#Control-plane Architecture

OSC separates customer workloads from the control planes that manage them.

Each Shoot cluster has its own Kubernetes control plane. Gardener runs that control plane in an OSC-managed Seed cluster rather than on the customer worker nodes. The API server, etcd, controller manager and scheduler are therefore operated as part of the managed service.

The Garden layer coordinates the overall Kubernetes service. It knows the available Seeds, projects, credentials and supported cluster configurations. When a Shoot is created or changed, Gardener translates that desired state into infrastructure and Kubernetes operations.

Below Gardener, OSC operates regional infrastructure control planes for compute, networking, storage, DNS and hardware lifecycle. These internal clusters use Kubernetes-style reconciliation to keep the platform state consistent. They are not exposed as customer products.

This layered design creates clear responsibility boundaries. Customers administer the Kubernetes API of their Shoot and the resources deployed into it. OSC administers the Seed, Garden and infrastructure control planes that keep the service running.