# Cosmonic > Documentation for Cosmonic Control — secure sandboxed compute for AI workloads on Kubernetes This file contains links to documentation sections following the llmstxt.org standard. ## Table of Contents - [Cosmonic Platform Operator API Reference](https://docs.cosmonic.com/docs/api-reference/k8s.cosmonic.io/): Complete API reference for the Cosmonic Platform Operator CRDs (k8s.cosmonic.io), covering HTTPTrigger, Project, and other Cosmonic Control resources. - [wasmCloud Runtime Operator API Reference](https://docs.cosmonic.com/docs/api-reference/runtime.wasmcloud.dev/): Complete API reference for the wasmCloud Runtime Operator CRDs used by Cosmonic Control, including WasmCloudHostConfig, Application, and related re... - [Architecture](https://docs.cosmonic.com/docs/architecture/): Overview of the Cosmonic Control architecture, including wasmCloud, controllers, operators, custom resources, and the Kubernetes API server. - [Custom Resources](https://docs.cosmonic.com/docs/custom-resources/): Reference guide for Kubernetes custom resources in Cosmonic Control, including Artifacts, Hosts, HTTPTriggers, Workloads, and more. - [Deploy on VMware vSphere Kubernetes Service (VKS)](https://docs.cosmonic.com/docs/deployment-guides/cosmonic-control-on-vmware-vsphere-kubernetes-service/): Step-by-step guide to installing Cosmonic Control on VMware vSphere Kubernetes Service (VKS) with Contour ingress and monitoring. - [FAQ](https://docs.cosmonic.com/docs/faq/): Frequently asked questions about Cosmonic Control, wasmCloud, WebAssembly components, and cloud-native platforms. - [Glossary](https://docs.cosmonic.com/docs/glossary/): Definitions of key terms used in Cosmonic Control, wasmCloud, and the WebAssembly component ecosystem. - [Introduction to Cosmonic](https://docs.cosmonic.com/): How Cosmonic helps platform engineering teams manage ultra-dense sandboxed platforms on Kubernetes with WebAssembly (Wasm) - [Get Started](https://docs.cosmonic.com/docs/install-cosmonic-control/): Install Cosmonic Control on any Kubernetes cluster in minutes. - [CI/CD with GitLab CI](https://docs.cosmonic.com/docs/integrations/gitlab-ci/): Build, sign, attest, and deploy Cosmonic Control workloads from GitLab CI using the cosmonic-labs/ci-components/wash CI/CD Catalog. - [CI/CD and GitOps](https://docs.cosmonic.com/docs/integrations/gitops-with-argo-cd/): Automate Wasm deployments on Cosmonic Control with GitHub Actions and Argo CD. - [How to add WebAssembly components to IDPBuilder](https://docs.cosmonic.com/docs/integrations/idpbuilder/): Deploy Cosmonic Control with IDPBuilder to run a local internal developer platform with WebAssembly components. - [Multitenancy](https://docs.cosmonic.com/docs/multitenancy/): How Cosmonic Control supports multi-tenant deployments with Kubernetes namespace isolation and WebAssembly sandboxing. - [Observability](https://docs.cosmonic.com/docs/observability/): Built-in observability stack in Cosmonic Control with Prometheus metrics, Loki logs, and Tempo distributed traces. - [Air-Gapped Installation](https://docs.cosmonic.com/docs/operations/air-gapped-installation/): Mirror Helm charts and container images to an internal registry for air-gapped Cosmonic Control installations. - [Autoscaling](https://docs.cosmonic.com/docs/operations/autoscaling/): Scale Cosmonic Control HTTPTriggers and WorkloadDeployments with the standard Kubernetes Horizontal Pod Autoscaler or KEDA via the /scale subresource. - [Component Configuration and Secrets](https://docs.cosmonic.com/docs/operations/component-configuration/): Configure Wasm components with inline values, Kubernetes ConfigMaps, Secrets, and network allowlists on Cosmonic Control. - [Production Installation](https://docs.cosmonic.com/docs/operations/deploying-to-cosmonic-control/): Deploy