network

networking is split by job. the kubernetes proof host uses dual linux bridges for management/cluster traffic and data/backup traffic. in-cluster traffic rides cilium. remote access prefers tunnels over opening the lab to the internet. broader house wifi segmentation remains a separate concern from this cluster’s implemented path.

proof-host fabric

on the proxmox kubernetes host, phase-1 design uses two physical nics bridged without vlans — one path for management and cluster vms, one path for data and backup traffic — keep it debuggable at homelab scale.

—dual linux bridges
—management + kubernetes vm traffic
—data / backup traffic
—10gbe ports reserved for a later dedicated path

cluster networking

pods and services use cilium’s overlay. metallb publishes load-balancer ips on the lan for ingress and platform services. internal dns gives lan-friendly names alongside public tunnel hostnames.

—cilium overlay
—metallb lan services
—internal coredns
—api vip

remote access posture

cloudflare tunnel is the primary way to reach selected services remotely — no inbound port-forward habit. overlay vpn patterns remain available when a full private path is the better fit.

—cloudflare tunnel
—tailscale-style overlays when needed

house network (separate track)

ubiquiti unifi gear and vlan segmentation are part of the wider home network goals — trusted clients, iot, and lab isolation — but they are not required to explain how the kubernetes proof cluster works today.

—unifi routing / wifi
—future vlan trust domains

← back to homelab·ai lab →