# K8sHost

`k8shost` is UltraCloud's tenant workload control plane. The supported surface is `k8shost-server`, which exposes node, pod, deployment, and service APIs and then projects tenant networking and publication into `prismnet`, `flashdns`, and `fiberlb`.

## Supported scope

- tenant pod, deployment, and service lifecycle APIs
- bounded `WatchPods` snapshot streams for the current matching pod set
- tenant-aware auth integration through IAM
- service publication through `prismnet`, `flashdns`, and `fiberlb`
- VM-cluster coverage through `fresh-smoke` and `fresh-matrix`
- API/control-plane product surface only; runtime dataplane helpers stay archived non-product

## Archived Non-Product Scaffolds

- `k8shost-cni`
- `k8shost-controllers`
- `lightningstor-csi`

Those binaries stay in-tree as internal integration scaffolds. They are excluded from the default workspace members, they are not wired into canonical profiles, they are not started by the publishable suites, and they should not be presented as productized entrypoints until they have their own documented contract and coverage.