jakman85 and Claude Opus 4.8
b4b3bb0922
W5 (FINAL): Cilium 1.19.7->1.20.1 (+GW-API CRDs v1.6.1), Longhorn 1.11->1.12.1 (pre-k8s-1.36)
...
Cilium 1.20 is mandatory for k8s 1.36. GW-API CRDs v1.4.1->v1.6.1 (direct, never v1.5.x).
Co-Authored-By: Claude Opus 4.8 <[email protected]
2026-08-30 00:22:53 -05:00
jakman85 and Claude Opus 4.8
36173b9529
W3: Cilium 1.18.13->1.19.7 (+GW-API CRDs v1.4.1), Longhorn 1.9->1.10.2 (pre-k8s-1.34)
...
Co-Authored-By: Claude Opus 4.8 <[email protected]
2026-08-30 00:00:23 -05:00
jakman85 and Claude Opus 4.8
cd8cf6220b
W2: Cilium 1.17.18->1.18.13 (+GW-API CRDs v1.3.0), Longhorn 1.8->1.9 (pre-k8s-1.33)
...
Gateway API CRDs bumped v1.2.1->v1.3.0 (required by Cilium 1.18; applied server-side).
Land on current k8s 1.32 before the 1.33 hop.
Co-Authored-By: Claude Opus 4.8 <[email protected]
2026-08-29 23:46:09 -05:00
jakman85 and Claude Opus 4.8
5efd983239
W1: Cilium 1.16.5->1.17.18, Longhorn 1.7->1.8 (pre-k8s-1.32 component landing)
...
Land the two pacing components on current k8s 1.31 before the 1.32 k3s hop.
Cilium 1.17 supports k8s 1.29-1.32; Longhorn 1.8 supports 1.25+; Gateway API CRDs
stay v1.2.1 (Cilium 1.17 targets v1.2.x). Also commits the full upgrade plan doc.
Co-Authored-By: Claude Opus 4.8 <[email protected]
2026-08-29 23:23:34 -05:00
jakman85 and Claude Opus 4.8
81ef78295a
infra: direct kube-API access via kube-vip VIP + NAT (retire SSH tunnel)
...
Controller now reaches the kube-API directly through the pfSense NAT
(192.168.2.50:6443 -> kube-vip VIP 192.168.1.49:6443), validating TLS
against the VIP via tls-server-name. Removes the dev.sh SSH-tunnel
scaffolding and updates the ansible source-of-truth so a rebuild
regenerates a direct-access kubeconfig.
Co-Authored-By: Claude Opus 4.8 <[email protected]
2026-08-25 22:10:27 -05:00
jakman85 and Claude Opus 4.8
0037fb40fa
ansible(cilium): rewrite controller kubeconfig to SSH-tunnel endpoint (kube-API not NAT-forwarded)
...
Co-Authored-By: Claude Opus 4.8 <[email protected]
2026-08-25 12:15:12 -05:00
jakman85 and Claude Opus 4.8
125ca428bc
fix(phase1): two execution-surfaced bugs bringing up k3s+Cilium
...
- ansible.cfg: stdout_callback 'yaml' (community.general.yaml) was REMOVED in
ansible-core 2.20 -> use builtin default + result_format=yaml.
- cilium-values: egressGateway.enabled requires ipv4+eBPF masquerade or the
agent fatals at startup ('egress gateway requires --enable-ipv4-masquerade
and --enable-bpf-masquerade'). Add enableIPv4Masquerade + bpf.masquerade=true
(also the correct pairing with kubeProxyReplacement; [parity] w/ platform/cilium).
Verified live: 3/3 nodes Ready, embedded-etcd HA, Cilium status OK, CoreDNS up.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]
2026-08-16 02:04:50 -05:00
jakman85 and Claude Opus 4.8
f2a7e42068
Phase 1 (author-only): node provisioning IaC — tofu + cloud-init + Ansible (T-1.1/1.2/1.3)
...
OpenTofu libvirt module (k3s-dev NAT 10.73.0.0/24, 3x 6GiB/4vCPU VMs, 20G OS +
40G thin data, host-passthrough), cloud-init baseline (k3s/Cilium/Longhorn
prereqs, static net), Ansible k3s-HA + Cilium (kube-proxy replacement, Gateway
API, Hubble; flannel/kube-proxy/Traefik disabled). PM fix: escape ${...} in a
cloud-init template comment (tofu templatefile parse). tofu fmt/init/validate =
Success; ansible --syntax-check + yamllint pass. NOTHING executed (no apply).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]
2026-08-16 01:21:00 -05:00
jakman85andClaude Opus 4.8