docs: reconcile docs/comments with post-upgrade cluster state
Text-only cleanup after the upgrade campaign. Updates stale version strings, prose, and comments to the verified current facts; no Kubernetes behavior or version pins changed except the kubectl toolchain bump (below). Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie, Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB, dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18, Grafana 13.2.0. - Version strings across infra/ and platform/ READMEs + comments - kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew) - Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh) - COMPLETED/historical banners on the three executed plan docs - Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges - Appended dated DECISIONS-LOG entry (2026-08-30) superseding the 2026-08-26 LIVE STATE line Left as revalidation items (not blind-edited): external-snapshotter v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1, conformance ImageVolume feature-gate assertions under 1.36. Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed
1 parent
dbd73f1f88
commit
cbc2301b30
25 files changed
+100
-43
No files matched your search
@@ -1150,3 +1150,27 @@ gitignored (agent worktrees were tripping the lint stage's untracked-file scan).
|
||||
Plex uses `/config` → Plex writes the ephemeral layer, is unclaimed, loses config on restart
|
||||
(seerr↔plex connectivity is actually fine — 200 on `/identity`). FIX PENDING operator go (resets
|
||||
Plex, needs re-claim): mount PVC at `/config` + wire `PLEX_CLAIM`.
|
||||
|
||||
---
|
||||
|
||||
## 2026-08-30 — Upgrade campaign landed: cluster now k3s v1.36.4 / Debian 13 / Cilium 1.20.1 / Longhorn 1.12.1
|
||||
|
||||
The platform-wide upgrade campaign completed and is live. Verified current state of the dev cluster:
|
||||
|
||||
- **k3s v1.36.4+k3s1** (was v1.31.5+k3s1), 3-server embedded-etcd HA.
|
||||
- **Debian 13 (trixie)** node OS (was Debian 12 bookworm).
|
||||
- **Cilium 1.20.1** (was 1.16.5); **Gateway API v1.6.1** (was v1.2.x).
|
||||
- **Longhorn 1.12.1** (was 1.7.3).
|
||||
- cert-manager >=1.21; Velero chart 12.x / Velero v1.18; kube-prometheus-stack 88 (operator
|
||||
v0.93.1, Grafana 13.2.0); kube-vip v1.2.3.
|
||||
- Node RAM **24 GiB / 24576 MB** (tofu default; earlier docs said 16 GiB).
|
||||
- Each node now carries a **dedicated virtio2 SSD etcd disk** (`/dev/vdc`, `local-zfs`) isolating
|
||||
etcd WAL fsync from HDD Longhorn I/O — see `docs/plans/ssd-etcd-isolation.md`.
|
||||
|
||||
**The "LIVE STATE VERIFIED 2026-08-26" line above (k3s v1.31.5) is SUPERSEDED by this entry.**
|
||||
That older line is retained as historical record — this append is the current source of truth.
|
||||
Documentation and comments across the repo were reconciled to these facts in the same change;
|
||||
toolchain kubectl bumped 1.31.4 → 1.36.4 (the 1.31 pin exceeded the ±1 version skew against a 1.36
|
||||
cluster). Revalidation items deliberately left open: external-snapshotter v8.2.0 pin vs 1.36, the
|
||||
Cilium ext_authz/forward-auth workaround relevance under 1.20.1, and the conformance ImageVolume
|
||||
feature-gate assertions under 1.36.
