Loft Labs’ vcluster Provides Secure Virtual Multitenant Kubernetes Clusters

This week, Loft Labs’ vcluster became a certified Kubernetes distribution making it “the first virtual cluster solution that passes 100% of Kubernetes conformance tests.” according to a statement from the company.

Loft Labs was founded two years ago with the goal of enabling organizations to scale self-service access to Kubernetes, and earlier this year, the company open sourced a piece of that technology as vcluster.

Vcluster allows engineers to spin up lightweight, virtual Kubernetes clusters that run inside the namespaces of an underlying Kubernetes cluster. In doing so, vcluster not only provides a more resource-efficient manner of spinning up multiple clusters, but also provides a form of soft multitenancy without needing to hand out administrator credentials to more users than needed.

Loft Labs CEO Lukas Gentele explained in an interview that vcluster came directly out of the company’s primary goal of scaling Kubernetes access from 10 to 10,000 engineers, which derives from the need for developers to use Kubernetes in ways not normally permitted.

“The more cloud native applications become, the more important it is for your engineering teams, not just the operations and production focus teams, but for the engineering teams that focus on development, to get early access to Kubernetes to choose the right architectures to build tools in the right way,” Gentele said. “That’s essentially where we’re coming from for our commercial product, and virtual clusters emerged, because of the need to do more than what you can do with namespaces.”

Gentele explained that there are various actions engineers may want to take — from running different Kubernetes versions to installing operators and CRDs to changing permissions — that simply are not available on a shared cluster without administrative privileges. The problem, of course, is that their actions could impact other applications and users running on that same cluster. The answer was vcluster, which provides a virtual cluster using the lightweight k3s Kubernetes distribution originally created by Rancher and now a sandbox project with the Cloud Native Computing Foundation (CNCF).

Vcluster works by “essentially deploying a separate control plane,” Gentele said. Spinning up a virtual cluster means creating a stateful set, which creates a pod with two containers inside of it. One is k3s, with the k3s API server (although Gentele says that the full Kubernetes API is planned for the future) and the controller manager, which is responsible for handling replica numbers. The second container runs the syncher, which uses the underlying Kubernetes cluster to create the necessary pods, as indicated by the replica number. As opposed to what you might expect with a virtualized environment, there is no performance hit when running vcluster, because the application is actually running on the underlying cluster, explained Gentele. Your actual application, he said, runs “100% the same way as they would have run if you spun them up directly.”

Becoming 100% conformant with Kubernetes was a difficult task for a virtual cluster, given the differences under the hood, but Gentele said he thought it was an important milestone.

“I think it’s very important to get to that point, because it assures people that they can use vcluster in more than just development,” he noted. “If you have a managed product, and you want to host different customers in different vclusters, you want to be sure that that cluster is a conformant Kubernetes cluster, not just because that gives you some kind of benchmark, it also makes sure that you can seamlessly transition workloads between vclusters and real clusters. So there’s no lock-in to what we’re doing. It’s 100% Kubernetes API and you can move workloads back and forth between vclusters and real clusters. I think that’s super important to ensure that.”

It is still early days for vcluster, which is just v0.3, and Gentele said that the project is looking to remain as flexible as possible. One thing he said vcluster would be trying to add would be the ability to increase communication between different vcluster instances and offer the ability to share services. While specific features for the future may be up in the air, one thing is not — Gentele sees the CNCF as the future home for vcluster, once it’s a bit more mature.

“We want to see vcluster in the CNCF down the road,” said Gentele. “I strongly believe that vcluster is such a fundamental piece of Kubernetes multitenancy and solves so many problems that go even beyond that use case that it needs to be part of CNCF. We definitely want to make it a sandbox project.”