Control Plane
The Riptides control plane is hosted and operated by Riptides. You do not need to deploy or manage it yourself. Your daemons connect to the hosted control plane, and you manage resources (WorkloadIdentities, Services, CredentialSources, etc.) through it.
An on-premises control plane is also available for organizations that require it. Contact info@riptides.io to discuss your requirements.
Accessing the Control Plane
Section titled “Accessing the Control Plane”Log in to the control plane web UI at your tenant URL using your GitHub credentials.
For programmatic access, use riptides-cli (e.g., riptides-cli ctl apply for Riptides resources) configured with the control plane URL provided after signup.
Architecture
Section titled “Architecture”The hosted control plane exposes three subdomains under your tenant’s base hostname (e.g. 0d4e539f.console.riptides.io), each serving a different protocol:
| Endpoint | Protocol | Description |
|---|---|---|
<base-hostname> | HTTPS | Primary API and UI endpoint for daemons and users |
grpc.<base-hostname> | gRPCS | Information sync and streaming between daemons and the controlplane |
tunnel.<base-hostname> | TLS | Telemetry retrieval from daemons (pull model) |
Trust Domain
Section titled “Trust Domain”Your trust domain is assigned when you register at console.riptides.io. It must match across the control plane and all daemons. This is typically a domain you own (e.g., example.com).
Tunnel Server
Section titled “Tunnel Server”The tunnel server at tunnel.<base-hostname> lets the control plane retrieve telemetry from daemons in a pull model, over a persistent connection the daemon initiates. This applies regardless of whether the daemon is behind NAT.
gRPC Server
Section titled “gRPC Server”The gRPC server at grpc.<base-hostname> handles information sync and streaming between daemons and the control plane, including policy and certificate updates.
Connecting Daemons
Section titled “Connecting Daemons”Daemons authenticate to the hosted control plane using one of the following methods:
- JoinToken: A pre-shared token created in the control plane. Suitable for initial setup and on-premises nodes.
- AWSIID: Automatic attestation using the EC2 instance identity document. No shared secrets needed.
- GCPIIT: Automatic attestation using GCP instance identity tokens.
See the Getting Started guide for a walkthrough of connecting your first daemon, or the daemon deployment guides for Kubernetes and bare metal / VM environments.