Introduction

OtterScale is a multi-cluster Kubernetes platform that provides a single, authenticated entry point to all of your clusters — including clusters behind NAT, firewalls, or in air-gapped environments. Manage Kubernetes resources, storage, virtual machines, and AI workloads from one unified console.

Work in Progress

This documentation is under active development. New pages and guides are being added continuously — check back often for updates.

How It Works

A central server (hub) accepts ConnectRPC requests, while lightweight agents (spokes) running inside each cluster dial home over an mTLS reverse tunnel and forward requests to their local kube-apiserver with the caller’s identity preserved through impersonation. The result is consistent RBAC, discovery, and runtime operations across every connected cluster.

1. An agent registers with the server via a CSR flow and receives an mTLS certificate.
2. The agent establishes a reverse tunnel back to the server, so the cluster never needs to expose an inbound endpoint.
3. Users send ConnectRPC requests to the server, authenticated with an OIDC token (Keycloak).
4. The server routes each request through the tunnel to the target cluster, where the agent calls the local kube-apiserver using user impersonation — so native Kubernetes RBAC applies.

Components

The OtterScale platform is composed of several open-source components:

OtterScale Core

The multi-cluster Kubernetes API gateway — a unified ConnectRPC endpoint over reverse tunnels, secured with OIDC and mTLS. Provides generic resource CRUD, watch, exec/TTY, log streaming, port-forward, and API discovery across clusters.

Dashboard

The web UI for OtterScale, built with SvelteKit. A unified operations console for multi-cluster Kubernetes management, Ceph storage orchestration, VM lifecycle with console access, LLM serving, and Prometheus-backed monitoring.

Tenant Operator

A Kubernetes operator that turns a single Workspace resource into a fully isolated multi-tenant environment — namespace, RBAC bindings, resource quotas, network isolation, and optional Harbor registry integration.

Helm Charts

A curated collection of Helm charts for deploying OtterScale and the infrastructure it builds on — Rook Ceph, KubeVirt, KServe, GPU Operator, Envoy AI Gateway, Prometheus, and more.

Key Features

Multi-Cluster Management

Scopes, resources, and RBAC across every connected cluster

Storage Orchestration

Ceph pools, OSD, NFS, SMB, and object gateways

Virtual Machines

VM lifecycle management with xterm.js and VNC console access

AI/ML Model Serving

LLM deployment and an inference proxy

Security

OIDC (Keycloak), per-tunnel mTLS, user impersonation, and FIPS 140-3

Monitoring

Built-in metrics and dashboards backed by Prometheus

Multi-Tenancy

Isolated workspaces with quotas, network policies, and registry access

Getting Started

Installation, configuration, and operational guides are coming soon as part of this documentation. In the meantime:

• Run otterscale server --help and otterscale agent --help to explore the available options.
• Add the Helm repository: helm repo add otterscale https://otterscale.github.io/charts