|
||||
@@ -13,14 +13,16 @@ Spec: [ADR-0004 (Flux)](../../../home-network-k3s/decisions/adr-0004-gitops-flux
|
||||
|---|---|
|
||||
| `bootstrap.sh` | **The single bootstrap entrypoint** the Infra worker's final Ansible play calls. `flux install` → verify `sops-age` Secret → `kubectl apply -k clusters/dev`. |
|
||||
| `patches/platform-sops-decryption.yaml` | Strategic-merge patch enabling `decryption.provider: sops` + `secretRef: sops-age` on the `platform` Kustomization (realises the base TODO). |
|
||||
| `patches/apps-sops-decryption.yaml` | Same, for the `apps` Kustomization. |
|
||||
| `patches/apps-sops-decryption.yaml` | Same, for the app-wave Kustomizations. There is **no single `apps` Kustomization** any more — the apps tier is now `apps-wave-0/1/2` + `apps-vms`, and SOPS decryption is layered on **per wave** (each wave Kustomization is patched by name in `clusters/dev`). |
|
||||
| `patches/flux-system-source-url.yaml` | Overrides the `flux-system` GitRepository `url` placeholder with the real bootstrap source (template — fill at bootstrap). |
|
||||
|
||||
## Why `flux install` + apply, not `flux bootstrap git` (Phase 1)
|
||||
|
||||
The reconciliation graph is **already authored** in `clusters/base` (read-only to this worker):
|
||||
`flux-system.yaml` is the `flux-system` **GitRepository**; `platform.yaml`/`apps.yaml` are the Flux
|
||||
**Kustomizations**; `clusters/dev` is the overlay that patches `cluster-vars` (R-ENV-02).
|
||||
`flux-system.yaml` is the `flux-system` **GitRepository**; `platform.yaml`, `platform-config.yaml`
|
||||
and the app-wave Kustomizations (`apps-wave-0/1/2.yaml` + `apps-vms.yaml` — the single `apps.yaml`
|
||||
was retired) are the Flux **Kustomizations**; `clusters/dev` is the overlay that patches
|
||||
`cluster-vars` (R-ENV-02) and layers SOPS decryption onto each Kustomization by name.
|
||||
|
||||
`flux bootstrap git` **generates and owns its own** `gotk-sync` GitRepository + Kustomization named
|
||||
`flux-system` and commits them into the repo — which would **duplicate/conflict** with the authored
|
||||
@@ -41,8 +43,9 @@ tofu apply → cloud-init → Ansible (k3s + Cilium) [Infra worker, T-1
|
||||
3. bootstrap/flux/bootstrap.sh # flux install → verify sops-age → apply -k clusters/dev
|
||||
│
|
||||
▼
|
||||
Flux reconciles: GitRepository(flux-system) → Kustomization(platform) → Kustomization(apps),
|
||||
with SOPS decryption enabled (patches/) and cluster-vars overlay (R-ENV-02).
|
||||
Flux reconciles: GitRepository(flux-system) → Kustomization(platform) → Kustomization(platform-config)
|
||||
→ Kustomization(apps-wave-0 → apps-wave-1 → apps-wave-2) + Kustomization(apps-vms),
|
||||
with per-Kustomization SOPS decryption enabled (patches/) and cluster-vars overlay (R-ENV-02).
|
||||
```
|
||||
|
||||
## Interface note — for the Infra worker (T-1.3 Ansible)
|
||||
@@ -72,7 +75,8 @@ patches:
|
||||
- path: ../../bootstrap/flux/patches/apps-sops-decryption.yaml # SOPS on apps
|
||||
```
|
||||
|
||||
Alternatively the base TODOs in `clusters/base/{platform,apps}.yaml` and the `url` in
|
||||
Alternatively the base TODOs in `clusters/base/platform.yaml` and each app-wave Kustomization
|
||||
(`apps-wave-0/1/2.yaml`, `apps-vms.yaml`) and the `url` in
|
||||
`clusters/base/flux-system.yaml` can be filled in directly (same effect) — the clusters owner's call.
|
||||
Either way the `sops-age` `secretRef` name and `flux-system` source name are kept in lockstep with
|
||||
the authored base.
