Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

docs: reconcile docs/comments with post-upgrade cluster state

Browse Source 
Text-only cleanup after the upgrade campaign. Updates stale version
strings, prose, and comments to the verified current facts; no
Kubernetes behavior or version pins changed except the kubectl
toolchain bump (below).

Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie,
Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB,
dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18,
Grafana 13.2.0.

- Version strings across infra/ and platform/ READMEs + comments
- kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance
  versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew)
- Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms
  with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh)
- COMPLETED/historical banners on the three executed plan docs
- Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges
- Appended dated DECISIONS-LOG entry (2026-08-30) superseding the
  2026-08-26 LIVE STATE line

Left as revalidation items (not blind-edited): external-snapshotter
v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1,
conformance ImageVolume feature-gate assertions under 1.36.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-30 15:13:12 -05:00
1 parent dbd73f1f88
commit cbc2301b30
25 files changed
+100 -43
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

infra/PHASE1-STATUS.md
+5 -5
View File
@@ -1,6 +1,6 @@
# Dev cluster — current state & reconnect guide
**Last verified: 2026-08-26.** Phase 1 is **complete and long since exited**; the cluster has been
**Last verified: 2026-08-30.** Phase 1 is **complete and long since exited**; the cluster has been
running the full platform (phases 2–6) for some time. This doc is how a session — human or agent —
reconnects to it and re-establishes the toolchain.
@@ -15,12 +15,12 @@ reconnects to it and re-establishes the toolchain.
| | |
|---|---|
| Substrate | Proxmox VE host, node `proxmox`, disks on the `Storage` ZFS datastore, bridge `vmbr0` |
| Nodes | `k3s-dev-1/2/3` at `192.168.1.50 / .51 / .52` — 6 vCPU, 16 GiB, Debian 12 (bookworm) |
| k3s | **v1.31.5+k3s1**, 3 servers, embedded etcd (HA); no flannel / kube-proxy / Traefik |
| CNI | Cilium 1.16.5 (kube-proxy replacement, L2 announcements, egress gateway) |
| Nodes | `k3s-dev-1/2/3` at `192.168.1.50 / .51 / .52` — 6 vCPU, 24 GiB, Debian 13 (trixie) |
| k3s | **v1.36.4+k3s1**, 3 servers, embedded etcd (HA); no flannel / kube-proxy / Traefik |
| CNI | Cilium 1.20.1 (kube-proxy replacement, L2 announcements, egress gateway) |
| kube-API | kube-vip VIP **`192.168.1.49:6443`**, tls-san'd on the serving cert |
| Ingress VIP | **`192.168.1.53`** (shared Gateway). Pool `192.168.1.53–.60` for LB VIPs; UniFi holds `.54` |
| Storage | Longhorn 1.7.3 — classes `longhorn` (default), `longhorn-static`, `longhorn-vm` (RWX/Block, migratable), `longhorn-scratch`. `bulk` (NFS CSI) is a **non-provisioning stub** pending OQ-2 |
| Storage | Longhorn 1.12.1 — classes `longhorn` (default), `longhorn-static`, `longhorn-vm` (RWX/Block, migratable), `longhorn-scratch`. `bulk` (NFS CSI) is a **non-provisioning stub** pending OQ-2 |
| Nested virt | `cpu_type = host` → real KVM in-guest; KubeVirt + CDI run on it |
Everything above is provisioned by IaC: [`tofu/`](tofu/) creates the VMs,
infra/README.md
+1 -1
View File
@@ -20,7 +20,7 @@ Proxmox LAN and are reached across a pfSense NAT:
| | |
|---|---|
| Nodes | `k3s-dev-1/2/3` at `192.168.1.50/.51/.52` — 6 vCPU, 16 GiB, Debian 12, k3s v1.31.5 |
| Nodes | `k3s-dev-1/2/3` at `192.168.1.50/.51/.52` — 6 vCPU, 24 GiB, Debian 13, k3s v1.36.4 |
| kube-API | kube-vip VIP `192.168.1.49:6443`, reached from the workstation via NAT `192.168.2.50:6443` |
