↑ ↓ to navigate
    ↵ to select
    esc to close
    Homelab

    Kubernetes Architecture

    Node layout, CNI, platform services, and workload placement on the Talos cluster.

    Overview

    Three Talos control-plane nodes share a virtual IP. Four worker nodes run all workloads. Cilium handles CNI, Gateway API ingress, and L2 LoadBalancer announcements. Argo CD syncs all apps via GitOps.

    Node Inventory

    NameRoleIPCPURAMStorage
    k8s-controller1Control plane192.168.1.2114 vCPU8 GiB50 GiB
    k8s-controller2Control plane192.168.1.2124 vCPU8 GiB50 GiB
    k8s-controller3Control plane192.168.1.2134 vCPU8 GiB50 GiB
    k8s-worker1Worker192.168.1.2214 vCPU14 GiB200 GiB
    k8s-worker2Worker192.168.1.2224 vCPU14 GiB200 GiB
    k8s-worker3Worker192.168.1.2234 vCPU14 GiB200 GiB
    k8s-worker4Worker + GPU192.168.1.2248 vCPU16 GiB250 GiB + RTX 5070 Ti
    Talos VIPVirtual IP192.168.1.210——Floats across control-plane nodes
    Cilium L2 LBLoadBalancer pool192.168.1.220–230——Assigned per LoadBalancer Service

    Cluster Diagram

     flowchart TB
    subgraph LAN["On-Prem LAN · 192.168.1.0/24"]
        subgraph CP["Control Plane · Talos"]
            VIP["Talos VIP<br/>192.168.1.210:6443"]
            CP1["controller1 · .211"]
            CP2["controller2 · .212"]
            CP3["controller3 · .213"]
            VIP --- CP1 & CP2 & CP3
        end

        subgraph WORKERS["Workers · k8s-worker1–3"]
            W1["worker1 · .221"]
            W2["worker2 · .222"]
            W3["worker3 · .223"]
        end

        subgraph GPU["GPU node · k8s-worker4 · .224"]
            W4["RTX 5070 Ti<br/>dedicated=ai:NoSchedule"]
        end
    end

    CP --> WORKERS
    CP --> GPU

    The three control planes share a VIP provided by Talos itself. Workers 1–3 carry the general workloads and Longhorn replicas; worker4 is tainted so only GPU work lands on it — see GPU.

    Two flows cross this topology, each drawn in full on its own page:

    • Inbound requests — Cloudflare → Bifrost or the LAN gateway → Cilium → pod. See Network Flow.
    • Deployments — source branch → GitHub Actions → manifests branch → Argo CD. See GitOps Flow.

    Talos Configuration

    Talos Linux is provisioned by Pulumi (core/platform/talos.go). Each role gets a machine config with role-specific patches:

    PatchControllerWorkerWorker4 (GPU)
    cpPatch✓——
    workerPatch—✓—
    gpuWorkerPatch——✓

    These are inline Go strings in core/platform/talos.go , not separate YAML files.

    Talos image schematics (from factory.talos.dev):

    SchematicExtensionsUsed by
    Baseiscsi-tools, util-linux-tools, qemu-guest-agentAll nodes
    GPUBase + nvidia-container-toolkit, nvidia-open-gpu-kernel-modulesk8s-worker4

    The cluster endpoint is https://192.168.1.210:6443 (Talos VIP).

    Cilium + Gateway API

    Cilium handles both CNI and north-south ingress via the Gateway API:

    FeatureConfig
    CNI modekube-proxy replacement
    L2 announcements192.168.1.220–230 pool (LAN)
    Gateway classcilium
    HTTPRoute for Hubble UIhubble.madhan.app → hubble-ui:80
    ForwardAuthVia Traefik on Bifrost (not in-cluster)

    The Gateway API GatewayClass is provisioned by core/platform/cilium.go. App HTTPRoutes are defined in CDK8s (workloads/**/*.go).

    Workload Placement

    PackageComponentsNode affinity
    storage/LonghornDaemonSet — all workers
    secrets/OpenBao + CSI DriverAny worker
    observability/VictoriaMetrics, VictoriaLogs, OTelDeployment + DaemonSet
    monitoring/GrafanaAny worker
    security/Falco (eBPF), Kyverno, TrivyDaemonSet + CronJob
    hardware/NVIDIA device plugin + DCGMDaemonSet, NodeFeatureDiscovery
    networking/NetBird peerhostNetwork: true, any worker
    registry/HarborDeployments + RWO PVCs
    automation/n8n + PostgreSQLAny worker
    ai/Ollama, ComfyUI, Kubeflowk8s-worker4 only (GPU)
    management/HeadlampAny worker
    support/Stakater ReloaderAny worker

    Service Access

    Service URLDNS resolves toAccess
    grafana.madhan.app178.156.199.250 (public)Via Bifrost + ForwardAuth
    auth.madhan.app178.156.199.250 (public)Authentik on Bifrost
    netbird.madhan.app178.156.199.250 (public)NetBird on Bifrost
    harbor.madhan.app192.168.1.220 (LAN)LAN or VPN only
    headlamp.madhan.app192.168.1.220 (LAN)LAN or VPN only
    hubble.madhan.app192.168.1.220 (LAN)LAN or VPN only

    See Network Flow for the complete traffic path breakdown, and the Software Inventory for the version of everything named above.

    Edit this page