|
||||
|
||||
@@ -25,7 +25,9 @@
|
||||
# We do NOT use `flux bootstrap git` in Phase 1 because that command commits
|
||||
# and OWNS its own gotk-sync GitRepository+Kustomization named `flux-system`.
|
||||
# Our entrypoints are ALREADY authored in clusters/base (flux-system.yaml =
|
||||
# the GitRepository; platform.yaml/apps.yaml = the Kustomizations). Letting
|
||||
# the GitRepository; platform.yaml + platform-config.yaml + the app-wave
|
||||
# Kustomizations apps-wave-0/1/2.yaml + apps-vms.yaml = the Kustomizations;
|
||||
# the single apps.yaml was retired). Letting
|
||||
# bootstrap regenerate them would DUPLICATE/conflict. `flux install` +
|
||||
# applying the authored clusters/dev overlay is the reconciling path.
|
||||
# 2. sops-age Secret — the operator installs the age PRIVATE key out-of-band BEFORE reconcile so
|
||||
@@ -33,8 +35,9 @@
|
||||
# only VERIFIES it exists; it never handles key material.
|
||||
# 3. `kubectl apply -k clusters/dev` — materialises the authored reconciliation graph:
|
||||
# GitRepository `flux-system` (source) -> Kustomization `platform` ->
|
||||
# Kustomization `apps` (dependsOn platform), with cluster-vars overlay
|
||||
# (R-ENV-02) and SOPS decryption enabled via the patches in ./patches/.
|
||||
# `platform-config` -> the app-wave Kustomizations `apps-wave-0/1/2`
|
||||
# (chained dependsOn) + `apps-vms`, with cluster-vars overlay
|
||||
# (R-ENV-02) and per-Kustomization SOPS decryption enabled via ./patches/.
|
||||
#
|
||||
# PREREQUISITES the operator/PM resolves before this runs (see ../README.md "Handoff"):
|
||||
# - clusters/base/flux-system.yaml url placeholder is overridden — wire ./patches/flux-system-
|
||||
|
||||
+1
-1
@@ -10,7 +10,7 @@ policy, egress, TLS, DNS, monitoring, and update policy from it (see
|
||||
[`docs/13-service-catalog.md`](../../home-network-k3s/docs/13-service-catalog.md) (14-service table +
|
||||
SSO/egress/dependency intent).
|
||||
|
||||
## Current examples (Phase 0)
|
||||
## Current examples
|
||||
| File | docs/13 row | exposure | egress | auth | Notes |
|
||||
|---|---|---|---|---|---|
|
||||
| `pihole.yaml` | 6 | internal | internet | forward-auth | admin UI behind oauth2-proxy; config on Longhorn (DR-critical); also platform DNS |
|
||||
|
||||
+1
-1
@@ -464,7 +464,7 @@ def r_gateway_ingress_policy(s: dict):
|
||||
north-south). This CiliumNetworkPolicy is the ADDITIVE, least-privilege allow that opens
|
||||
ONLY the north-south path (docs/09 "Ingress opens north-south only — it does not relax
|
||||
east-west default-deny"): ingress from Cilium's reserved `ingress` identity (the Gateway/
|
||||
Ingress Envoy proxy, `reserved:ingress`, numeric identity 8 in Cilium 1.16.5) to ONLY the
|
||||
Ingress Envoy proxy, `reserved:ingress`, numeric identity 8 in Cilium 1.20.1) to ONLY the
|
||||
exposed service port(s). Everything else stays denied; undeclared ports stay denied.
|
||||
|
||||
Verified empirically against the cluster: with default-deny in place, Hubble shows the
|
||||
|
||||
+1
-1
@@ -18,7 +18,7 @@ CHAINSAW_VERSION="0.2.12"
|
||||
|
||||
# Lint / manifest tooling
|
||||
YAMLLINT_VERSION="1.35.1"
|
||||
KUBECTL_VERSION="1.31.4"
|
||||
KUBECTL_VERSION="1.36.4"
|
||||
YQ_VERSION="4.44.6"
|
||||
|
||||
# ServiceDefinition JSON-Schema validation (schemas/validate.sh). Pip-installed;
|
||||
|
||||
+3
-2
@@ -29,8 +29,9 @@ clusters/
|
||||
|
||||
## How the overlay model satisfies R-ENV-02
|
||||
|
||||
The base authors the reconciliation graph **once**. `platform.yaml` and `apps.yaml` (Flux
|
||||
`Kustomization`s) both declare `postBuild.substituteFrom` the `cluster-vars` ConfigMap. Platform and
|
||||
The base authors the reconciliation graph **once**. `platform.yaml` and the app-wave Kustomizations
|
||||
(`apps-wave-0/1/2.yaml` — the single `apps.yaml` was retired; `apps-vms.yaml` deliberately omits it,
|
||||
see below) declare `postBuild.substituteFrom` the `cluster-vars` ConfigMap. Platform and
|
||||
app manifests use `${TOKEN}` placeholders for every value that legitimately differs between
|
||||
environments (issuer, replica counts, storage sizes, retention, node placement).
