Guides

Task-focused guides for every capability CAPVCO ships. Each feature is opt-in: you enable it with a cluster template, a label on the Cluster, and/or a field on the VCOCluster — nothing here is on unless you ask for it.

New to CAPVCO? Do the Getting started path first; it gives you a running cluster these guides build on.

Pick a guide

• Networking & CNI

  ---

  Calico, pod/service CIDRs, and the overlap rule that will bite you if you ignore it.

  Networking

• HA control plane

  ---

  Three control-plane nodes, stacked etcd with quorum protection, self-healing, and safe rolling upgrades.

  HA control plane

• Geo-redundant clusters

  ---

  One logical cluster across multiple datacenters, meshed over site-to-site VPN, with a health-aware DNS endpoint. Survive a datacenter outage.

  Geo-redundancy

• Persistent storage (CSI)

  ---

  The whitesky.cloud CSI driver: standard, physical, and LUKS2-encrypted StorageClasses, plus online volume expansion.

  Storage

• Node disks

  ---

  A dedicated low-latency etcd disk, and automatic node-disk growth before you hit DiskPressure.

  Node disks

• Load balancing & Services

  ---

  Service type=LoadBalancer backed by real whitesky.cloud load balancers, with or without a cloud-controller-manager.

  Load balancing

• Automatic worker scaling

  ---

  A worker pool that grows when pods go Pending and shrinks when nodes sit idle — including scaling a pool all the way down to zero.

  Autoscaling

• ExternalDNS

  ---

  Publish Service/Ingress hostnames into whitesky.cloud-managed DNS automatically.

  ExternalDNS

• etcd backup & restore

  ---

  Encrypted, WORM-protected etcd snapshots to S3 on a grandfather-father-son schedule — and a restore path that has actually been exercised.

  Backup & restore

• Pre-baked images

  ---

  Build node images with Kubernetes already installed, so nodes boot fast and offline.

  Pre-baked images

• Air-gapped clusters

  ---

  Run with no public-internet egress: an in-cloudspace registry serves every image locally over TLS.

  Air-gapped

How features are enabled — the map

Most features are switched on in one (or more) of three places. This table is the quick index; each guide has the detail.

Feature	Template	Cluster label	VCOCluster field
CNI (Calico)	all	…/cni: calico	—
CSI storage	base, prebaked, geo	…/csi: vco	spec.storage
HA control plane	any (set replicas ≥ 3)	—	—
Geo-redundancy	geo	…/apiserver-proxy: enabled	spec.geo
Physical etcd disk	base (commented block)	—	machine spec.etcdDisk
Disk auto-expansion	—	—	machine spec.diskGrowthPolicy
Service LoadBalancer	base (commented)	…/service-lb: vco	—
Cloud-controller-manager	ccm	…/ccm: enabled	—
ExternalDNS	—	…/external-dns: enabled	—
etcd backup	backup	—	spec.backup
Pre-baked images	prebaked, ccm, backup, geo	—	machine spec.imageId / spec.geo.locationImages
Air-gapped registry	airgapped	—	spec.airGapped + spec.registry

Labels live on the Cluster, not the VCOCluster

Add-on selector labels use the prefix capvco.infrastructure.cluster.x-k8s.io/ and go on the core CAPI Cluster object. The stock templates set the common ones for you.

The exhaustive field-by-field truth is the CRD API reference; every template variable is in Templates & variables.