Longhorn Architecture
You set up longhorn architecture by deploying control plane managers and per-volume storage engines on Kubernetes. The system splits each disk volume into dedicated microservice controllers and synced node replicas. Many teams install this storage system using default cluster admin permissions for fast testing. Broad cluster roles create big risks when engineers manage storage volumes in production. An engineer with wide access can delete live volumes or read raw block data. How longhorn archi
Zero Trust Architecture: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up longhorn architecture by deploying control plane managers and per-volume storage engines on Kubernetes. The system splits each disk volume into dedicated microservice controllers and synced node replicas. Many teams install this storage system using default cluster admin permissions for fast testing. Broad cluster roles create big risks when engineers manage storage volumes in production. An engineer with wide access can delete live volumes or read raw block data.
How longhorn architecture handles control and data paths
The system divides work between a control plane and a data plane. The manager pod runs on each node in your Kubernetes cluster. It talks to the Kubernetes API server to watch for new volume requests. When an app asks for storage, the manager creates a new volume engine. Unlike shared storage controllers, this design gives every single volume its own dedicated controller.
The data plane uses two core parts called engines and replicas. The engine runs as a Linux process on the node that runs your pod. Replicas store the actual data blocks across local disks on separate cluster nodes. The engine writes every change to all healthy replicas at the same time. If one node fails, the volume stays online using the remaining replicas. If the engine node fails, the manager starts a new engine on another node.
A built-in CSI driver links this storage system to standard Kubernetes persistent volume claims. When a pod moves, the driver detaches the volume and mounts it again. The system also takes snapshots by tracking changed blocks in a chain. It sends backup blocks to external object storage so teams can recover lost clusters.
How to set up storage roles and permissions
Teams interact with the storage system through the Kubernetes API or a web dashboard. In a standard setup, you assign role-based rules to control who manages volumes. You should create narrow roles that only allow users to view storage status. Only automated deployment pipelines should have the right to create or delete persistent volumes. You also need network rules to isolate replica traffic on a private cluster network.
Setting up backup storage requires extra care with cloud storage keys. The manager needs a secret key to push volume backups to external object stores. You must scope that cloud role to a single backup bucket. Never share that storage key with normal app pods or developer roles.
Zero Trust Architecture: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native cluster roles solve and where gaps remain
Native Kubernetes roles decide who can log in and call the storage API. They help you separate storage admins from developers who only deploy stateless apps. Good network rules also stop bad pods from talking to replica ports directly. These basic controls form the first line of defense for your cluster disks.
Still, static cluster roles cannot inspect individual commands or queries in flight. Once an engineer gets admin access to fix a broken volume, they hold full power. They can mount a production volume to a debug pod and read raw files. Native roles only check who starts the session, not what commands run inside it. Also, shared dashboard credentials make it hard to see which person deleted a snapshot. Teams need finer controls over live cluster commands and database queries on those volumes.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
How many replicas should we run for each volume?
Most production teams run three replicas across three separate nodes or availability zones. This setup keeps data safe even if two disks fail at the same time.
Does a crashed volume engine break other volumes on the node?
No, each volume runs its own isolated engine process in the data plane. A crash in one engine never stops input or output for other volumes.
How do we secure the storage dashboard in production?
Do not expose the dashboard to the public internet without an auth check. Place it behind a private network and require team members to log in first.