What’s shipped, what’s being built right now, and what’s next. Dates reflect real engineering plans, not marketing promises.
End-to-end declarative VM lifecycle on bare metal. Controller, node agent, CLI, networking, storage, mTLS — all working in production.
kctl workload / kctl container)kctl create vm -f)kctl apply -f ... kind-based manifest dispatch (kubectl-style)kctl rotate)kctl node install/etc/kcore/certs
Declarative disk layouts from install through day-2. The live ISO generates
disko-config.nix and runs disko --mode format,mount;
the kcore.disko NixOS module expresses OS and data disks with optional
merged fragments; nodes default to installer-only ownership and can be
moved to controller-managed for declarative DiskLayout
resources. The controller stores DiskLayout objects in its replicated
DB and reconciles them to the target node, which atomically persists the layout to
/etc/kcore/disk/current.nix and chains
nixos-rebuild test + switch. The node-agent classifier
refuses any layout that would touch a disk currently backing an active kcore
volume, LVM PV, or ZFS pool member — the controller never touches VMs.
disko-config.nix, runs disko --mode format,mount
modules/kcore-disko.nix with kcore.disko.* (including managementMode, controllerFragments, and persistedLayoutPath)
/etc/kcore/disk-management-mode — default installer-only; controller-managed unlocks declarative apply (legacy disko-management-mode path read as fallback)
kctl node apply-disk -f … [--apply] [--no-rebuild] → node-agent ApplyDiskLayout: classifier-gated, atomic persist to /etc/kcore/disk/current.nix, automatic nixos-rebuild chain
kind: DiskLayout resource, controller CRUD + replication outbox, controller-side reconciler tick that pushes unobserved generations to nodes and writes back observed_generation + phase
kcore-disko-types shared crate (used by both controller pre-flight and node-agent authoritative gate); refusal codes surface on status.refusalReason
Multi-controller clusters with CRDT-based state merge and cross-DC replication. Replication now runs with automatic reconciliation and compensation paths instead of manual conflict resolution.
kctl get replication-status [--require-healthy] for hard runtime gates
kctl resolve conflict removed from operator workflow
Formal models of distributed protocols to catch design bugs before they become code bugs. Models and trace checks are now wired as required CI gates.
ControllerNodeReconcile.tla — reconciliation model
ControllerReplication.tla — single-DC replication
CrossDcReplication.tla — multi-DC model
DiskLayoutReconcile.tla — per-resource state machine for the controller-orchestrated DiskLayout; safety invariant “no Applied transition without classifier approval”
The remaining three phases of the formal-methods plan landed alongside TLA+: generative property tests across every Rust crate, Kani bounded proofs on the security-critical sanitisers, and proptest coverage of database CRUD invariants. All four phases (proptest, Kani, DB invariants, TLA+) are now required CI gates.
kcore-sanitize leaf crate (zero non-std deps, so proofs compile in seconds)
DiskLayout diff parser in kcore-disko-types: extract_target_devices never panics, comment stripper preserves length, every emitted path is /dev/-prefixed, extraction is deterministic
#[kani::proof] runs on its own GitHub Actions runner with shared toolchain cache, completing the gate in ~1–2 min on warm cache
DiskLayout round-trips, idempotent upserts, foreign-key integrity, cascading delete, and the reconciler queue (list_disk_layouts_needing_reconcile)
DiskLayout safe/dangerous classifier: safe verdicts never overlap an active-VM, system-mount, LVM PV, or zpool-member device; classifier is deterministic on identical inputs
In-browser serial console in the dashboard for datacenter use: a CLI
terminal for day-to-day work, rescue, and installers. Also available
from the CLI via kctl console. Console opens are recorded
in the append-only audit log (actor, VM, timestamp). If you need a
graphical desktop, install a VNC server (or equivalent) inside the
guest OS yourself and reach it over the network. kcore does not provide
a hypervisor-level graphical console — that would add complexity
we do not need for headless workloads.
kctl console <vm> for operator serial access from a terminal
RBAC, audit logging, certificate lifecycle, SBOM export, and
per-identity gRPC rate limiting. Node certificates rotate on
their own, and revoked certificates are published over CRL and
OCSP — see
certificates & encryption.
kctl get crypto-config reports the cryptographic
posture. kctl get sbom exports the CycloneDX
document, and release artifacts are signed with Sigstore.
read-only, vm-admin, cluster-admin (per-operator certs CN=kctl:<name>, kctl operator)
ListAuditEvents API (+ kctl audit / dashboard)
AttachVmConsole records who opened which VM console, and when
kctl rotate node-certs, kctl revoke cert, kctl get pki-status)
SHA256SUMS signed with Sigstore keyless signing
GetCryptoConfig, ExportSbom (kctl get crypto-config, kctl get sbom)
Distributed shared block storage for the cluster — a vSAN-class fabric powered by Ceph on NixOS, with the controller filling the gaps NixOS does not declare. Replicated VM disks, cold drain without copying disks, and Cloud Hypervisor live migration over shared RBD all work today. See kcore SAN docs.
CephCluster resource (MON / MGR / OSD) with dedicated Ceph network
services.ceph + controller-owned bootstrap (keys, ceph-volume, health)
--storage-backend ceph)
Push-based event system for external integrations and alerting.
Endpoints are configured in controller.yaml and
receive a JSON POST, optionally signed with HMAC-SHA256.
node.heartbeat.missed, cert.expiry.warning, vm.state.changed
controller.yaml
Topology-aware placement beyond most-free-first. The controller still
spreads a new VM onto the ready node with the most free memory, then
CPU. Free capacity is live heartbeat load subtracted from physical
capacity times the overcommit ratio in controller.yaml.
--label dc=dc-a)
A VM can join more than one network. A network can add an IPv6 /64 beside IPv4, drop VM-to-VM traffic on its bridge, and reuse VXLAN addresses after a guest is deleted. Security groups still control north-south exposure, and named target-IP rules stay open when the east-west filter is on.
Importers that bring existing guests into kcore. Still to do in Q4.
Metrics and logs from the controller and the nodes. Still to do in Q4.
PostgreSQL, MySQL, and Kubernetes installed on kcoreOS itself. Each one is a declarative NixOS service on the node, the same way the rest of the host is configured. They do not run inside a VM.
services.postgresql package, declared through kcore and applied on the node
A PostgreSQL cluster on kcoreOS, built from the NixOS
services.postgresql package. Members run on the nodes
themselves, declared through kcore. The cluster does not run inside a VM.
Building on the four shipped phases (proptest, Kani, DB invariants, TLA+), extending depth and coverage in places where the current bounds or fuzz domains leave room for higher-confidence guarantees.
MAX_INPUT_LEN bound once the per-harness matrix budget allows it
validate_path_under_root alongside the already-shipped segment validator
Backups that cannot be changed after they are written.
This is not shipped. kctl backup today copies the controller database.
Day-2 tooling for node removal, cluster health, a copy of the controller database, and moving shared-disk VMs when a node stops heartbeating.
GetClusterHealth API — kctl get cluster-health reports ready nodes, VMs left on not-ready nodes, certificates inside 30 days, and unresolved replication conflicts
kctl backup -o snapshot.sqlite and kctl restore controller -f snapshot.sqlite --confirm. This is not guest backup.
kctl node cordon stops new placement without moving VMs; kctl node delete refuses while VMs, workloads, or networks remain, then revokes the node's certificates (RFC 5280 reason 5) and removes the row
Open an issue on GitHub or reach out directly. We prioritise based on real usage.