|
||||
|
||||
|
||||
@@ -9,7 +9,7 @@ CHAINSAW_VERSION="v0.2.12"
|
||||
CHAINSAW_IMAGE="ghcr.io/kyverno/chainsaw:v0.2.12"
|
||||
|
||||
# kubectl — used by run.sh for cluster reachability preflight and by probe scripts.
|
||||
KUBECTL_VERSION="v1.31.4"
|
||||
KUBECTL_VERSION="v1.36.4"
|
||||
|
||||
# Kyverno CLI — L0 static/policy gate (owned by T-0.5, referenced here for a single
|
||||
# pinned toolchain view). Not invoked by run.sh yet.
|
||||
|
||||
@@ -1,5 +1,12 @@
|
||||
# Cluster upgrade plan — k3s 1.31.5 → 1.36.x + node OS (dev cluster)
|
||||
|
||||
> ## ✅ COMPLETED / historical — executed 2026-08-30, see git log
|
||||
>
|
||||
> **This plan has been carried out.** The dev cluster now runs **k3s v1.36.4+k3s1** on **Debian 13
|
||||
> (trixie)** with Cilium 1.20.1 and Longhorn 1.12.1. The steps, gates, and rollbacks below are
|
||||
> retained as the record of how the upgrade was performed — do NOT re-execute them against the live
|
||||
> cluster. Current state is tracked in `infra/PHASE1-STATUS.md` and the 2026-08-30 DECISIONS-LOG entry.
|
||||
|
||||
**Scope:** the `home-network-k3s-impl` **dev** cluster (`k3s-dev-1/2/3` @ 192.168.1.50-52), 3× HA
|
||||
embedded-etcd servers behind a kube-vip VIP, Debian 12 bookworm. Upgrade Kubernetes/k3s from
|
||||
**v1.31.5+k3s1 → v1.36.x+k3s1** (five minors) and the node OS (Debian 12 → 13), with an
|
||||
|
||||
@@ -1,5 +1,12 @@
|
||||
# Phase 2 execution runbook — SSD-backed etcd migration (interactive/manual)
|
||||
|
||||
> ## ✅ COMPLETED / historical — executed 2026-08-30, see git log
|
||||
>
|
||||
> **This runbook has been executed.** Every k3s node's etcd now lives on its dedicated SSD `virtio2`
|
||||
> disk. The command sequence below is retained as the record of how the migration was performed — do
|
||||
> NOT re-run it against the live cluster. Current state is tracked in `infra/PHASE1-STATUS.md` and the
|
||||
> 2026-08-30 DECISIONS-LOG entry.
|
||||
|
||||
Companion to `ssd-etcd-isolation.md`. This is the **exact command sequence** to migrate
|
||||
each k3s node's etcd onto its dedicated SSD `virtio2` disk. It must be run where live-infra
|
||||
mutations are permitted — an **interactive `claude` session** (default permission mode, which
|
||||
|
||||
@@ -1,5 +1,12 @@
|
||||
# SSD-backed etcd isolation for the k3s dev cluster
|
||||
|
||||
> ## ✅ COMPLETED / historical — executed 2026-08-30, see git log
|
||||
>
|
||||
> **This proposal was approved and carried out.** Each node now has a dedicated `virtio2` SSD etcd
|
||||
> disk (`/dev/vdc`, `local-zfs`) hosting the etcd data dir. The **Status: PROPOSAL** line below and
|
||||
> the sizing/RAM figures are the original investigation record — retained for the reasoning, not as a
|
||||
> live to-do. Current state is tracked in `infra/PHASE1-STATUS.md` and the 2026-08-30 DECISIONS-LOG entry.
