> HelmRelease name fits Helm’s 53-character limit — also enforced at render time. | map[string]object | {} |
nodeGroups[name].minReplicas | Minimum number of replicas. | int | 0 |
nodeGroups[name].maxReplicas | Maximum number of replicas. | int | 10 |
nodeGroups[name].instanceType | Virtual machine instance type. | string | u1.medium |
nodeGroups[name].diskSize | System disk size for the worker VM. Carries the Talos OS image, kubelet state, containerd image cache, and any local-path PVCs. | quantity | 20Gi |
nodeGroups[name].storageClass | StorageClass for worker node persistent disks. When empty, the kubernetes-nodes pool chart applies its own default (replicated). | string | "" |
nodeGroups[name].roles | List of node roles. At least one group must carry ingress-nginx — the module pins the ingress-nginx addon on, and its controller only schedules onto nodes with that role (enforced at render time). | []string | [] |
nodeGroups[name].resources | Explicit CPU and memory for each worker node, as an alternative to instanceType sizing. Set both cpu and memory together or neither. | object | {} |
nodeGroups[name].resources.cpu | CPU available. | quantity | "" |
nodeGroups[name].resources.memory | Memory (RAM) available. | quantity | "" |
nodeGroups[name].gpus | List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM). | []object | [] |
nodeGroups[name].gpus[i].name | Name of GPU, such as “nvidia.com/AD102GL_L40S”. | string | "" |
nodeGroups[name].kubelet | Kubelet resource reservations for this node group. | object | {} |
nodeGroups[name].kubelet.systemReservedMemory | Memory reserved for host OS. Auto-computed from instanceType if empty. | string | "" |
nodeGroups[name].kubelet.kubeReservedMemory | Memory reserved for kubelet and container runtime. Auto-computed from instanceType if empty. | string | "" |
nodeGroups[name].kubelet.systemReservedCpu | CPU reserved for host OS. Auto-computed from instanceType if empty. | string | "" |
nodeGroups[name].kubelet.kubeReservedCpu | CPU reserved for kubelet and container runtime. Auto-computed from instanceType if empty. | string | "" |
nodeGroups[name].kubelet.evictionHardMemory | Hard eviction threshold for memory (absolute like 200Mi or percentage like 7%). | string | 7% |
nodeGroups[name].kubelet.evictionSoftMemory | Soft eviction threshold for memory (absolute like 1Gi or percentage like 10%). | string | 10% |