labv2

Personal Talos Kubernetes cluster managed through Flux GitOps. Core services include Cilium, Hubble, Envoy Gateway, cert-manager, External Secrets, Spegel, Reloader, and Gatus.

This repository contains rendered cluster configuration. Initial template setup is complete; documentation now focuses on operating and redeploying the cluster.

Runbooks

• Deployment — bootstrap Talos and applications, then verify the rollout.
• GitOps — change applications, reconcile Flux, and operate network routes.
• Application databases — add, connect, verify, upgrade, and recover per-application PostgreSQL clusters.
• Application Valkey caches — add, connect, verify, and upgrade isolated per-application Valkey instances.
• Reset — return one or all Talos nodes to maintenance mode.
• Maintenance — apply and upgrade Talos, add nodes, maintain Kubernetes, and troubleshoot failures.
• Cluster power — safely shut down and restart the full Talos and Rook Ceph cluster.

Quick Reference

Run commands from repository root in WSL Bash with Mise activated:

mise trust
mise install
just --list

Private Codex instructions

Codex must be launched through the repository's private-instruction wrapper. Add this to WSL ~/.bashrc on every workstation:

if [[ -f /mnt/e/code/private/labv2/scripts/codex-shell.sh ]]; then
  source /mnt/e/code/private/labv2/scripts/codex-shell.sh
fi

Reload the shell with source ~/.bashrc. Running codex anywhere inside this repository then uses scripts/codex-private; elsewhere it uses the normal Codex executable.

Edit .codex-private/AGENTS.private.sops.yaml through the VS Code SOPS extension or with mise exec -- sops .codex-private/AGENTS.private.sops.yaml. SOPS uses the repository's ignored age.key for decryption.

Fresh deployment:

just bootstrap talos
just bootstrap apps
kubectl get pods --all-namespaces --watch

Routine status:

just talos nodes
kubectl get nodes -o wide
flux get ks -A
flux get hr -A

Force Flux to pull current Git state:

just kube reconcile

Never print or commit decrypted credentials, age keys, kubeconfigs, Talos secrets, or provider tokens.