|
||||
|
||||
**Status:** PROPOSAL — awaiting user approval. No changes have been made.
|
||||
**Author:** investigation agent (read-only), 2026-08-29
|
||||
**Problem:** Longhorn replica-rebuild I/O storms on the HDD-backed VM disks starve
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Dev cluster — current state & reconnect guide
|
||||
|
||||
**Last verified: 2026-08-26.** Phase 1 is **complete and long since exited**; the cluster has been
|
||||
**Last verified: 2026-08-30.** Phase 1 is **complete and long since exited**; the cluster has been
|
||||
running the full platform (phases 2–6) for some time. This doc is how a session — human or agent —
|
||||
reconnects to it and re-establishes the toolchain.
|
||||
|
||||
@@ -15,12 +15,12 @@ reconnects to it and re-establishes the toolchain.
|
||||
| | |
|
||||
|---|---|
|
||||
| Substrate | Proxmox VE host, node `proxmox`, disks on the `Storage` ZFS datastore, bridge `vmbr0` |
|
||||
| Nodes | `k3s-dev-1/2/3` at `192.168.1.50 / .51 / .52` — 6 vCPU, 16 GiB, Debian 12 (bookworm) |
|
||||
| k3s | **v1.31.5+k3s1**, 3 servers, embedded etcd (HA); no flannel / kube-proxy / Traefik |
|
||||
| CNI | Cilium 1.16.5 (kube-proxy replacement, L2 announcements, egress gateway) |
|
||||
| Nodes | `k3s-dev-1/2/3` at `192.168.1.50 / .51 / .52` — 6 vCPU, 24 GiB, Debian 13 (trixie) |
|
||||
| k3s | **v1.36.4+k3s1**, 3 servers, embedded etcd (HA); no flannel / kube-proxy / Traefik |
|
||||
| CNI | Cilium 1.20.1 (kube-proxy replacement, L2 announcements, egress gateway) |
|
||||
| kube-API | kube-vip VIP **`192.168.1.49:6443`**, tls-san'd on the serving cert |
|
||||
| Ingress VIP | **`192.168.1.53`** (shared Gateway). Pool `192.168.1.53–.60` for LB VIPs; UniFi holds `.54` |
|
||||
| Storage | Longhorn 1.7.3 — classes `longhorn` (default), `longhorn-static`, `longhorn-vm` (RWX/Block, migratable), `longhorn-scratch`. `bulk` (NFS CSI) is a **non-provisioning stub** pending OQ-2 |
|
||||
| Storage | Longhorn 1.12.1 — classes `longhorn` (default), `longhorn-static`, `longhorn-vm` (RWX/Block, migratable), `longhorn-scratch`. `bulk` (NFS CSI) is a **non-provisioning stub** pending OQ-2 |
|
||||
| Nested virt | `cpu_type = host` → real KVM in-guest; KubeVirt + CDI run on it |
|
||||
|
||||
Everything above is provisioned by IaC: [`tofu/`](tofu/) creates the VMs,
|
||||
|
||||
+1
-1
@@ -20,7 +20,7 @@ Proxmox LAN and are reached across a pfSense NAT:
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| Nodes | `k3s-dev-1/2/3` at `192.168.1.50/.51/.52` — 6 vCPU, 16 GiB, Debian 12, k3s v1.31.5 |
|
||||
| Nodes | `k3s-dev-1/2/3` at `192.168.1.50/.51/.52` — 6 vCPU, 24 GiB, Debian 13, k3s v1.36.4 |
|
||||
| kube-API | kube-vip VIP `192.168.1.49:6443`, reached from the workstation via NAT `192.168.2.50:6443` |
|
||||
| Node SSH | pfSense NAT `192.168.2.102:2250/2251/2252` → node `:22` (Ansible only) |
|
||||
| Ingress VIP | `192.168.1.53` (Cilium L2, shared Gateway); `.53–.60` reserved for LB VIPs |
