What happens during control plane outages?
vCluster Platform is the management plane for projects, access, templates, lifecycle operations, and connected cluster visibility. Tenant clusters have their own control planes. Those control planes might run on the same Kubernetes cluster as Platform or on separate connected clusters.
Because these layers are separate, an outage affects different capabilities depending on what is unavailable.
Platform outage​
If vCluster Platform is unavailable but the connected clusters and tenant cluster control planes remain healthy, tenant clusters do not automatically stop. Existing workloads are not intentionally deleted because Platform is unavailable.
| Capability | Status | Impact |
|---|---|---|
| Platform UI and API | Unavailable | Users and automation cannot reliably use Platform while it is down. |
| Lifecycle operations | Unavailable | Creating, deleting, sleeping, waking, updating, or restoring tenant clusters fail or wait. |
| Access, audit, and integrations | Limited | Platform-provided access features, audit, integrations, and automation are unavailable or delayed. |
| Tenant cluster runtime | Available | Tenant clusters do not automatically stop if their own control planes and connected clusters remain healthy. |
| External deployment tools | Available | Externally deployed tenant clusters continue to be managed by their original deployment tool. |
Platform high availability protects the management plane by running multiple Platform replicas. It doesn't replace high availability for tenant cluster control planes or for the Kubernetes clusters that host tenant clusters. See High Availability Installation.
Connected control plane cluster outage​
A connected control plane cluster is a Kubernetes cluster where Platform can deploy or manage tenant clusters. If a connected control plane cluster is unavailable, Platform can't complete operations that require access to that cluster.
| Capability | Status | Impact |
|---|---|---|
| Platform UI and API | Available | Platform remains reachable and continues managing other healthy connected clusters. |
| Connected cluster visibility | Limited | Platform marks the connected cluster or its network peer as offline until connectivity returns. |
| Lifecycle operations on that cluster | Unavailable | Platform can't create, update, delete, sleep, wake, or inspect tenant clusters hosted there. |
| Tenant cluster reconciliation | Unavailable | Platform-managed reconciliation pauses or fails for tenant clusters on the unavailable cluster. |
| Tenant workloads | Limited | Availability depends on whether their control planes and worker nodes are still running and reachable. |
If tenant cluster control planes are hosted on the unavailable control plane cluster, tenant users can't reliably use those tenant cluster APIs until the control plane cluster recovers. For the tenant cluster view of this behavior, see What happens during control plane outages?.
Tenant cluster control plane outage​
If an individual tenant cluster control plane is unavailable but Platform remains healthy, Platform can still be reachable, but operations against that tenant cluster are limited. Platform may report the tenant cluster's phase as pending or failed, and its status conditions can further indicate that it isn't ready or is offline, depending on the deployment model and connectivity path.
| Capability | Status | Impact |
|---|---|---|
| Platform UI and API | Available | Platform can remain reachable and continue managing other healthy tenant clusters. |
| Operations for this tenant cluster | Limited | Operations that require the unavailable tenant cluster API can fail or remain pending. |
| Tenant cluster status | Limited | Platform may report the tenant cluster's phase as pending or failed, with status conditions indicating it isn't ready or is offline. |
| Existing tenant workloads | Limited | Platform does not intentionally delete them for tenant clusters connected through an agent on a connected cluster. |
| Other tenant clusters | Available | Healthy tenant clusters can continue to be managed independently. |
For externally deployed tenant clusters connected directly through a network peer, such as vCluster Standalone, using their own backing store, Platform deletes the instance if it stays disconnected for more than 7 days. Tenant clusters connected through an agent are not affected by this cleanup.
Recovery resumes after the tenant cluster control plane becomes reachable again.
For production environments, plan availability at each layer: Platform, the connected control plane clusters, and the tenant cluster control planes.