11# Architecture
22
3- cloud-vinyl is a Kubernetes operator that manages Varnish Cache clusters as first-class Kubernetes resources.
4- It is a clean-room reimplementation of [ mittwald/kube-httpcache ] ( https://github.com/mittwald/kube-httpcache ) ,
5- designed around the Kubernetes operator pattern with a central controller instead of per-pod sidecars.
3+ cloud-vinyl is a Kubernetes operator that manages [ Vinyl Cache] ( https://vinyl-cache.org/ ) clusters
4+ (the FOSS HTTP cache formerly known as Varnish Cache) as first-class Kubernetes resources.
5+ It is designed around the Kubernetes operator pattern with a central controller instead of per-pod sidecars.
66
77## Components
88
@@ -11,7 +11,7 @@ graph TD
1111 subgraph Kubernetes cluster
1212 OP[cloud-vinyl operator<br/>Deployment]
1313 VC[VinylCache CR]
14- SS[StatefulSet<br/>Varnish pods]
14+ SS[StatefulSet<br/>Vinyl Cache pods]
1515 AG[vinyl-agent<br/>sidecar per pod]
1616 PX[Purge/BAN proxy<br/>port 8090]
1717 WH[Admission webhook<br/>port 9443]
@@ -20,7 +20,7 @@ graph TD
2020 OP -->|manages| SS
2121 SS -->|contains| AG
2222 OP -->|pushes VCL| AG
23- AG -->|manages Varnish | VCL[Varnish process]
23+ AG -->|manages Vinyl Cache | VCL[Vinyl Cache process]
2424 PX -->|PURGE/BAN broadcast| SS
2525 WH -->|defaults + validates| VC
2626```
@@ -38,33 +38,33 @@ The operator is a single Deployment that runs the reconcile loop. It:
3838
3939### vinyl-agent
4040
41- A lightweight HTTP server running as a sidecar in each Varnish pod.
42- It wraps the Varnish admin interface (port 6082) and exposes:
41+ A lightweight HTTP server running as a sidecar in each Vinyl Cache pod.
42+ It wraps the Vinyl Cache admin interface (port 6082) and exposes:
4343
4444- ` POST /vcl/push ` — compile and activate a new VCL.
4545- ` GET /vcl/active ` — return the hash of the currently active VCL.
46- - ` POST /ban ` — issue a Varnish ` ban ` command.
46+ - ` POST /ban ` — issue a ban command.
4747
4848Communication between the operator and vinyl-agent is authenticated with a pod-scoped token stored in a Kubernetes Secret.
4949
5050### Purge/BAN proxy
5151
5252The operator exposes an HTTP endpoint on port ` 8090 ` that accepts:
5353
54- - ` PURGE /<path> ` — HTTP PURGE broadcast to all Varnish pods.
54+ - ` PURGE /<path> ` — HTTP PURGE broadcast to all Vinyl Cache pods.
5555- ` POST /ban ` or ` BAN ` method — validated ban expression, forwarded to vinyl-agent ` /ban ` on all pods.
5656- ` POST /purge/xkey ` — xkey-based purge, one ` PURGE ` per key with ` X-Xkey-Purge ` header.
5757
5858Upstream services send a single request; the operator fans it out to all pods in parallel.
5959
6060## Why a central operator instead of sidecars?
6161
62- The original kube-httpcache runs a per-pod signaller sidecar that watches the Kubernetes Endpoints
63- API and triggers VCL reloads. This design has several problems:
62+ A per-pod signaller sidecar design that watches the Kubernetes Endpoints API and triggers VCL reloads
63+ has several structural problems:
6464
65651 . ** Chicken-and-egg at startup** : pods with readiness gates cannot become ready until the sidecar
6666 receives the first VCL push — but the sidecar needs other pods to be ready to build the peer list.
67- 2 . ** Silent drop on failure** : if a VCL push fails, kube-httpcache logs and continues.
67+ 2 . ** Silent drop on failure** : if a VCL push fails, the sidecar logs and continues.
6868 Pods silently run stale VCL.
69693 . ** No debouncing** : rapid endpoint churn (rolling restarts) triggers many VCL regenerations back-to-back.
7070
0 commit comments