|
||||
|
||||
@@ -4,14 +4,15 @@
|
||||
# HelmRelease adopts config afterward. The parity-critical values
|
||||
# (kubeProxyReplacement, k8sServiceHost/Port) are templated from k3s_api_host.
|
||||
|
||||
# Pin inside the platform/cilium HelmRelease window (>=1.16.0 <1.17.0).
|
||||
# Exact pin — MUST equal the platform/cilium HelmRelease chart.spec.version (1.20.1, an
|
||||
# exact pin, not a range). Renovate bumps both together.
|
||||
cilium_version: "1.20.1"
|
||||
cilium_chart_repo_name: "cilium"
|
||||
cilium_chart_repo_url: "https://helm.cilium.io/"
|
||||
cilium_namespace: "kube-system"
|
||||
|
||||
# Gateway API CRDs (standard channel) must exist BEFORE Cilium with gatewayAPI.enabled.
|
||||
# Cilium 1.16 targets Gateway API v1.2.x.
|
||||
# Cilium 1.20.1 targets Gateway API v1.6.1.
|
||||
gateway_api_version: "v1.6.1"
|
||||
gateway_api_crd_urls:
|
||||
- "https://github.com/kubernetes-sigs/gateway-api/releases/download/{{ gateway_api_version }}/standard-install.yaml"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
# k3s_server role defaults (ADR-0001).
|
||||
|
||||
# Best-effort version pin (kept near the ci/versions kubectl 1.31.x line). Bump
|
||||
# Best-effort version pin (kept near the ci/versions kubectl 1.36.x line). Bump
|
||||
# deliberately — a version change is a code change. Empty string => latest stable.
|
||||
k3s_version: "v1.36.4+k3s1"
|
||||
|
||||
|
||||
@@ -11,8 +11,8 @@ OPENTOFU_VERSION=1.9.0
|
||||
AGE_VERSION=1.2.1
|
||||
SOPS_VERSION=3.9.4
|
||||
FLUX_VERSION=2.4.0
|
||||
# Aligned with ci/versions.env (KUBECTL=1.31.4) and the k3s 1.31.5 cluster.
|
||||
KUBECTL_VERSION=1.31.4
|
||||
# Aligned with ci/versions.env (KUBECTL=1.36.4) and the k3s 1.36.4 cluster.
|
||||
KUBECTL_VERSION=1.36.4
|
||||
HELM_VERSION=3.16.0
|
||||
|
||||
# --- Conformance test toolchain (match ci/versions.env) ----------------------
|
||||
|
||||
@@ -5,7 +5,7 @@ Provisions the "Create" lifecycle stage (docs/02): 3 cloud-init'd VMs on the
|
||||
(Migrated from the old memory-constrained libvirt host; provider is now `bpg/proxmox`.)
|
||||
|
||||
**APPLIED AND LIVE.** These three VMs are the running dev cluster — `k3s-dev-1/2/3`, k3s
|
||||
v1.31.5, carrying the whole platform. Treat any `tofu apply/destroy` here as an operation on
|
||||
v1.36.4, carrying the whole platform. Treat any `tofu apply/destroy` here as an operation on
|
||||
production-for-dev, and note the state file caveat below.
|
||||
|
||||
Serves **R-ENV-01/02**, **R-PLAT-01**, ADR-0001 (k3s substrate).
|
||||
@@ -19,9 +19,10 @@ Serves **R-ENV-01/02**, **R-PLAT-01**, ADR-0001 (k3s substrate).
