Harvester Longhorn
Harvester Longhorn provides distributed block storage for virtual machines running on Kubernetes clusters. You set up harvester longhorn by assigning disks and storage classes to nodes. Teams often grant full cluster roles so admins can manage disks and volumes. Broad cluster roles let one bad command wipe out live storage volumes. How harvester longhorn manages virtual machine storage Harvester runs on top of Kubernetes and uses KubeVirt to run virtual machines. Longhorn acts as the built-in
Longhorn: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
Harvester Longhorn provides distributed block storage for virtual machines running on Kubernetes clusters. You set up harvester longhorn by assigning disks and storage classes to nodes. Teams often grant full cluster roles so admins can manage disks and volumes. Broad cluster roles let one bad command wipe out live storage volumes.
How harvester longhorn manages virtual machine storage
Harvester runs on top of Kubernetes and uses KubeVirt to run virtual machines. Longhorn acts as the built-in storage engine inside every Harvester cluster. It splits host disks into replicated block volumes for virtual machine root disks. Each volume gets its own controller pod and several replica pods across nodes.
When a host node fails, the storage engine keeps volumes online using replicas. Admins manage these volumes through the Harvester dashboard or standard Kubernetes API calls. Under the hood, every disk change becomes a custom resource change in Kubernetes. Storage classes define how many replicas each virtual machine volume should keep.
Teams also use this setup to take volume snapshots and run off-site backups. Backups go to external object stores or network file shares outside the cluster. Restoring a snapshot creates a new block volume from the saved state. This native architecture gives virtual machines the same storage flow as container workloads.
How cluster roles control storage tasks
Harvester uses Kubernetes role-based access control to manage who can change storage resources. Admins assign cluster roles or project roles to team members based on duties. A cluster owner role allows full control over nodes, disks, and storage classes. Project roles restrict users to creating virtual machines and volumes in one namespace.
Many teams share a single kubeconfig file to run maintenance tasks on nodes. Engineers use this file to drain nodes, check replica health, or fix volumes. Native roles check who is allowed to talk to the Kubernetes API server. They work well for separating project users from core cluster operators.
What native cluster roles leave open
Native roles decide who logs in to the cluster, not what commands run. Once an engineer has a cluster role, every storage action is allowed. An operator fixing a stuck replica can delete a healthy volume by mistake. Kubernetes logs the API call, but it does not block bad commands early.
Longhorn: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Shared kubeconfig files also make it hard to track which person ran commands. Teams need a way to approve risky volume deletions before they happen. They also need to protect sensitive data inside guest databases during live maintenance. Data masking can rewrite emails, phone numbers, card numbers, and national IDs in results.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Can you use external storage with Harvester instead of the built-in engine?
Yes, Harvester supports third-party container storage drivers alongside the default storage engine. You can install another driver to provision volumes from external storage arrays.
How does the storage engine handle node maintenance in Harvester?
When you put a Harvester node into maintenance mode, live virtual machines migrate away. The storage engine rebuilds volume replicas on remaining healthy nodes to keep data safe.
How do you limit who can delete virtual machine volumes?
Remove broad cluster admin roles from daily user accounts and use scoped project roles. Add command-level checks and human approval steps for any delete requests on storage resources.
Teams that document these role rules and review logs each month catch config drift early. Clear ownership for each role keeps live systems simple to run and easy to audit across the whole team.
Short role checks help teams work fast. Simple rules make each review clear. Good logs keep every team safe. Scoped keys stop bad changes early.