DOCSEARCHbyAlgolia
Submit Docs

Control Plane Documentation

website·Indexed 34 days ago

https://docs.controlplane.com/

Documentation for Control Plane, featuring a REST API reference for Core and Audit APIs, and guides for integrating AI coding agents. Includes support for the Model Context Protocol (MCP) server and AI plugins for tools like Claude Code, Cursor, OpenAI Codex, and ChatGPT to manage infrastructure via natural-language conversations.

Tokens
497.4K
Snippets
2.4K
Records
3.7K
Agent score
62%

What's inside Control Plane

  1. Overview of Secret storage and access

    Secrets provide strongly-encrypted storage for sensitive information. They can be injected into containers as environment variables. To access a secret at runtime, a workload must have an assigned identity that has been granted the reveal permission on that specific secret via a policy.

  2. Overview of Control Plane Jenkins Plugin

    The Control Plane Jenkins Plugin allows Jenkins to dynamically provision and deprovision agent workloads on Control Plane. Agents are created as workloads inside a Global Virtual Cloud (GVC) when jobs enter the queue and are automatically removed after an idle timeout. This eliminates the need for permanently running build infrastructure and allows scaling to zero when idle.

  3. Overview of FusionAuth deployment on Control Plane

    FusionAuth is a self-hosted identity and access management platform supporting OAuth2, OpenID Connect, and SAML. When deployed via the Control Plane Template Catalog, it includes a pre-configured PostgreSQL database. Note that this template does not create a Global Virtual Cluster (GVC); it must be deployed into an existing one.

    Deployed components include:

    • FusionAuth Workload: The main identity platform.
    • PostgreSQL Workload: The backing database.
    • Volume Set: Persistent storage for PostgreSQL.
    • Backup Cron Job: Optional scheduled database dumps to S3 or GCS (enabled via postgres.backup.enabled).
    • Secrets: PostgreSQL credentials and a startup script to ensure database readiness.
    • Identity & Policy: Access controls for secrets and object storage buckets.

  4. Overview of Hermes Agent architecture

    Hermes Agent is a self-hosted, model-agnostic AI agent that wraps an LLM with persistent memory, chat-platform gateways, and an OpenAI-compatible API. It consists of the following components:

    • Hermes Agent Workload: A single-replica stateful workload. It exposes a Gateway API on port 8642 (bearer auth), a web dashboard on port 9119 (basic auth), and an optional HMAC-signed webhook listener on port 8644.
    • Chromium Sidecar (Optional): A headless Chromium container enabled via browser.enabled. It exposes the Chrome DevTools Protocol (CDP) on loopback for browser automation tools.
    • Control Plane MCP (Default): A pre-registered MCP server (cplnMcp.enabled) that allows the agent to manage resources in a Control Plane organization after OAuth authentication in the dashboard.
    • Persistent Storage: A 10 GiB volume at /opt/data used for the SQLite memory database, sessions, learned skills, agent config, and MCP OAuth tokens.

  5. Overview of Keypair secrets

    Keypair secrets are used to store asymmetric public and private keys. They are typically used for SSH authentication, JWT signing, data encryption/decryption, code signing, and establishing secure communication channels between services. Both the public and private keys must be PEM-encoded. Private keys can optionally be protected with a passphrase.

  6. Overview of Apache Polaris on Control Plane

    Apache Polaris is an Apache Iceberg REST catalog that manages table metadata and access control, enabling query engines like Trino and Spark to read and write tables in S3-compatible storage. On Control Plane, Polaris is deployed as a stateless server backed by a PostgreSQL metastore. It is typically used in a lakehouse stack alongside S3-compatible storage (e.g., SeaweedFS) and a query engine (e.g., Trino).

  7. Overview of TimescaleDB Highly Available architecture

    The TimescaleDB Highly Available template deploys a Patroni-managed PostgreSQL 18 cluster with the TimescaleDB extension. The architecture consists of:

    • TimescaleDB Cluster: Three replicas (1 leader, 2 hot standbys) by default. Leadership is managed by Patroni to ensure writes remain available during deployments.
    • etcd Cluster: A distributed consensus store used for Patroni leader election. Requires an odd number of replicas (3, 5, or 7) for quorum.
    • HAProxy: A leader-routing workload that provides a stable endpoint by routing write traffic to the current primary via Patroni's REST health check.
    • PgBouncer (Optional): A connection pooler to multiplex application connections.
    • Backup Cron Workload (Optional): Performs scheduled pg_dumpall logical backups to AWS S3, GCS, or MinIO.

  8. Overview of PostgreSQL Highly Available architecture

    The PostgreSQL Highly Available template deploys a production-ready cluster with the following components:

    • Patroni PostgreSQL Workload: A stateful cluster with automatic leader election and failover. Each replica has its own volume.
    • etcd Workload: Provides distributed consensus for Patroni leader election. For production, use an odd number of replicas (3, 5, or 7) to maintain quorum.
    • HAProxy Leader-Routing Workload (Optional, enabled by default): Routes write traffic to the current primary replica to provide a stable connection endpoint.
    • PgBouncer Workload (Optional): A connection pooler that multiplexes application connections into a smaller pool of database connections.
    • Volume Set: Persistent storage for PostgreSQL data with optional autoscaling.

    Note: This template must be deployed into an existing Global Virtual Cluster (GVC).

  9. Overview of Coraza WAF Architecture

    Coraza WAF is deployed as a reverse proxy using the coraza-crs image, which runs Coraza as a plugin inside the Caddy web server. Traffic enters the WAF, is inspected against the OWASP Core Rule Set (CRS) and any custom rules, and is then forwarded to a target workload.

    Key architectural components include:

    • WAF Workload: A standard workload listening on WAFPort and proxying to targetWorkload:targetPort.
    • Startup Hook: A postStart hook that configures the Caddy reverse-proxy handler. It fails closed (refuses to serve traffic) if the WAF cannot configure itself.
    • Custom Rules: User-defined seclang rules loaded after the Core Rule Set, stored in a secret mounted at /opt/coraza/rules.d/custom.conf.

  10. Overview of Docmost Architecture on Control Plane

    Docmost is an open-source knowledge base and wiki featuring real-time collaborative editing and per-space permissions. The deployment consists of:

    • Docmost Server: A stateful workload serving the UI, REST API, and Yjs collaboration websockets on port 3000. It handles database migrations on boot and supports horizontal scaling via docmost.replicas.
    • PostgreSQL: Stores all pages, users, spaces, and permissions.
    • Redis: A bundled single-node instance with AOF persistence used for background job queues, the socket.io adapter, and cross-replica collaboration sync. The server requires Redis to report a healthy status.
    • Attachment Storage: Supports either a persistent volume mounted at /app/data/storage (default) or an S3 bucket.

  11. Overview of Azure SDK secrets

    Azure SDK secrets store Azure service principal credentials, allowing workloads to authenticate with Azure services using the Azure SDK. Common use cases include accessing Azure Storage (Blob, Files, Queues, Tables), Azure Key Vault, Azure Cosmos DB, Azure Service Bus, and Azure Resource Manager APIs.

  12. Overview of Debezium Server on Control Plane

    Debezium Server is a standalone Change Data Capture (CDC) application that streams row-level change events from a database's transaction log to a messaging system. Unlike standard Debezium connectors, it runs as a self-contained process and does not require a Kafka Connect cluster. It supports various sources (PostgreSQL, MySQL, MongoDB, SQL Server, Oracle) and sinks (Kafka, Redis, NATS, HTTP, AWS Kinesis, GCP Pub/Sub, Apache Pulsar, Azure Event Hubs).