|
||||
| Image/snippet datastore | `local` (dir; content = iso + **snippets**) |
|
||||
| Bridge | `vmbr0` (no VLAN) |
|
||||
| Nodes | `k3s-dev-1/2/3` at `192.168.1.50/.51/.52`, gw `192.168.1.1`, DNS `192.168.1.18` |
|
||||
| Per node | 6 vCPU, 16 GiB RAM, **cpu type `host`** (nested virt for KubeVirt — real KVM confirmed in-guest) |
|
||||
| OS disk | **64 GiB**, virtio0 (`/dev/vda`, boot), imported from the Debian 12 cloud image |
|
||||
| Per node | 6 vCPU, 24 GiB RAM, **cpu type `host`** (nested virt for KubeVirt — real KVM confirmed in-guest) |
|
||||
| OS disk | **64 GiB**, virtio0 (`/dev/vda`, boot), imported from the Debian 13 cloud image |
|
||||
| Data disk | **128 GiB**, virtio1 (`/dev/vdb`) → `/var/lib/longhorn` (mounted by cloud-init; Longhorn reports ~125 GiB usable per node) |
|
||||
| etcd disk | **16 GiB SSD**, virtio2 (`/dev/vdc`) on the `local-zfs` SSD datastore → etcd data dir (`/var/lib/rancher/k3s/server/db`); isolates etcd WAL fsync from the HDD Longhorn I/O (docs/plans/ssd-etcd-isolation.md) |
|
||||
| Cloud-init | native `initialization` (static IP + DNS) + user-data **snippet** for the baseline |
|
||||
| Reserved | `192.168.1.53–.60` for Cilium L2 ingress VIPs (surfaced in outputs). In use: `.53` shared Gateway, `.54` UniFi |
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ spec:
|
||||
chart:
|
||||
spec:
|
||||
chart: cert-manager
|
||||
version: ">=1.21.0 <1.22.0" # TODO(WS-SEC): pin at bring-up; Renovate maintains
|
||||
version: ">=1.21.0 <1.22.0" # Renovate-maintained range (bring-up is past; team uses ranges, not exact pins)
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: jetstack
|
||||
|
||||
@@ -6,9 +6,9 @@
|
||||
#
|
||||
# SOURCE OF TRUTH (all [parity] fields MUST equal these):
|
||||
# infra/ansible/roles/cilium/templates/cilium-values.yaml.j2
|
||||
# infra/ansible/roles/cilium/defaults/main.yml (cilium_version: 1.16.5, k3s_api_host/port)
|
||||
# infra/ansible/roles/cilium/defaults/main.yml (cilium_version: 1.20.1, k3s_api_host/port)
|
||||
#
|
||||
# chart version (helmrelease.yaml chart.spec.version): 1.16.5 # [parity] = cilium_version
|
||||
# chart version (helmrelease.yaml chart.spec.version): 1.20.1 # [parity] = cilium_version
|
||||
|
||||
# [parity] k3s kube-proxy disabled → Cilium replaces it (ADR-0001/0002)
|
||||
kubeProxyReplacement: true
|
||||
|
||||
@@ -13,7 +13,7 @@ spec:
|
||||
chart:
|
||||
spec:
|
||||
chart: cloudnative-pg
|
||||
version: ">=0.22.0 <1.0.0" # TODO(WS-SEC): pin at bring-up; Renovate maintains
|
||||
version: ">=0.22.0 <1.0.0" # Renovate-maintained range (bring-up is past; team uses ranges, not exact pins)
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: cloudnative-pg
|
||||
|
||||
@@ -26,6 +26,7 @@ Neither k3s nor the Longhorn chart ships this. It is a prerequisite for:
|
||||
## Version
|
||||
|
||||
Pinned to **v8.2.0** (Renovate-maintained). The v8.x line aligned to Kubernetes 1.31 at
|
||||
v8.1.0; this cluster is k3s v1.31.5. The snapshot-controller image is re-pinned to the same
|
||||
tag via the kustomization `images` transformer (the upstream setup manifest lags on the image
|
||||
tag).
|
||||
v8.1.0; this cluster is now k3s v1.36.4, so the pin should be **re-checked for 1.36** (a newer
|
||||
external-snapshotter line may be the version-matched choice) — do not treat v8.2.0 as verified
|
||||
against 1.36 yet. The snapshot-controller image is re-pinned to the same tag via the kustomization
|
||||
`images` transformer (the upstream setup manifest lags on the image tag).
