Platform¶

The core infrastructure components that run the cluster, all managed by ArgoCD. Every one of them exists because bare metal does not come with the thing a cloud provider would have handed you: no load balancer, no managed certificates, no block storage API, no identity provider, no backup service.

Components¶

One row per directory under payload/platform/, with the Application name where it differs from the directory — that is the name kubectl -n argocd get applications shows — and the namespace it lands in.

Across the platform, memory limits are set at roughly 2.5x the measured peak working set and requests at steady state; CPU is requested but never limited. The control-plane static pods get their memory requests through the kubeadm patches in ansible/templates/butane_node_config.yaml.j2, applied at kubeadm init, join and upgrade, so a running node picks them up at its next reinstall; they carry no limits, because a limit on the API server or etcd would OOM-kill the control plane and 2.5x their peak exceeds the node. CoreDNS is kubeadm's too: the same directory holds a patch spreading its replicas one per node, which kubeadm applies at init and upgrade apply only, and its PodDisruptionBudget sits in the security component because nothing else owns a CoreDNS manifest.

Components the cluster cannot run without — the CNI and API VIP, the admission webhooks, the secret and certificate chain, the CSR approver, the storage daemons and the node security agents — carry a system-* priority class, so under node pressure the kubelet evicts workloads first: system-node-critical for the DaemonSets a node needs, system-cluster-critical for the rest.

Traffic Flow¶

flowchart LR
    Client([Client]) --> LB[Cilium LoadBalancer]
    LB --> GW[Gateway API]

    subgraph Cluster
        GW -->|HTTPRoute| Svc[Service]
        Svc --> Pod[App Pod]
    end

    style Client fill:#f9f,stroke:#333

Four hops, and Cilium is three of them. When a hostname stops answering, ask which hop stopped, in this order: does the Gateway still hold its LoadBalancer IP, does the HTTPRoute still say Accepted, does the Service still have endpoints.

HTTPRoute Locations¶

Routes sit with the component they expose, as a manifest where the component is plain YAML and as chart values where the chart renders its own:

Deployment¶

make bootstrap  # Gateway API CRDs + Cilium, ArgoCD, then the handover

After that the argocd Application syncs the platform ApplicationSet, which generates one Application per payload/platform/*/application.yaml plus the workloads Application that deploys the apps ApplicationSet for the workloads repository. Each component directory holds exactly one application.yaml; everything else in it is what that Application deploys. GitOps Strategy has the structure and the sync policy.

Replica placement¶

Two replicas on one node are not redundancy. Every chart's default is a single preferredDuringSchedulingIgnoredDuringExecution anti-affinity term — one weight among the scheduler's scores, and on a cluster of one 16 GB worker against two 8 GB ones, free memory outscores it. So every component with more than one replica carries an explicit rule:

Constraints carry nodeTaintsPolicy: Honor, so the skew is measured over the nodes the pod can reach rather than over the tainted control planes. Where a component carries a PodDisruptionBudget it says maxUnavailable: 1, so a drain or the descheduler evicts one replica at a time; maxUnavailable rather than minAvailable, so a component scaled down to one replica never blocks a drain. The CloudNativePG operator runs two replicas with no budget. Placement is scored once, at scheduling time: pods already sharing a node stay there until something restarts them, and the descheduler moves them back only if its evictor is allowed to touch them.

Rollout order¶

Nothing enforces an order: every Application syncs as soon as it exists and converges by retry and health, as GitOps Strategy explains. This is the order a fresh cluster settles in, and what each layer is waiting for while it is not yet Healthy.

Why the ClusterSecretStore sits with OpenBao and the issuers are their own Application is in Bootstrap convergence.