k8s
Star
Fork
Watch
183 1 0
Files
apps
bootstrap
clusters
docs
platform
talos
.gitignore
.sops.yaml
flake.lock
flake.nix
README.md
README.md

k8s #

Declarative configuration for the single-node hetzner-seed cluster.

Deployment contract: the public Tangled repository https://tangled.org/kaij.party/k8s, branch main, is the source for Flux. Accepted pushes to main are deployment requests. Flux polls Git; no webhook or Git write credential is required in the cluster.

Ownership #

  • Flux reconciles its own pinned installation, Git synchronization, and the platform/application Kustomizations.
  • Flux Helm controllers reconcile Cilium, cert-manager, Longhorn, PGO and Harbor from their declared Helm inputs.
  • Direct configuration covers Gateway API, snapshot support, storage policy, Certificates, the production issuer and gang5.
  • Helm, PGO, cert-manager, Cilium and Longhorn own their generated children. Do not export generated Secrets, status or runtime volume identities into Git.
  • Talos, initial CNI/Flux installation, the SOPS identity and disaster-recovery data are explicit bootstrap boundaries. See bootstrap.

The initial Git adoption is staged through suspended child Kustomizations. Do not interpret a successful source fetch or root reconciliation as proof that every child is active. Verify each child inventory, revision and Ready condition. The final operational state requires all intended children enabled and Ready.

Public routing #

One public IP and shared Cilium Gateway serve the applications. The Gateway keeps a generic HTTP listener; app-owned ListenerSet resources hold HTTPS hostnames and local TLS Secret references. Explicit app Certificate resources remain managed by cert-manager. Namespace-name allowlists control listener delegation and shared HTTP route attachment.

See Gateway ownership and routing for the app owners, HTTP-01 path and staged-change safeguards.

Layout #

  • clusters/hetzner-seed/: source/root sync and ordered Flux reconciliation definitions.
  • platform/flux-system/: exact minimal four-controller Flux installation.
  • platform/: Gateway API, Cilium, cert-manager, snapshots, Longhorn and PGO.
  • apps/harbor/: chart inputs, five retained PVCs, external values, Certificate and routing.
  • apps/gang5/: PostgresCluster, workload, proxy, external inputs, Certificate and routing.
  • talos/: machine policy, encrypted site inputs and Factory schematic.
  • .sops.yaml: public age-recipient and encryption policy.
  • flake.nix, flake.lock: pinned Linux/WSL operator environment.

Secrets and public disclosure #

Authored credentials are SOPS/age ciphertext. The four external application inputs retain their existing stable names and values. ACME contact and host-specific Talos bootstrap details are also encrypted. The private age identity is recovered out of band; it is never committed. See secrets and deployment.

Public Git still reveals application names, service hostnames, software versions, resource structure and encrypted-value change history. SOPS protects values, not the trustworthiness of manifests. Anyone who can push accepted changes to main can affect this cluster. Protect the forge account and review changes before pushing.

Verification #

Use the pinned environment with nix develop. Ordinary kubectl kustomize can inspect the structure of a leaf, but does not decrypt SOPS. Never directly apply an encrypted app or issuer render with kubectl.

With an explicit private kubeconfig:

kubectl --kubeconfig "$KUBECONFIG" -n flux-system get gitrepositories,kustomizations
kubectl --kubeconfig "$KUBECONFIG" get helmreleases -A

Verify the observed Git revision, every Kustomization's Ready condition/inventory, and the relevant controller/application health. No force-conflicts, reinstall, restore replay or password rotation is part of ordinary adoption.

Retention and limits #

Pruning is deliberately disabled. Git updates and creates declared configuration; removing a file is not a resource/data retirement operation. Review extra live objects against inventory and use an explicit retirement plan. Never casually prune Namespaces, CRDs, PVCs, PostgresClusters or storage resources.

This is one host, not HA. Two Longhorn replicas on separate local SSDs protect against one disk failure, not host/site loss. Local pgBackRest is not an off-node database backup. Persistent data and generated credentials need separate recovery backups. Database least-privilege hardening, SSO, other applications and broader backup work are outside this configuration transition.

Pins #

Talos 1.14.1; Kubernetes 1.37.0; Flux 2.9.5; Cilium 1.20.2; Gateway API standard CRDs 1.6.1; cert-manager 1.21.2; Longhorn 1.12.1; snapshot controller 8.6.0; PGO 6.0.0/PostgreSQL 17.7; Harbor chart 1.18.1/application 2.14.1. Application and snapshot images are digest-pinned in source.