|
||||
@@ -18,9 +18,10 @@
|
||||
# CRDs (the Longhorn VolumeSnapshotClass, item 2) live in platform-config so the CRDs exist first.
|
||||
#
|
||||
# VERSION (Renovate-maintained): external-snapshotter v8.2.0.
|
||||
# * The v8.x line updated its Kubernetes deps to 1.31 at v8.1.0 (this cluster is k3s v1.31.5),
|
||||
# so v8.2.x is the conservative, version-matched choice — newer than the 1.31 alignment,
|
||||
# older than the v8.4/v8.5 churn.
|
||||
# * The v8.x line updated its Kubernetes deps to 1.31 at v8.1.0. This cluster is now k3s v1.36.4,
|
||||
# so the v8.2.0 pin is NO LONGER verified against the running Kubernetes version — RE-CHECK it
|
||||
# for 1.36 (a newer external-snapshotter line may be the version-matched choice). Pin left as-is
|
||||
# pending that revalidation.
|
||||
# * snapshot.storage.k8s.io CRDs are served at v1 (GA) — driver.longhorn.io speaks v1, so
|
||||
# Longhorn CSI snapshots + CDI snapshot-clone work against these CRDs.
|
||||
# * The upstream setup manifest pins the controller image to an older v8.0.x tag; the `images`
|
||||
|
||||
@@ -63,7 +63,7 @@ media on the replicated tier, or app DBs on the bulk tier.**
|
||||
- **OQ-2 (human):** decide the `bulk`-tier backing (NAS/NFS host + share, vs dedicated large disk).
|
||||
Until answered, the `bulk` class is a non-functional placeholder (`server`/`share` = REPLACE-ME).
|
||||
Blocks `bulk` finalize; does **not** block the core platform (docs/04).
|
||||
- **Version pin (WS-STORAGE):** `>=1.7.0 <1.8.0` is a range; pin exactly at bring-up, Renovate
|
||||
- **Version pin (WS-STORAGE):** `>=1.12.0 <1.13.0` is a range; pin exactly at bring-up, Renovate
|
||||
maintains.
|
||||
- **Phase 4 (WS-STORAGE):** off-cluster backup target via `defaultSettings.backupTarget` +
|
||||
SOPS-encrypted credential secret, wired alongside `platform/velero/` (R-STATE-03).
|
||||
|
||||
@@ -172,9 +172,9 @@ spec:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 256Mi # Grafana 12.x (kps 88) baseline is well above Grafana 11.x (kps 65)
|
||||
memory: 256Mi # Grafana 13.x (image 13.2.0, kps 88) baseline is well above Grafana 11.x (kps 65)
|
||||
limits:
|
||||
memory: 512Mi # 256Mi OOMKilled (exit 137) Grafana 12.x during apiserver/unified-storage
|
||||
memory: 512Mi # 256Mi OOMKilled (exit 137) Grafana 13.x during apiserver/unified-storage
|
||||
# startup — the silent SIGKILL that made the whole 65->88 Helm upgrade
|
||||
# time out (the new Grafana pod never went Ready). 512Mi holds.
|
||||
# --- Keycloak native-OIDC SSO (ADR-0014, deliverable #4 SSO proof) ---
|
||||
|
||||
@@ -9,7 +9,7 @@
|
||||
|
||||
## What this is (LIVE)
|
||||
|
||||
Flux `HelmRelease` (Velero chart 8.x / Velero 1.15.x) wired to the on-Proxmox **MinIO** S3 target:
|
||||
Flux `HelmRelease` (Velero chart 12.x / Velero 1.18.x) wired to the on-Proxmox **MinIO** S3 target:
|
||||
|
||||
- **Endpoint:** `http://192.168.1.9:9000` (plain HTTP, **path-style**, region `us-east-1` placeholder)
|
||||
- **BucketStorageLocation `default`:** provider `aws`, bucket `velero`, `s3ForcePathStyle=true`.
|
||||
|
||||
Reference in new issue
Block a user