docs: add ComputePlane technical design for code-executing apps - #7
Conversation
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a technical design document (docs/compute-plane.md) detailing the architecture for isolating arbitrary-code-execution applications onto a separate, hidden Kubernetes cluster (ComputePlane) to secure the management plane. The review feedback suggests minor grammatical improvements to enhance the clarity and flow of the document.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
|
||
| 2. **Do not embed remote-apply logic in the app charts.** The `kubeConfig.secretRef` injection is performed centrally by the core app→HelmRelease conversion when `placement == ComputePlane`. cozyllm charts stay unaware of where they land — this keeps every app chart identical whether it runs locally or on a ComputePlane, and avoids duplicating the routing decision per app. | ||
|
|
||
| 3. **Declare the ComputePlane module dependency.** cozyllm's install/bundle documents that a tenant intended to host code-executing apps must have the ComputePlane Tenant module set (a non-empty `computePlane` profile name). If a `placement: ComputePlane` app is created in a tenant chain with no ComputePlane, creation is rejected (fail closed) rather than silently deploying onto the management cluster. |
There was a problem hiding this comment.
The phrase 'tenant intended to host' is grammatically awkward. Using 'tenant intending to host' makes the sentence active and clearer.
| 3. **Declare the ComputePlane module dependency.** cozyllm's install/bundle documents that a tenant intended to host code-executing apps must have the ComputePlane Tenant module set (a non-empty `computePlane` profile name). If a `placement: ComputePlane` app is created in a tenant chain with no ComputePlane, creation is rejected (fail closed) rather than silently deploying onto the management cluster. | |
| 3. **Declare the ComputePlane module dependency.** cozyllm's install/bundle documents that a tenant intending to host code-executing apps must have the ComputePlane Tenant module set (a non-empty `computePlane` profile name). If a `placement: ComputePlane` app is created in a tenant chain with no ComputePlane, creation is rejected (fail closed) rather than silently deploying onto the management cluster. |
|
|
||
| These mirror the core proposal's guarantees, asserted specifically for cozyllm's apps: | ||
|
|
||
| - A JupyterHub notebook (or n8n code node, ComfyUI custom node, Langflow component) runs on the ComputePlane with **no token/kubeconfig for** and **no network route to** the management/infra kube-apiserver. |
There was a problem hiding this comment.
The phrasing 'no token/kubeconfig for and no network route to the management/infra kube-apiserver' is slightly awkward. Simplifying it to 'no token/kubeconfig and no network route to...' is cleaner and grammatically correct.
| - A JupyterHub notebook (or n8n code node, ComfyUI custom node, Langflow component) runs on the ComputePlane with **no token/kubeconfig for** and **no network route to** the management/infra kube-apiserver. | |
| - A JupyterHub notebook (or n8n code node, ComfyUI custom node, Langflow component) runs on the ComputePlane with **no token/kubeconfig** and **no network route** to the management/infra kube-apiserver. |
|
Superseded by docs/compute-plane.md in aenix-io/cozyllm#1, rewritten for the final consumer pattern (chart-side opt-in remote apply; the ApplicationDefinition placement enum described here ships separately in cozystack core). This repository is archived; development continues in aenix-io. |
1 participant
Adds the cozyllm-specific technical design for running code-executing apps on a ComputePlane — a hidden, Cozystack-managed cluster the tenant does not see or manage — closing the isolation gap tracked in #6.
The catalog is split by whether an app executes user code: JupyterHub / n8n / ComfyUI / Langflow / Open WebUI route to the ComputePlane (
placement: ComputePlane); vLLM / LiteLLM stay on the ManagementPlane (inference / gateway only, no user-code execution). Routing reuses existing Cozystack primitives — the managedkubernetesapp, tenant modules, and Flux remote apply viakubeConfig.secretRef— so cozyllm adds no new isolation machinery.Upstream generic design (Cozystack core primitive): cozystack/community#17
Doc:
docs/compute-plane.md