| Node SSH | pfSense NAT `192.168.2.102:2250/2251/2252` → node `:22` (Ansible only) |
| Ingress VIP | `192.168.1.53` (Cilium L2, shared Gateway); `.53–.60` reserved for LB VIPs |
infra/ansible/roles/cilium/defaults/main.yml
+3 -2
View File
@@ -4,14 +4,15 @@
# HelmRelease adopts config afterward. The parity-critical values
# (kubeProxyReplacement, k8sServiceHost/Port) are templated from k3s_api_host.
# Pin inside the platform/cilium HelmRelease window (>=1.16.0 <1.17.0).
# Exact pin — MUST equal the platform/cilium HelmRelease chart.spec.version (1.20.1, an
# exact pin, not a range). Renovate bumps both together.
cilium_version: "1.20.1"
cilium_chart_repo_name: "cilium"
cilium_chart_repo_url: "https://helm.cilium.io/"
cilium_namespace: "kube-system"
# Gateway API CRDs (standard channel) must exist BEFORE Cilium with gatewayAPI.enabled.
# Cilium 1.16 targets Gateway API v1.2.x.
# Cilium 1.20.1 targets Gateway API v1.6.1.
gateway_api_version: "v1.6.1"
gateway_api_crd_urls:
- "https://github.com/kubernetes-sigs/gateway-api/releases/download/{{ gateway_api_version }}/standard-install.yaml"
infra/ansible/roles/k3s_server/defaults/main.yml
+1 -1
View File
@@ -1,7 +1,7 @@
---
# k3s_server role defaults (ADR-0001).
# Best-effort version pin (kept near the ci/versions kubectl 1.31.x line). Bump
# Best-effort version pin (kept near the ci/versions kubectl 1.36.x line). Bump
# deliberately — a version change is a code change. Empty string => latest stable.
k3s_version: "v1.36.4+k3s1"
infra/devcontainer/versions.env
+2 -2
View File
@@ -11,8 +11,8 @@ OPENTOFU_VERSION=1.9.0
AGE_VERSION=1.2.1
SOPS_VERSION=3.9.4
FLUX_VERSION=2.4.0
# Aligned with ci/versions.env (KUBECTL=1.31.4) and the k3s 1.31.5 cluster.
KUBECTL_VERSION=1.31.4
# Aligned with ci/versions.env (KUBECTL=1.36.4) and the k3s 1.36.4 cluster.
KUBECTL_VERSION=1.36.4
HELM_VERSION=3.16.0
# --- Conformance test toolchain (match ci/versions.env) ----------------------
infra/tofu/README.md
+4 -3
View File
@@ -5,7 +5,7 @@ Provisions the "Create" lifecycle stage (docs/02): 3 cloud-init'd VMs on the
(Migrated from the old memory-constrained libvirt host; provider is now `bpg/proxmox`.)
**APPLIED AND LIVE.** These three VMs are the running dev cluster — `k3s-dev-1/2/3`, k3s
v1.31.5, carrying the whole platform. Treat any `tofu apply/destroy` here as an operation on
v1.36.4, carrying the whole platform. Treat any `tofu apply/destroy` here as an operation on
production-for-dev, and note the state file caveat below.
Serves **R-ENV-01/02**, **R-PLAT-01**, ADR-0001 (k3s substrate).
@@ -19,9 +19,10 @@ Serves **R-ENV-01/02**, **R-PLAT-01**, ADR-0001 (k3s substrate).
| Image/snippet datastore | `local` (dir; content = iso + **snippets**) |
| Bridge | `vmbr0` (no VLAN) |
| Nodes | `k3s-dev-1/2/3` at `192.168.1.50/.51/.52`, gw `192.168.1.1`, DNS `192.168.1.18` |
| Per node | 6 vCPU, 16 GiB RAM, **cpu type `host`** (nested virt for KubeVirt — real KVM confirmed in-guest) |
| OS disk | **64 GiB**, virtio0 (`/dev/vda`, boot), imported from the Debian 12 cloud image |
| Per node | 6 vCPU, 24 GiB RAM, **cpu type `host`** (nested virt for KubeVirt — real KVM confirmed in-guest) |
| OS disk | **64 GiB**, virtio0 (`/dev/vda`, boot), imported from the Debian 13 cloud image |
| Data disk | **128 GiB**, virtio1 (`/dev/vdb`) → `/var/lib/longhorn` (mounted by cloud-init; Longhorn reports ~125 GiB usable per node) |
| etcd disk | **16 GiB SSD**, virtio2 (`/dev/vdc`) on the `local-zfs` SSD datastore → etcd data dir (`/var/lib/rancher/k3s/server/db`); isolates etcd WAL fsync from the HDD Longhorn I/O (docs/plans/ssd-etcd-isolation.md) |
| Cloud-init | native `initialization` (static IP + DNS) + user-data **snippet** for the baseline |
| Reserved | `192.168.1.53–.60` for Cilium L2 ingress VIPs (surfaced in outputs). In use: `.53` shared Gateway, `.54` UniFi |