#Projects and Shoot Clusters

Projects and Shoot clusters form the customer-facing structure of managed Kubernetes on OSC.

A project groups clusters, users and permissions into a shared administrative boundary. It can represent a business unit, application domain or lifecycle environment. Many customers use separate projects for development, staging and production so that responsibilities and access rights remain clear.

Within a project, customers create one or more Shoot clusters. A Shoot is a complete Kubernetes environment with its own API endpoint, networking, worker pools and lifecycle settings. The cluster is logically isolated from other Shoots and is managed as an independent unit.

The control plane of a Shoot is not placed on the customer worker nodes. Gardener hosts it in an OSC-managed Seed environment. This separation keeps critical control-plane components under provider operation while giving customers full Kubernetes API access for their workloads.

A project can therefore contain several clusters with different purposes. A development team may use smaller, short-lived clusters, while production workloads run in separate, highly available clusters with worker pools across all three Availability Zones.

The project model also supports clear access control. Users and groups can receive permissions that match their role, from read-only visibility to cluster administration. Application teams can manage their own Shoot clusters without receiving access to the underlying OSC infrastructure.