fabric

Zyvor Fabric is a self-hosted control plane for private clouds built on ordinary Linux servers with KVM. It packages API, authentication, networking, storage, and monitoring into a single Rust daemon, zyvor-fabricd. Rather than implementing VM execution itself, it is positioned as the orchestration and UX layer over two companion projects: FluxVM (the VM engine, reached over REST on 127.0.0.1:7788) and GuestKit (offline disk inspection and customization used before first boot). Interfaces and automation The same daemon backs four first-class front ends: the zyvorctl command-line tool, a web console served alongside the API (default port 9095), a Kubernetes operator that reconciles VirtualMachine custom resources against a running fabricd instance, and a Terraform provider. Ansible content and a "Fabric Doctor" preflight tool are also included. Declarative VM definitions can be applied with zyvorctl apply -f, and VM creation supports optional tenant scoping. The README states that the daemon exposes 480+ REST endpoints plus three WebSocket channels, and reports roughly 48 Rust crates and on the order of 87K lines of code across Rust and TypeScript. Security and multi-tenancy Authentication uses JWT, with tenant claims scoping list, get, and mutate operations. The project lists RBAC roles, audit export, and encryption at rest, and documents OIDC/SSO and SCIM identity integration, plus an OpenStack compatibility layer with client tutorial material. Networking The README distinguishes two policy planes that should not be conflated: Fabric SDN (label-driven nftables host isolation, managed via /api/network-policies) and the VM-edge Network Fabric dataplane, which attaches TC/eBPF programs to the host-side interface of each VM. The edge dataplane supports per-VM IPv4/IPv6 CIDR allowlists (LPM maps), L4 protocol/port enforcement, Mbps/PPS rate limits, and per-VM statistics and LRU flow records, all readable and writable through /api/vms/{name}/dataplane/{status,policy,stats,flows} and the matching zyvorctl dataplane subcommands. Policy updates are described as in-place BPF map rewrites, with a documented brief over-deny window during reconfiguration rather than any allow-all gap. Three modes are documented: legacy nftables only, eBPF on the VM edge, and a Cilium coexistence mode. A separate Service Fabric layer provides Maglev VIP load balancing and related facilities. Durable policy lives in /var/lib/fluxvm/network-policy, with pinned programs and maps under /sys/fs/bpf/fluxvm. Generic PCI/VFIO passthrough is exposed through the REST API for GPU and similar devices. Deployment Four documented paths exist: bare metal via systemd or direct binary with helper scripts (including one-command "ship" flows), Docker/Podman Compose for local evaluation with /dev/kvm and host networking, Kubernetes using privileged hostNetwork DaemonSets plus Helm charts and a remote k3s lab script, and operator-only mode for GitOps workflows against an existing daemon. Kubernetes requirements listed include /dev/kvm on nodes, a privileged pod security level, and a rootful container engine on the build host. Admin credentials are generated at deploy time and retrievable from disk or from the zyvor-fabric-secrets Kubernetes Secret, with environment variables available to set or reset them. Notes for evaluation The README contains comparative material arguing the project's approach to VM-edge policy is ahead of libvirt/nftables, shared-bridge firewalling, QEMU user-mode NAT, and typical microVM-plus-CNI setups; these are the maintainers' own claims, and several performance figures cited (such as policy-update latency) are described as lab measurements. The primary in-repo documentation set covers quick start, Kubernetes, Docker, architecture, networking, web UX, host lifecycle, governance, and security policy. Licensing is Apache-2.0.