Platform

vCluster

<p>Release Date: July 21, 2026</p><p>vCluster Platform v4.11 and vCluster v0.36 focus on day-2 operations for tenant clusters: built-in monitoring for platform admins, consistent configuration for private-node fleets, and clearer recovery guidance for backing-store incidents.</p><div data-type="horizontalRule"><hr></div><h2>Fleet Observability</h2><p>On shared infrastructure, platform admins need one fleet-wide view, while each tenant needs a safe, isolated slice of the same data. Building this by hand often means per-tenant Prometheus deployments and brittle access rules. vCluster Platform v4.11 introduces <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/maintenance/observability/overview">Fleet Observability</a>, giving platform admins one fleet view from which they can drill into tenant and control plane clusters that need attention. This initial release focuses on metrics. Logs and traces are not part of the Fleet Observability pipeline.</p><p>When admins deploy the optional bundled Grafana application template and configure the <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/maintenance/observability/install-observability-gateway">Observability Connector</a>, Platform embeds fleet, cluster, and GPU dashboards. The connector can use the bundled Prometheus backend or another metrics backend that accepts OTLP metrics and provides a Prometheus-compatible HTTP query API.</p><img data-width="100%" data-align="left" alt="" data-featurebase-content-key="65c0cea60ed972a243099c90/changelog/6a5f83eb1c2564ade3330245/019f851c-d7a1-7f22-8296-11c514af23f0/b64u-ZmxlZXQtb2JzZXJ2YWJpbGl0eS1kYXNoYm9hcmQucG5n.png" data-featurebase-content-filename="fleet-observability-dashboard.png" src="https://65c0cea60ed972a243099c90.featurebase-attachments.com/c/changelog/6a5f83eb1c2564ade3330245/019f851c-d7a1-7f22-8296-11c514af23f0/b64u-ZmxlZXQtb2JzZXJ2YWJpbGl0eS1kYXNoYm9hcmQucG5n.png?X-Amz-Expires=3600&amp;X-Amz-Date=20260921T000000Z&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=DO801TYC4FCVNNEKURKM%2F20260921%2Ffra1%2Fs3%2Faws4_request&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=3426aa5665fa184a06438a27cc8f1e2ddfbff4900ff3d9c4f93ed454a0fdd663"><p>OpenTelemetry collectors write metrics to a single backend through an authenticated gateway that stamps trusted Platform labels. Dashboard and API requests pass through the vCluster-provided <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/maintenance/observability/query-fleet-metrics">query proxy</a> that scopes PromQL to the control plane clusters or tenant clusters the authenticated identity can read. Together, authenticated labels and query rewriting enforce tenant-isolated access over a shared metrics backend. Platform dashboard views are available to platform admins, while direct API clients can use <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/maintenance/observability/configure-metrics-access#create-a-reader-key">scoped metrics-reader access keys</a>.</p><h3>Ready-to-deploy metrics stack</h3><p>For teams that want a ready starting point, Platform includes <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/maintenance/observability/deploy-with-argocd">Argo CD application templates</a> for the metrics stack. The bundled Prometheus template accepts OTLP metrics. The Grafana template integrates with Platform SSO and provides fleet, cluster, and GPU dashboards. <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/maintenance/observability/deploy-with-argocd#deploy-edge-collectors">OpenTelemetry collector templates</a> collect workload, Kubernetes, node, and optional GPU metrics. Admins create applications from these templates for the backend, Grafana, and the clusters they want to monitor.</p><h3>GPU health and operations</h3><p>For AI and GPU fleets, the same metrics path surfaces GPU-specific signals alongside tenant and control plane cluster health. Fleet Observability includes a GPU dashboard and collector scrape paths for exporters such as DCGM.</p><p>Separate GPU application templates help admins deploy NVIDIA GPU Operator, NVSentinel, and NVIDIA Fleet Intelligence Agent. These applications operate independently of Fleet Observability, but their metrics can feed the same Platform-centered operating view.</p><p>As more teams and clusters share the platform, Fleet Observability gives admins a clearer starting point for everyday operations. Admins can see the fleet, find the cluster that needs attention, and follow its metrics without leaving Platform.