3.1 KiB
3.1 KiB
title, category, tags, created, modified
| title | category | tags | created | modified | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| RKE2 Kubernetes Cluster | systems |
|
2026-07-24 | 2026-07-24 |
RKE2 Kubernetes Cluster
Übersicht
- Version: v1.35.6-rke2r1
- Nodes: 6 (3 CP + 3 Worker), alle schedulable (keine CP Taints)
- CNI: Cilium (LB IP Pool)
- **Ingress:**两层 Traefik (extern CT9999 + intern K8s) + Authelia SSO
Node IPs
| Node | IP | Role |
|---|---|---|
| cp-01 | 10.0.30.51 | Control Plane |
| cp-02 | 10.0.30.52 | Control Plane |
| cp-03 | 10.0.30.53 | Control Plane |
| worker-01 | 10.0.30.63 | Worker |
| worker-04 | 10.0.30.64 | Worker |
| worker-05 | 10.0.30.65 | Worker (GPU renderD128 ✅ on ms-a2-2) |
Storage
- Ceph CSI: ceph-flash (fast), ceph-hdd (bulk)
- CNPG PostgreSQL:
postgres-mainCluster (3/3 Ready), RW Servicepostgres-main-rw.postgres.svc.cluster.local:5432
GitOps
- ArgoCD: SSH Deploy Keys (read-only) auf Gitea
- 15 Applications via SSH (
ssh://git@10.0.30.202:22/dominik/iac-homelab.git) - Gitea SSH user is
git, notgitea—git.schoen.codesresolves to Traefik (10.0.30.203, HTTP only), SSH is on 10.0.30.202:22 - Workflow: IaC repo auschecken → ändern → commit+push → ArgoCD sync → verify → lokale Kopie löschen
- Siehe concepts/gitops-workflow
Backup
- Velero v1.18.1 with
--features=EnableCSI, S3 backend (noris cloudhomelab-velero-backups) - VolumeSnapshotClass
ceph-rbd-snapclass(rbd.csi.ceph.com, default) - Schedules: daily 01:00 UTC (30d TTL), weekly Sun 00:00 UTC (90d TTL)
- CNPG Postgres: separate hourly backups via barmanObjectStore to S3 (30d retention)
- All 24 PVCs (~430 GiB) now have off-site CSI snapshots
- Helm pitfall:
features: EnableCSImust be underconfiguration:in Velero Helm values (not top-level)
Deployed Workloads
| Workload | Namespace | Notes |
|---|---|---|
| Paperless-ngx v3.0.0 | paperless | PostgreSQL (CNPG), enableServiceLinks: false |
| Gitea | gitea | git.schoen.codes |
| Loki Stack | logging | LB 10.0.30.207:3100 |
| Hindsight | hindsight | LB 10.0.30.201:9177 |
| Authelia | authelia | SSO, Galera backend |
| HolmesGPT | holmes | SRE Bot |
| Traefik | traefik | Ingress Controller |
| CNPG | postgres | PostgreSQL HA |
GPU
- worker-04: renderD128 ✅ (AMD GPU Passthrough, rombar=1, on n5pro)
- worker-05: renderD128 ✅ (AMD GPU Passthrough, rombar=1, on ms-a2-2)
- IaC: unified
amd-gpuPCI mapping (n5pro + ms-a2-1 + ms-a2-2) + dynamic hostpci (one worker block, gpu flag) - ms-a2-1 has kernel BUG with 1002:13c0 (renderD128 missing) — worker-05 moved to ms-a2-2 (identical hardware)
Known Pitfalls
enableServiceLinks: falsebei Apps deren Service-Name mit Env-Vars kollidiert (z.B. PaperlessPAPERLESS_PORT)- ArgoCD
--forcekann nicht mit ServerSideApply kombiniert werden - CoreDNS:
hostsconfigBlock nicht params - etcd Defrag monatlich (CronJob)
Related Skills
rke2-cluster-administration(devops)