2025-08-26 19:58:08 +03:00
2025-08-14 20:34:28 +03:00
2025-06-18 18:21:35 +03:00
2025-06-18 18:46:06 +03:00
2025-04-20 19:01:39 +03:00
2025-08-07 19:20:45 +03:00
2025-08-07 16:34:47 +03:00
2025-08-14 02:02:26 +03:00
2025-08-07 16:26:21 +03:00
2025-08-07 19:02:11 +03:00
2025-08-08 03:03:49 +03:00
2025-08-14 02:02:26 +03:00
2025-08-14 21:06:59 +03:00
2025-07-29 15:58:20 +03:00
2025-07-24 09:36:54 +03:00
2025-08-14 20:28:42 +03:00
2025-07-30 16:49:25 +03:00
2025-07-22 01:44:26 +03:00
2025-08-14 22:22:50 +03:00
2025-08-07 16:26:21 +03:00
2025-06-18 18:21:35 +03:00
2025-08-07 19:20:45 +03:00
2023-07-28 12:23:29 +03:00
2024-07-30 14:15:13 +03:00
2022-08-25 11:22:50 +03:00
2025-08-07 18:59:04 +03:00
2024-07-30 10:32:57 +03:00

k-space.ee infrastructure

Kubernetes manifests, Ansible playbooks, and documentation for K-SPACE services.

Jump to docs: inventory-app / cameras / doors / list of apps // all infra / network / retro / non-infra

Tip: Search the repo for kind: xyz for examples.

Supporting services

  • Build Git repositories with Woodpecker1 .
  • Passmower: Authz with kind: OIDCClient (or kind: OIDCMiddlewareClient2 ).
  • Traefik3 : Expose services with kind: Service + kind: Ingress (TLS and DNS included).

Additional

  • bind: Manage additional DNS records with kind: DNSEndpoint.
  • Prometheus: Collect metrics with kind: PodMonitor (alerts with kind: PrometheusRule).
  • Slack bots and Kubernetes CLUSTER.md itself.

Network

All nodes are in Infra VLAN 21. Routing is implemented with BGP, all nodes and the router make a full-mesh. Both Serice LB IPs and Pod IPs are advertised to the router. Router does NAT for outbound pod traffic. See the Calico installation for Kube side and Routing / BGP in the router. Static routes for 193.40.103.36/30 have been added in pve nodes to make them communicating with Passmower via Traefik more stable - otherwise packets coming back to the PVE are routed directly via VLAN 21 internal IPs by the worker nodes, breaking TCP.

Databases / -stores:

  • Dragonfly: kind: Dragonfly (replaces Redis4 )
  • Longhorn: storageClassName: longhorn (filesystem storage)
  • Mongo5 : kind: MongoDBCommunity (NAS* inventory-mongodb)
  • Minio S3: kind: MinioBucketClaim with class: dedicated (NAS*: class: external)
  • MariaDB*: search for mysql, mariadb6 (replaces MySQL)
  • Postgres*: hardcoded to harbor/application.yml
  • Seeded secrets: kind: SecretClaim (generates random secret in templated format)
  • Secrets in git: https://git.k-space.ee/secretspace (members personal info, API credentials, see argocd/deploy_key.pub comment)

* External, hosted directly on nas.k-space.ee


This page is referenced by wiki front page as the technical documentation for infra.

nas.k-space.ee pre-migration whouses listing

mongodb

  • inventory
  • wildduck

mariadb.infra.k-space.ee (DNS from ns1 to 172.20.36.1)

  • freescout
  • gitea nb! MYSQL_ROOT_PASSWORD seems to be invalid, might be ok to reset it upstream
  • wiki
  • nextcloud
  • etherpad NB! probably NOT using kspace_etherpad_kube NB! does not take DNS likely due to netpol, hardcoded to 172.20.36.1
  • grafana
  • woodpecker

  1. Replaces Drone CI. ↩︎

  2. Applications should use OpenID Connect (kind: OIDCClient) for authentication, whereever possible. If not possible, use kind: OIDCMiddlewareClient client, which will provide authentication via a Traefik middleware (traefik.ingress.kubernetes.io/router.middlewares: passmower-proxmox@kubernetescrd). Sometimes you might use both for extra security. ↩︎

  3. No nginx annotations! Use kind: Ingress instead. IngressRoute is not used as it doesn't support external-dns out of the box. ↩︎

  4. Redis has been replaced as redis-operatori couldn't handle itself: didn't reconcile after reboots, master URI was empty, and clients complained about missing masters. Dragonfly replaces KeyDB. ↩︎

  5. Mongo problems: Incompatible with rawfile csi (wiredtiger.wt corrupts), complicated resizing (PVCs from statefulset PVC template). ↩︎

  6. As of 2024-07-30 used by auth, authelia, bitwarden, etherpad, freescout, git, grafana, nextcloud, wiki, woodpecker ↩︎

Description
Kubernetes manifests of services running on k-space.ee domains (mirrored to https://gitlab.com/k-space/kube)
Readme 2.1 MiB
Languages
Shell 100%