Technologies are generally described for establishing secure communications to manage components of a control system. In some examples, upon receiving a request from a component to join a cluster of components, a class and instance of the component may be verified to authorize the component. A command to be transmitted from the component to another component of the cluster may be marked with a signature, where restrictions may be placed on a type of command that a particular class of component may transmit to one or more other classes of components. Based on the signature, a secure communication path between the components may be established by creating an encrypted virtual private network (VPN). The command may then be transmitted from the component to the other component through the secure communication path.