---
title: "Ctrlplane"
tagline: "Instance lifecycle"
language: "Go"
license: "Apache-2.0"
since: "2026"
canonical: "https://xraph.com/work/ctrlplane"
---

# Ctrlplane

Provisions and manages per-tenant instances on whatever you already run: Docker, Kubernetes, ECS or Fly. Rolling, blue-green and canary strategies, health checks over HTTP, TCP, gRPC or a command, custom domains and certificates, per-tenant quotas, and an audit trail of every action.

## Install

```bash
go get github.com/xraph/ctrlplane
```

## What it is

Ctrl Plane deploys and manages SaaS instances at scale. You bring a cloud provider and an auth system; it handles instance lifecycle, deployments, health monitoring, secrets, traffic routing and tenant isolation.

It is a library rather than a framework: Go packages configured with functional options and embedded in your own application, standalone or as a Forge extension.

## What it does

- Provisions tenant instances across any provider: Docker, Kubernetes, AWS ECS, Fly.io.
- Deploys with rolling, blue-green, canary or recreate strategies.
- Runs HTTP, TCP, gRPC and command-based health checks.
- Manages custom domains, TLS certificates and traffic routing.
- Stores secrets behind a pluggable vault backend.
- Publishes lifecycle events and delivers webhooks.
- Collects metrics, logs, traces and resource snapshots.
- Enforces per-tenant quotas and records an audit trail.

## Where it came from

Every multi-tenant product I have built eventually grew a home-made version of this: a table of instances, a deploy script, a health poller, and a page in the internal admin. Ctrl Plane is that, extracted and made provider-agnostic before it grew a fifth incompatible implementation.

---

*Unpublished draft. Not peer reviewed and not submitted to a venue.*


## Anatomy

- **Instances**: Lifecycle of a tenant’s running instance, start to teardown.
- **Placement**: Where an instance runs and what it is allowed to reach.
- **State**: Desired versus observed, reconciled continuously.

## Constraints and trade-offs

- (decision) Reconciliation, not orchestration. Declare the desired state and let the loop converge.