Platform¶

The core infrastructure components that run the cluster, all managed by ArgoCD. Every one of them exists because bare metal does not come with the thing a cloud provider would have handed you: no load balancer, no managed certificates, no block storage API, no identity provider, no backup service.

Components¶

Alphabetical, with the namespace it lands in and the rollout stage it belongs to.

Across the platform, memory limits are set at roughly 2.5x the measured peak working set and requests at steady state; CPU is requested but never limited.

Traffic Flow¶

flowchart LR
    Client([Client]) --> LB[Cilium LoadBalancer]
    LB --> GW[Gateway API]

    subgraph Cluster
        GW -->|HTTPRoute| Svc[Service]
        Svc --> Pod[App Pod]
    end

    style Client fill:#f9f,stroke:#333

Four hops, and Cilium is three of them. When a hostname stops answering, ask which hop stopped, in this order: does the Gateway still hold its LoadBalancer IP, does the HTTPRoute still say Accepted, does the Service still have endpoints.

HTTPRoute Locations¶

HTTPRoutes are co-located with their respective apps:

Deployment¶

make bootstrap  # Gateway API CRDs + Cilium, ArgoCD, then the handover

After that the argocd Application syncs the platform ApplicationSet, which generates one Application per payload/platform/*/application.yaml plus the workloads Application that deploys the apps ApplicationSet for the workloads repository. Each component directory holds exactly one application.yaml; everything else in it is what that Application deploys. GitOps Strategy has the structure and what the staging costs.

Rollout order¶

The ApplicationSet syncs its Applications in stages, selected by the homelab.wlkr.ch/stage label, and starts a stage only when every Application in the one before it is Synced and Healthy; GitOps Strategy covers how the gating works.

The ClusterSecretStore lives with OpenBao in 05-secrets rather than with External Secrets, and cert-manager's issuers and certificates are their own certificates Application, for the same reason: neither can go Ready until OpenBao holds what they read.