This is a mono repository for my home infrastructure and Kubernetes cluster. I try to adhere to Infrastructure as Code (IaC) and GitOps practices using tools like Ansible, Terraform, Kubernetes, Flux, Renovate, and GitHub Actions.
Click to see my rack
| Device | Count | OS Disk Size | Data Disk Size | Ram | Operating System | Purpose |
|---|---|---|---|---|---|---|
| ThinkCentre M920x | 2 | 500GB SSD | 1TB NVME + 512GB NVME | 64GB | Talos | Kubernetes |
| ThinkStation P330 | 1 | 500GB SSD | 1TB NVME + 512GB NVME | 64GB | Talos | Kubernetes |
| Device | Count | OS Disk Size | Data Disk Size | Ram | Operating System | Purpose |
|---|---|---|---|---|---|---|
| ThinkCentre M910q | 1 | 800GB SSD | - | 32GB | Fedora IoT | Infra Services |
| Synology NAS RS1221+ | 1 | - | 8x12TB HDD | 32GB | DSM 7 | NFS |
| IBM Tape Library TS-3200 | 1 | - | 24xLTO-6 + 24xLTO-7 | - | - | Longterm Archive |
| TESmart 8 Port KVM Switch | 1 | - | - | - | - | Network KVM |
| Juniper SRX320 | 1 | - | - | - | JUNOS | Router |
| TPLINK SX3008F | 2 | - | - | - | - | 10GGb ToR Switch |
| TPLINK SG2210MP | 1 | - | - | - | - | PoE Switch |
| TPLINK SG3428X | 1 | - | - | - | - | Aggregation Switch |
| APC AP4421 | 1 | - | - | - | - | ATS/PDU |
| APC SURT2000RM XL + 2x BP | 1 | - | - | - | - | UPS |
This semi hyper-converged cluster operates on Talos Linux, an immutable and ephemeral Linux distribution tailored for Kubernetes, and is deployed on bare-metal workstations. Rook supplies my workloads with persistent block, object, and file storage, while a separate server handles media file storage. The cluster is designed to enable a full teardown without any data loss.
There is a template at onedr0p/cluster-template if you want to follow along with some of the practices I use here.
- actions-runner-controller: Self-hosted Github runners.
- cert-manager: Creates SSL certificates for services in my cluster.
- cilium: eBPF-based networking for my workloads.
- cloudflared: Enables Cloudflare secure access to my routes.
- external-dns: Automatically syncs ingress DNS records to a DNS provider.
- external-secrets: Managed Kubernetes secrets using 1Password Connect.
- multus: Multi-homed pod networking.
- rook: Distributed block storage for peristent storage.
- spegel: Stateless cluster local OCI registry mirror.
- volsync: Backup and recovery of persistent volume claims.
Flux watches my kubernetes folder (see Directories below) and makes the changes to my clusters based on the state of my Git repository.
The way Flux works for me here is it will recursively search the kubernetes/apps folder until it finds the most top level kustomization.yaml per directory and then apply all the resources listed in it. That aforementioned kustomization.yaml will generally only have a namespace resource and one or many Flux kustomizations (ks.yaml). Under the control of those Flux kustomizations there will be a HelmRelease or other resources related to the application which will be applied.
Renovate monitors my entire repository for dependency updates, automatically creating a PR when updates are found. When some PRs are merged Flux applies the changes to my cluster.
This Git repository contains the following directories under kubernetes.
📁 kubernetes # Kubernetes cluster defined as code
├─📁 apps # Apps deployed into my cluster grouped by namespace (see below)
├─📁 components # Re-usable kustomize components
└─📁 flux # Flux system configuration