Cluster and provisioning
The cluster has three mixed ARM and x86 k3s nodes. Ansible playbooks handle bootstrap, upgrades and teardown, while the descheduler redistributes workloads after node restarts.
Back to the main page
Homelab
This is a homelab. It does not carry a regulated workload or customer SLA. I use it to test upgrades, networking, GitOps, observability and backup routines on infrastructure I can publish.
GitOps delivery, cluster networking, Alloy telemetry and restic backup paths around a three-node k3s cluster.
Delivery
Git repositoryManifests and playbooks
Argo CDReconcile and correct drift
Three-node k3s cluster
Network
Cilium / Gateway APIeBPF, LB IPAM and HTTPRoutes
Cluster servicesLAN, split DNS and Tailscale
Telemetry
Cluster telemetrymetrics, logs, traces
Grafana AlloyDiscovery and routing
PrometheusLokiTempo
Backup
Persistent dataNFS and database dumps
resticScheduled snapshots
Object storageOff-site backup target
Networking
Cilium provides the eBPF datapath and Hubble flow visibility. LB IPAM assigns service addresses and L2 announcements advertise them on the LAN. Applications attach HTTPRoutes to a shared Gateway API gateway, split-horizon DNS resolves internal names, and the Tailscale operator provides remote access.
GitOps
Argo CD uses an app-of-apps setup and discovers Applications from a directory. Kustomize inflates Helm charts so the rendered manifests remain available for review. Automated reconciliation applies changes and corrects drift.
Secrets and identity
Sealed Secrets stores encrypted secrets in Git, with the controller private key backed up separately. Authentik provides OIDC for applications that support it, and cert-manager issues and renews TLS certificates.
Observability
Grafana Alloy routes metrics, logs and traces to Prometheus, Loki and Tempo. Annotations enable discovery for workloads that expose the appropriate endpoints. Grafana dashboards and alerts are managed as custom resources.
Storage and backups
NFS provides separate fast and slow storage tiers. CloudNativePG manages PostgreSQL. Scheduled restic backups go to off-site object storage, and database-backed applications use pre-backup dump hooks.