From a207c56637e5bd43fffb61d5cfa6f64f52b5d5b7 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Mon, 20 Jul 2026 08:22:53 -0700 Subject: [PATCH] fix(k8s,docs): scale ddb-cluster to single instance, pin minio to storage namespace, document 3-CP topology in USAGE --- USAGE.md | 16 ++++++++++++++-- k8s/data/ddb-cluster.yaml | 6 ++++-- k8s/infrastructure/minio/buckets.yaml | 6 +++--- k8s/infrastructure/minio/kustomization.yaml | 2 +- 4 files changed, 22 insertions(+), 8 deletions(-) diff --git a/USAGE.md b/USAGE.md index 115be1a..a9377a1 100644 --- a/USAGE.md +++ b/USAGE.md @@ -1,6 +1,18 @@ ## Cluster Architecture at a Glance -**Homelab** is a 2-node bare-metal Kubernetes cluster deployed with Talos Linux, designed for self-hosted services, observability, and GitOps-ready CI/CD. +**Homelab** is a 3-node bare-metal Kubernetes cluster deployed with Talos Linux, designed for self-hosted services, observability, and GitOps-ready CI/CD. + +### Node Topology (3 control-plane HA, since 2026-07-20) + +| Node | IP | Zone | Role | Scheduling | Storage | +|------|----|----|------|-----------|---------| +| `talos-cp-1` | 192.168.1.213 | az-a | control-plane | **schedulable** (runs all workloads) | sole Longhorn node (sdb/sdc/sdd) | +| `talos-cp-2` | 192.168.1.163 | az-b | control-plane | dedicated (`NoSchedule`) | none | +| `talos-cp-3` | 192.168.1.166 | az-c | control-plane | dedicated (`NoSchedule`) | none | + +- **etcd** has 3 voting members peering over the LAN (`cluster.etcd.advertisedSubnets: 192.168.1.0/24` — without it Talos may advertise on the WireGuard IP and new members hang as learners). Tolerates 1 node loss. +- Only `talos-cp-1` runs workloads and holds storage, so stateful services are **single-instance** (e.g. CNPG `ddb-cluster` = 1 instance). The kube-apiserver endpoint is single-homed to `.213` (no VIP yet). +- Scheduling is declarative: `allowSchedulingOnControlPlanes: true` + per-node `machine.nodeTaints` re-adds the control-plane taint on the dedicated nodes only. ### Deployment Stack (18 Helm releases) @@ -12,7 +24,7 @@ | **Certificates** | cert-manager + homelab-ca | cert-manager | Self-signed CA, auto-renewal | | **Storage (Block)** | Longhorn v1.7.0 | longhorn-system | Persistent volumes, default StorageClass | | **Storage (Object)** | MinIO (3-node, site-repl) | storage | S3-compatible, multi-AZ replication | -| **Database** | CloudNativePG (3 replicas) | ddb | PostgreSQL 16 + pgvector | +| **Database** | CloudNativePG (1 instance) | ddb | PostgreSQL 16 + pgvector (single-node; see topology) | | **IAM / OIDC** | Authentik | iam | Federated OIDC provider for all services | | **Secrets** | HashiCorp Vault | iam | KV secrets backend, JWT auth | | **Logs** | Loki (SingleBinary) | logging | 10-day retention, MinIO backend | diff --git a/k8s/data/ddb-cluster.yaml b/k8s/data/ddb-cluster.yaml index dfb8f54..a2282a9 100644 --- a/k8s/data/ddb-cluster.yaml +++ b/k8s/data/ddb-cluster.yaml @@ -7,8 +7,10 @@ metadata: app: postgresql layer: data spec: - # 3-node cluster for HA - instances: 3 + # Single instance — cp-1 is the only schedulable node in the 3-CP topology + # (.163/.166 are dedicated control planes with no workload scheduling/storage). + # Postgres standby HA is traded away; control-plane/etcd HA is unaffected. + instances: 1 # PostgreSQL 16.2 imageName: ghcr.io/cloudnative-pg/postgresql:16.2 diff --git a/k8s/infrastructure/minio/buckets.yaml b/k8s/infrastructure/minio/buckets.yaml index fb148f5..4b363fd 100644 --- a/k8s/infrastructure/minio/buckets.yaml +++ b/k8s/infrastructure/minio/buckets.yaml @@ -4,7 +4,7 @@ apiVersion: minio.min.io/v1alpha1 kind: Bucket metadata: name: riotpiao-models - namespace: minio + namespace: storage spec: name: riotpiao-models versioning: @@ -20,7 +20,7 @@ apiVersion: minio.min.io/v1alpha1 kind: Policy metadata: name: policy-ollama - namespace: minio + namespace: storage spec: name: policy-ollama statements: @@ -42,7 +42,7 @@ apiVersion: minio.min.io/v1alpha1 kind: User metadata: name: user-ollama - namespace: minio + namespace: storage spec: accessKey: ollama-access-key secretKey: ollama-secret-key-changeme # Override via Secret diff --git a/k8s/infrastructure/minio/kustomization.yaml b/k8s/infrastructure/minio/kustomization.yaml index 1f8eda7..3cb798a 100644 --- a/k8s/infrastructure/minio/kustomization.yaml +++ b/k8s/infrastructure/minio/kustomization.yaml @@ -1,6 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -namespace: minio +namespace: storage resources: - minio-tenant.yaml - minio-service.yaml