</p><h2>Group private nodes and keep them configured</h2><p>vCluster Platform v4.11 introduces <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/administer/node-profiles/overview">NodeProfile</a> as a way to group private nodes and maintain their configurations in common. Platform admins define named profiles with the labels, annotations, and taints that should apply to any node referencing them, and the platform keeps those settings in sync continuously, not just at join time. Editing a profile pushes the change out to every node that already uses it, without rejoining or replacing the node. Profiles can also apply startup taints that hold a new node out of scheduling until setup finishes, then clear automatically once it's ready.</p><img data-width="100%" data-align="left" alt="" data-featurebase-content-key="65c0cea60ed972a243099c90/changelog/6a5f83eb1c2564ade3330245/019f851e-635e-70df-88b0-eb8d7f105dd4/b64u-Y3JlYXRlLW5vZGUtcHJvZmlsZS5wbmc.png" data-featurebase-content-filename="create-node-profile.png" src="https://65c0cea60ed972a243099c90.featurebase-attachments.com/c/changelog/6a5f83eb1c2564ade3330245/019f851e-635e-70df-88b0-eb8d7f105dd4/b64u-Y3JlYXRlLW5vZGUtcHJvZmlsZS5wbmc.png?X-Amz-Expires=3600&amp;X-Amz-Date=20260921T000000Z&amp;X-Amz-Algorithm=AWS4-HMAC-SHA256&amp;X-Amz-Credential=DO801TYC4FCVNNEKURKM%2F20260921%2Ffra1%2Fs3%2Faws4_request&amp;X-Amz-SignedHeaders=host&amp;X-Amz-Signature=bf8b726c85662ec16d41675645daf1eaec0a29ecd25463ad8f42c4a0bb76e747"><p>Profiles apply the same way across manual joins and <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/vcluster/0.36.0/configure/vcluster-yaml/private-nodes/auto-nodes">auto-node pools, including both static and dynamic pools</a>. A node gets the right configuration no matter how it was provisioned, without teams hand-rolling their own join scripts or one-off per-pool settings. Application teams can target the right capacity with familiar Kubernetes scheduling controls, while platform teams manage the configuration from a single place.</p><p>Project admins can <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/administer/projects/allowed/node-profiles">curate which profiles a project is allowed to use</a> and set a project-level default for nodes that don't select one explicitly. A tenant cluster's own default (<code>privateNodes.defaultProfile</code>) always takes precedence over the project default, so platform teams get a safe baseline per project, while application teams can still opt into specialized profiles where they're allowed. Because the assignment is enforced through a protected node label that only the platform can set, a node can't grant itself a different profile after it joins.</p><p>Node profiles also make private-node operations easier to reason about as fleets grow. A node no longer joins as an undifferentiated machine that needs follow-up patching. Instead, it joins with its labels, annotations, and taints already applied, and stays in sync with its profile for as long as it's part of the tenant cluster.</p><div data-type="horizontalRule"><hr></div><h2>Breaking Change</h2><ul><li><p><strong>CSI volume snapshot backup and restore has been removed.</strong> vCluster v0.35 deprecated CSI volume snapshot backup/restore for persistent volumes. In vCluster v0.36 and Platform v4.11, the volume snapshot implementation, CSI snapshot controller deployment, VolumeSnapshot syncers, and related API fields have been removed. Existing <code>sync.toHost.volumeSnapshots</code>, <code>sync.toHost.volumeSnapshotContents</code>, and <code>sync.fromHost.volumeSnapshotClasses</code> configuration is retained only as a no-op so older configs can still parse. Customers that previously relied on backup (<code>--include-volumes</code>) or restore (<code>--restore-volumes</code>) should move persistent data protection to application-level or storage-provider-native workflows, such as <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/vcluster/0.36.0/manage/backup-restore/velero">Velero-based backups</a>, and use <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/vcluster/0.36.0/manage/backup-restore/backup">vCluster snapshots</a> for vCluster state.</p></li><li><p><strong>ArgoCD Application names now include a Platform instance hash.