Architecture
Control-plane services, node execution, ownership, and hosted boundaries.
Infra separates management state from node execution and workload data. The control plane authorizes and coordinates changes; node agents apply them to hypervisors, storage, and regional networking.
Clients submit changes to the control plane, which stores management state in PostgreSQL and coordinates node agents. Regional services run droplets, store volume data, and provide mesh transport.
Components
The console and API authenticate requests and store accepted configuration in PostgreSQL. The scheduler resolves placement and reservations; workers issue and reconcile operation steps. Observation services retain the metrics and journals used to diagnose those steps.
Each node agent has its own identity and local reconciliation state. It manages hypervisors, storage paths, and regional networking without turning the management database into a guest disk store. Live volume data belongs to storage-pool devices; guest execution belongs to its hypervisor.
The Connector is a separate authorization and reconciliation path for selected hosted resources. It does not replace local agents or make the hosted service the storage backend for every owned region.
Request execution
The API authenticates a request, checks role and policy, validates resource references, and records desired configuration and an operation. Workers dispatch necessary changes. Agents report observed state and component results.
An accepted request can outlive its client connection. Workers reconcile an uncertain result rather than assuming that a timeout means no change occurred. Operations expose the distinction between queued, running, reconciling, and terminal work.
Workload and storage ownership
A droplet has one authoritative execution placement. Writable volume attachments have ownership records and storage leases used to prevent competing writers. Migration transfers ownership as part of its commit phase.
An unreachable host might still run its guests. Recovery must establish that the previous writer is fenced before a replacement receives write ownership. Operator workflows cannot safely substitute network timeout for fencing.
Failure boundaries
A control-plane outage prevents new management changes and fresh consolidated observations. Running workloads can continue when their hypervisor, storage, networking, and local dependencies remain healthy. Applications that depend on a control-plane service can still be affected.
A node failure affects its compute and any local storage role. Replicated volumes can remain available only when their storage policy's surviving placement and write requirements are met. A zone failure can affect several components at once.
Hosted and owned capacity
Owned nodes connect to the installation that manages them. Hosted regions expose managed capacity through the hosted service. A self-hosted installation uses a Connector for hosted capacity; local nodes do not require it.
The Connector sends configuration and observations needed for hosted resources. It does not replicate every local volume or create an automatic data path between regions. Backups and cross-region copies are explicit operations.
High availability and recovery
High availability distributes control-plane services across failure domains. It still depends on database availability, encryption material, observation storage, and shared configuration.
Control-plane backup restores management state. Application recovery restores workload data. Design and test both procedures; neither backup class replaces the other.