← All features
FEATURE DEEP DIVE

Managed clusters your customers can actually use, without a platform team

HA control planes, node pools that mix shapes and sizes, a real cluster autoscaler, and rolling upgrades that never take the apiserver down. Provisioning finishes in 5 to 12 minutes.

app.virtconsole.com/kubernetes/clusters
VirtConsole Kubernetes cluster overview with node pools, control plane status and kubeconfig download
01

Cluster provisioning

Launch a cluster in minutes from a six-step wizard. Provisioning finishes in 5 to 12 minutes with a live progress overlay.

Multi-region

Each cluster lives in a region of your choice. Operate clusters across many regions from the same panel.

VPC-native

Clusters run inside one of your VPCs. Control plane nodes sit in private subnets; workers can be private or public.

Curated versions

An admin-managed catalogue of supported Kubernetes versions, each with vetted images and tested upgrade paths.

02

Control plane

Single-node or 3-node HA, always fronted by a dedicated managed load balancer.

HA-ready etcd

HA clusters run a 3-node etcd quorum that tolerates the loss of any one node without an apiserver outage.

Public + private endpoints

Each cluster exposes both a public and a VPC-internal API endpoint. Restrict to private only if you like.

Custom domain TLS

Bind a Let’s Encrypt or custom certificate to the API LB and reach kubectl at your own domain with strict TLS verification.

One-click kubeconfig

Download a ready-to-use kubeconfig from the cluster page, served by System DNS name rather than a bare IP.

03

Workers & autoscaling

Pin a fixed count, or set bounds and let the autoscaler respond to pod demand.

Cluster autoscaler

Workers scale up when pods are pending, down when nodes are underutilised. Bounds are enforced strictly so costs never run away.

Node pools

Mix node shapes in one cluster: per-pool plans, labels, taints, autoscaling bounds and drain policy. A general pool beside a GPU pool.

Plan rotation

Change a pool’s instance plan with live workers. Replacements provision first, then old nodes drain, wave by wave with zero capacity loss.

Labels & taints

NoSchedule, PreferNoSchedule or NoExecute, pushed to every worker, applied at exactly the moment rotation reschedules pods.

Graceful drain

Removing a worker cordons it, evicts pods within a configurable grace period, then deletes the VM. PDBs are respected.

Per-node inspection

CPU and memory donuts, pod-level utilisation and top consumers straight from the panel. No kubectl top required.

04

Rolling upgrades

One-click upgrades for control plane and workers, wave by wave, apiserver always available.

Worker surge-replace

Configure how many extra workers run in parallel: 1 means one-at-a-time with zero overhead, higher means faster.

Control plane waves

One new CP node provisioned, one old drained, repeated until done. The apiserver stays available across all waves.

Valid-path enforcement

Kubernetes forbids skipping minor versions, so the dropdown only shows versions you can actually reach.

05

LoadBalancer Services

Apply a Service of type LoadBalancer and a real platform LB appears with a public IP within minutes.

Cloud Controller Manager

Pre-installed integration that watches Services and Nodes and reconciles them against the platform.

Annotations for everything

Plan, backend protocol, Let’s Encrypt SSL, source ranges, PROXY protocol. Scaled workers appear in the LB pool within seconds.

Internal VIPs

Annotate a Service as internal and it gets a private VIP inside the VPC instead of a public IP.

06

Security & the stack

Defense in depth on battle-tested upstream components. Nothing exotic.

Three security group scopes

Separate rule sets for the API LB, control plane and workers, controllable from the panel.

Pod Security Admission

Set the cluster-wide default profile at create time: privileged, baseline or restricted.

Cilium CNI

eBPF kube-proxy replacement, faster than iptables, with native NetworkPolicy support. kubeadm, kubelet and containerd from pkgs.k8s.io.

Certificates that renew themselves

Cluster PKI, autoscaler tokens and the CCM rotate 30 days before expiry. Workloads keep running.

Webhook subscriptions

HMAC-signed lifecycle event webhooks with per-subscription delivery history, manageable over the API.

Team-friendly RBAC

Destructive operations like scale, upgrade and delete sit behind permissions that match your team structure.

Deeper look

One cluster page, everything that matters

Control plane status, node pools and worker inventory in a single view, no kubectl required.

app.virtconsole.com/kubernetes/clusters/prod
VirtConsole Kubernetes cluster detail page with control plane status, node pools and worker inventory

A cluster open: control plane health, pools and workers together

More of the platform

Try it on your own hardware

Free 30-day trial. Every feature included. No credit card required.

View pricing