Kubernetes Architecture

Overview

Three Talos control-plane nodes sit behind a KubeVIP virtual IP. Four worker nodes run all workloads. Cilium handles CNI, Gateway API ingress, and L2 LoadBalancer announcements. ArgoCD syncs all apps via GitOps.

Node Inventory

Cluster Diagram

 flowchart TB
    subgraph CP["Control Plane · 3 nodes"]
        VIP["KubeVIP<br/>192.168.1.210:6443"]
        CP1["k8s-controller1<br/>.211"]
        CP2["k8s-controller2<br/>.212"]
        CP3["k8s-controller3<br/>.213"]
        VIP --- CP1 & CP2 & CP3
    end

    subgraph WRK["Workers"]
        W1["k8s-worker1<br/>.221"]
        W2["k8s-worker2<br/>.222"]
        W3["k8s-worker3<br/>.223"]
        W4["k8s-worker4<br/>.224<br/>RTX 5070 Ti"]
    end

    subgraph PLT["Platform Services"]
        CIL["Cilium L2 LB<br/>192.168.1.220"]
        ARGO["ArgoCD<br/>ApplicationSet"]
        LONG["Longhorn<br/>distributed storage"]
        INF["Infisical<br/>operator + secrets"]
        CERT["cert-manager<br/>wildcard TLS"]
    end

    subgraph BIFROST["Bifrost VPS · Hetzner"]
        WG["NetBird routing peer<br/>WireGuard mesh"]
    end

    VIP --> CIL
    CIL --> W1 & W2 & W3 & W4
    ARGO -->|"syncs workloads<br/>from manifests branch"| W1 & W2 & W3 & W4
    LONG --> W1 & W2 & W3 & W4
    INF -->|"InfisicalSecret CRs"| W1 & W2 & W3 & W4
    CERT -->|"cert-manager ACME"| CIL
    WG <-->|"WireGuard<br/>192.168.1.0/24"| CIL

Talos Configuration

Talos Linux is provisioned by Pulumi (core/platform/talos.go). Each role gets a machine config with role-specific patches:

Talos image schematics (from factory.talos.dev):

The cluster endpoint is https://192.168.1.210:6443 (KubeVIP).

Cilium + Gateway API

Cilium handles both CNI and north-south ingress via the Gateway API:

The Gateway API GatewayClass is provisioned by core/platform/cilium.go. App HTTPRoutes are defined in CDK8s (workloads/**/*.go).

Workload Placement

Service Access

See Network Flow for the complete traffic path breakdown.