> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rafftechnologies.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes cluster architecture

> What a Raff Kubernetes cluster is made of — gateway, control plane, workers, storage nodes

<sub>Updated August 24, 2026</sub>

Every cluster is a set of virtual machines in a **dedicated VPC**, built from four roles:

| Role              | Count         | What it does                                                                                                                                                               |
| ----------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Gateway**       | 1 (2 with HA) | Holds the cluster's public IP, NATs outbound traffic, load-balances the Kubernetes API (6443) and ingress traffic (80/443) into the cluster, and serves DNS to the nodes   |
| **Control plane** | 1 or 3        | Runs the Kubernetes API server, scheduler, controllers and etcd. Sized and managed by Raff, free of charge. etcd lives on hypervisor-local NVMe for consistent low latency |
| **Workers**       | 2–20 per pool | Your capacity — grouped into [node pools](/products/build/kubernetes/concepts/node-pools-and-autoscaling), billed per node                                                 |
| **Storage nodes** | 0, 2 or 3     | Optional dedicated nodes running Longhorn, providing replicated block volumes — see [Storage](/products/build/kubernetes/concepts/storage)                                 |

The distribution is **RKE2** with the **Cilium** CNI. Nodes have no public IPs — all traffic enters and leaves through the gateway, and the [firewall](/products/build/kubernetes/concepts/networking) on the gateway decides what gets in.

The cluster's **Nodes** tab shows each role in its own section — Gateway (with the floating public IP), Control plane, Storage and Workers — with internal IPs, per-node CPU/memory and kubelet status:

<Frame>
  <img src="https://mintcdn.com/rafftechnologiesllc/pydLUQqixwIwkrCw/images/products/compute/kubernetes/nodes-tab.png?fit=max&auto=format&n=pydLUQqixwIwkrCw&q=85&s=787c158435ad3c7ad57f771671b5dc44" alt="Nodes tab with Gateway, Control plane, Storage and Workers sections" width="2000" height="1376" data-path="images/products/compute/kubernetes/nodes-tab.png" />
</Frame>

## Lifecycle states

A cluster's `status` moves through: `pending` → `deploying` → `running`, with `warning` for degraded conditions (details in the status message), `failed` when provisioning could not complete (all infrastructure is cleaned up automatically and nothing bills), and `deleting` / `delete_failed` during teardown. The `ready` flag is the simple version: `true` means running with no pool mid-operation.