Cosmonic Control to production Kubernetes with Helm. Covers cluster requirements, Helm values, ingress setup, and day-two operations for Was... - [Ingress and Workloads](https://docs.cosmonic.com/docs/operations/ingress-and-workloads/): Configure Envoy ingress and deploy WebAssembly workloads on Cosmonic Control using Kubernetes CRD manifests. - [Tenant RBAC](https://docs.cosmonic.com/docs/operations/tenant-rbac/): Configure multi-tenant RBAC on Cosmonic Control with namespace-scoped Kubernetes Roles and RoleBindings. - [Two-component NATS workloads](https://docs.cosmonic.com/docs/operations/two-component-nats-workloads/): Many real workloads split into two pieces: a thin, fresh-per-request HTTP component that handles the inbound request, and a heavier worker componen... - [Upgrading](https://docs.cosmonic.com/docs/operations/upgrading/): Upgrade Cosmonic Control to the latest version with Helm. - [Capabilities (Capability-Based Security)](https://docs.cosmonic.com/docs/platform-concepts/capabilities/): Capabilities are unforgeable references that name what a Wasm component is allowed to do. - [Platform Concepts](https://docs.cosmonic.com/docs/platform-concepts/): Concept references for the security, isolation, and trust model behind Cosmonic Control, Cosmonic Desktop, and the Cosmonic platform. - [Principle of Least Authority (PoLA)](https://docs.cosmonic.com/docs/platform-concepts/principle-of-least-authority/): Principle of Least Authority (PoLA): what it means, how it differs from least privilege, and how WebAssembly + Cosmonic enforce it by default. - [Security and Non-Deterministic I/O](https://docs.cosmonic.com/docs/platform-concepts/security-under-non-deterministic-io/): AI agent security under non-deterministic I/O: why traditional access control breaks when an LLM generates tool calls, and how capabilities bound r... - [WebAssembly for Platforms](https://docs.cosmonic.com/docs/platform-engineering-with-webassembly/): Discover how platform teams use WebAssembly and Cosmonic Control to cut infrastructure costs, enforce security boundaries, and ship features faster. - [Securely Deploy MCP on Kubernetes](https://docs.cosmonic.com/docs/securely-deploy-mcp-on-kubernetes/): Deploy MCP servers as sandboxed WebAssembly components on Kubernetes with Cosmonic Control for secure agentic AI. - [Blobstore Fileserver (NATS)](https://docs.cosmonic.com/docs/template-catalog/blobstore-fileserver-nats/): Serve files from NATS-backed blob storage using a Rust WebAssembly component on Cosmonic Control. - [Blobstore Operations (NATS)](https://docs.cosmonic.com/docs/template-catalog/blobstore-nats/): Demonstration of blob storage operations via HTTP, implemented as a Wasm component for Cosmonic Control. - [Hono Swagger UI](https://docs.cosmonic.com/docs/template-catalog/hono-swagger-ui/): Interactive API documentation built on the Hono HTTP framework and Swagger UI middleware, deployed as a Wasm component. - [HTTP Server](https://docs.cosmonic.com/docs/template-catalog/http-server/): Deploy a multi-endpoint HTTP server written in Go as a WebAssembly component on Cosmonic Control. - [Template Catalog](https://docs.cosmonic.com/docs/template-catalog/): Browse ready-to-deploy application templates for Cosmonic Control, including HTTP APIs, messaging services, and more. - [Petstore MCP Server (TypeScript)](https://docs.cosmonic.com/docs/template-catalog/mcp-server-ts/): Build a sandboxed MCP server in TypeScript, compiled to a WebAssembly component. Deploy to Cosmonic Control with Helm for secure, isolated AI agent... - [Troubleshooting](https://docs.cosmonic.com/docs/troubleshooting/): Troubleshoot Cosmonic Control deployments by checking wasmCloud host logs and resolving common issues.