kubernetes

why talos

talos fits how i like platforms to behave: immutable infrastructure, declarative machine config, api-driven operations, and a minimal attack surface — no ssh snowflake nodes.

cluster shape

three control-plane and three worker nodes as proxmox vms. after bootstrap, day-2 change is meant to flow through git — not ad-hoc kubectl apply or hypervisor clicks.

• —talos linux
• —kubernetes
• —proxmox-hosted vms
• —api vip for control plane access

gitops operating model

flux continuously reconciles the cluster from git (gitea). infrastructure and apps are layered kustomizations; helm releases deploy controllers; pull-based sync keeps the cluster honest to the repo.

• —flux cd
• —gitea as source of truth
• —kustomize + helmrelease
• —phased reconciliations

networking & ingress

cilium (ebpf) with hubble replaced a simpler cni path; kube-proxy is disabled. metallb advertises load-balancer services on the lan; ingress-nginx terminates north-south traffic. cloudflare tunnel provides remote access without opening inbound firewall ports.

• —cilium + hubble
• —metallb
• —ingress-nginx
• —cloudflare tunnel
• —internal dns for lan hostnames

secrets platform

hashicorp vault holds runtime secrets; external secrets operator syncs them into kubernetes; sops + age covers the minimal bootstrap secrets that must live near git. a vault unsealer removes day-to-day manual unseal toil, with a longer-term path toward transit auto-unseal outside the cluster trust zone.

• —hashicorp vault
• —external secrets operator
• —sops + age (bootstrap)
• —kubernetes auth
• —planned transit auto-unseal

tls automation

cert-manager issues certificates through let's encrypt using dns-01 via cloudflare — automated renewal instead of hand-managed cert files.

• —cert-manager
• —let's encrypt
• —dns-01 automation

storage & backup

longhorn is the default storage class for stateful workloads. velero backs cluster state and volumes up to self-hosted object storage (minio) so recovery is a practiced path, not a hope.

• —longhorn
• —velero
• —minio object storage
• —restore runbooks

observability

kube-prometheus-stack, loki, grafana, and alloy cover metrics and logs. alertmanager routes grouped alerts (including flux-aware rules) to discord so noise can be tuned instead of ignored.

• —prometheus
• —loki
• —grafana
• —grafana alloy
• —alertmanager → discord
• —goldilocks + vpa (recommendations)

security controllers

runtime and policy tooling sits beside the platform: falco, kyverno, and trivy operator, plus cilium network policies where they fit — security as continuous capability, not a one-time harden pass.

• —falco
• —kyverno
• —trivy operator
• —cilium network policies

infrastructure as code

terraform drives proxmox node lifecycle with remote state on self-hosted s3-compatible storage — the same git discipline above the cluster as inside it.

• —terraform
• —proxmox provider
• —remote state on minio

docs as craft

architecture decision records and operational runbooks (including backstage techdocs) are part of the product. if it cannot be explained and recovered, it is not finished.