Projections

A projection makes a boundary available on one cluster. A boundary with no active projection cannot hold resource groups, so projecting it is the step between creating a boundary and using it. A boundary can be projected into several clusters, once into each.

Adding a projection needs boundaries/projections/manage at the root of the platform, which the Platform Owner and Platform Contributor roles have. The cluster must already be connected to the platform — see Connect a cluster.

What a projection does

Once a projection is Active:

• resource groups created in the boundary from then on get a namespace on that cluster;
• the platform keeps the boundary's network rules in those namespaces — see Network isolation;
• the platform writes a Boundary resource, named after the boundary's slug, into the cluster, and the cluster's operator reconciles it. This is how the operator learns about the boundary, for Crosslink among other things.

Add a projection

1. Open Boundaries, choose the boundary and open its Projections tab.
2. Choose Add Projection.
3. Pick the Cluster. Every connected cluster is listed.
4. Choose Add Projection.

The projection appears as Provisioning, and an operation for it appears on the boundary's Operations tab. The projection becomes Active on the platform's next network pass, within five minutes by default, and the operation completes with it. Only then can resource groups be created on the cluster.

A boundary can be projected into a cluster only once; a second projection into the same cluster is refused.

The Add Projection button is also shown to the boundary's Owners and Contributors, but adding fails for them because the action is only granted at the root.

Statuses

When a boundary gets another cluster later

A resource group gets its namespaces when it is created, on the clusters the boundary is actively projected into at that moment. Projecting the boundary into another cluster later does not add the existing resource groups to it; only resource groups created after the new projection is Active get a namespace there.

Removing a projection

There is no complete way to remove a projection today. The portal has no remove action. The API (DELETE https://api.example.com/boundaries/<boundary-id>/projections/<projection-id>) marks the projection Deleting: from then on the platform stops maintaining the boundary's network rules and its Boundary resource on that cluster, but removes nothing from the cluster, and the projection stays listed as Deleting.

While Crosslink is on, the projection of the hub cluster cannot be removed at all; the request is refused until the hub is moved to another cluster or Crosslink is turned off.

In the cluster

kubectl get boundaries.platform.stackship.se on the cluster lists the Boundary resources the platform wrote there. Their phase is the operator's own view of that cluster, not the status the portal shows for the boundary or the projection.

With the CLI

List the clusters a boundary is projected into, with each projection's status:

stsh boundary projections --boundary my-boundary

The CLI has no command for adding a projection.