</strong> To avoid collisions when two or more Platform instances deploy same-named tenant clusters with the same applications into a shared ArgoCD, the computed ArgoCD Application name now includes the Platform instance ID as a hash suffix. Platform migrates existing Applications automatically without deleting managed workloads. Teams using the <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/integrations/argocd/connect-argocd">Argo CD integration</a> should confirm their Applications reconcile cleanly after upgrading.</p></li></ul><div data-type="horizontalRule"><hr></div><h2>Deprecation</h2><ul><li><p><strong>Moving tenant clusters between projects by API is deprecated.</strong> The API for moving virtual clusters between projects is being deprecated. Customers should plan to <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/use-platform/virtual-clusters/create/create-with-template">create tenant clusters</a> directly in the intended project and avoid building new automation around cross-project moves.</p></li><li><p><strong>Legacy token forwarding boolean is deprecated.</strong> Platform now uses an explicit token forwarding mode for tenant clusters. Existing <code>forwardToken</code> configuration remains compatible, but new configuration should use the <code>forwardTokenMode</code> <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/api/resources/virtualclusterinstance/#spec-template-forwardTokenMode">enum</a> instead of the legacy boolean.</p></li></ul><div data-type="horizontalRule"><hr></div><h3>Kubernetes Version</h3><p>This release uses Kubernetes <strong>1.36</strong> by default (<code>v1.36.0</code>).</p><div data-type="horizontalRule"><hr></div><h2>Additional improvements</h2><ul><li><p><strong>Tenant cluster troubleshooting gets more complete.</strong> Platform includes updates to the tenant cluster status experience, host-cluster drilldowns, vCluster logs in Platform, VPN diagnostics, and Gateway API inspection paths so admins have more context when they <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/administer/clusters/advanced/cluster-troubleshooting">investigate a cluster</a>.</p></li><li><p><strong>Template-backed tenant cluster creation is easier to review.</strong> The Platform UI now shows template summaries and template parameters during creation, making <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/platform/4.11.0/use-platform/virtual-clusters/create/create-with-template">template-backed clusters</a> easier to understand before users create them.</p></li><li><p><strong>Standalone clusters can set an explicit advertise address.</strong> vCluster now supports <code>controlPlane.standalone.advertiseAddress</code>, which is useful when the address advertised to peers should differ from the address vCluster would auto-detect.</p></li><li><p><strong>Task execution moves in-process (runner removed).</strong> Platform no longer uses a standalone runner. App and template tasks now run in-process in the Control Plane Cluster (bounded by <code>LOFT_MAX_CONCURRENT_TASKS</code>). Task logs are stored per-task in Kubernetes secrets rather than streamed through a runner. There is no user-facing API change, but self-hosted setups that provisioned dedicated runner peers (for example, Tailscale runner peers, runner access keys) no longer need them. Review any automation that assumed a separate runner.</p></li><li><p><strong>Node join tokens now last 24 hours.</strong> Bootstrap tokens used by autoscaling worker-node user data and <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.vcluster.com/docs/vcluster/0.36.0/deploy/worker-nodes/private-nodes/join">tenant cluster join scripts</a> now expire after 24 hours instead of 1 hour. This makes provisioning and join flows more resilient in the case of token expiry.</p></li></ul><div data-type="horizontalRule"><hr></div><p>For a list of additional fixes and smaller changes, refer to the <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://github.com/loft-sh/vcluster/releases/tag/v0.36.0">vCluster release notes</a>, the <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://github.com/loft-sh/vcluster-pro/releases/tag/v0.36.0">vCluster Pro release notes</a>, and the <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://github.com/loft-sh/loft/releases/tag/v4.11.0">vCluster Platform release notes</a>. For detailed documentation and migration guides, visit <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="http://vcluster.com/docs">vcluster.com/docs</a>.</p>