TazLab K8s: Flux Kustomizations Detail

Level 3 (Detail) — All 15 Flux Kustomizations with exact spec, dependencies, and health checks.

Concept

Flux watches the clusters/tazlab-k8s/ directory for Kustomization resources. Each Kustomization points to a path in the repository and defines its dependencies, interval, and post-build substitution. Flux applies them in dependency order.

DAG Overview

infrastructure-operators-namespaces ──┬── infrastructure-bridge ────────── infrastructure-configs ──┬── infrastructure-instances ── infrastructure-auth
infrastructure-operators-core ────────┘                                                             ├── apps-static (hugo-blog)
infrastructure-operators-data ────────┴── infrastructure-monitoring                                  ├── apps-static-wiki (hugo-wiki)
                                                                                                      ├── apps-data (mnemosyne-mcp)
infrastructure-tailscale ─────────────── infrastructure-operators-tailscale ── infrastructure-tailscale-dns

Note: The Tailscale chain (infrastructure-tailscale → infrastructure-operators-tailscale → infrastructure-tailscale-dns) is an independent branch that does not depend on any core/infra Kustomization except itself. Tailscale DNS resolution is orthogonal to cluster core operations.

Kustomization Inventory

All Kustomizations share:

• namespace: flux-system
• sourceRef: kind: GitRepository, name: flux-system
• postBuild.substituteFrom → ConfigMap cluster-vars (provisioned by ephemeral-castle)
• interval: 1h
• prune: true

1. infrastructure-operators-namespaces

Declares the ai-agents namespace. Other namespaces (cert-manager, traefik, monitoring, tazlab-db, hugo-blog, hugo-wiki, dex, auth, reloader, cloudflare-ddns) are declared inline in each operator’s folder via Opzione A.1 pattern.

2. infrastructure-operators-core

Installs all core operators via HelmReleases:

• cert-manager (v1.16.2)
• traefik (v34.0.0)
• reloader (v1.2.1)
• dex
• auth (OAuth2 Proxy)
• cloudflare-ddns
• tazlab-db namespace declaration
• hugo-blog namespace declaration
• hugo-wiki namespace declaration

3. infrastructure-operators-data

Installs:

• postgres-operator (Crunchy PGO v5.7.2)

4. infrastructure-tailscale

Creates the tailscale namespace, provisions the OAuth ExternalSecret (k8s_operator client), and defines the HelmRepository for https://pkgs.tailscale.com/helmcharts. Layer 1 of the Tailscale Operator 3-layer DAG.

5. infrastructure-operators-tailscale

Installs the Tailscale Operator HelmRelease (v1.96.5, tailscale/tailscale-operator). Layer 2 of the 3-layer DAG — only applies after the namespace, Secret, and HelmRepository exist.

6. infrastructure-tailscale-dns

Deploys the hostNetwork CoreDNS relay DaemonSet (port 5353) for magellanic-gondola.ts.net resolution, static ClusterIP Service (10.96.0.101), and patches the coredns ConfigMap with a tailnet forwarding zone. Layer 3 — only applies after the Operator CRDs are available.

7. infrastructure-bridge

Aggregator for ./infrastructure/bridge. Configures:

• IngressClass traefik
• ClusterIssuer tazlab-issuer (Let’s Encrypt prod, HTTP01)

8. infrastructure-monitoring

Installs:

• kube-prometheus-stack (HelmRelease)
• metrics-server
• Grafana dashboards as ConfigMaps (cluster-health, nodes-pro)
• Grafana Ingress
• flux-secret-sync (syncs Grafana credential from ExternalSecret)

9. infrastructure-configs

Deploys all ExternalSecrets and static configuration:

• cert-manager: Cloudflare API token + DNS01 ClusterIssuer
• wildcard-tls: *.tazlab.net TLS cert via ExternalSecret
• hugo-wiki: namespace-specific ExternalSecrets
• tazlab-db: S3 backup credentials
• dex: OIDC client credentials
• ai-agents: OpenClaw gateway / Telegram / OpenAI / ElevenLabs tokens
• github-external-secret: GitHub token for Flux image automation

10. infrastructure-instances

Aggregator for ./infrastructure/instances plus all 4 image automation pipelines. Uses wait: false because some workloads (tazlab-db, longhorn, apps with init containers) can take variable time to become ready. Kubernetes handles Pending/Init states naturally.

Deploys:

• tazlab-db: PostgresCluster (Crunchy PGO, 1 replica, 4Gi, S3 backup)
• traefik: LoadBalancer Service (IP 192.168.1.240)
• longhorn: Ingress + Service
• dex: Deployment + Service + Ingress + ConfigMap
• pgadmin: Deployment + PVC + Service
• homepage: Dashboard UI
• cloudflare-ddns: Deployment + ExternalSecret

Plus image automation for:

• hugo-blog
• hugo-wiki
• mnemosyne-mcp

11. apps-static (hugo-blog)

Deploys hugo-blog from apps/base/hugo-blog/:

• nginx serving static Hugo build
• Certificate CR for blog.tazlab.net
• Traefik Ingress + middlewares
• Redirect middleware (tazlab.net → blog.tazlab.net)

12. apps-static-wiki (hugo-wiki)

Deploys hugo-wiki from apps/base/hugo-wiki/:

• nginx serving static Hugo wiki build
• Ingress for wiki.tazlab.net
• Wildcard TLS via ExternalSecret (same cert chain as blog)

13. apps-data (mnemosyne-mcp)

Deploys mnemosyne-mcp from apps/base/mnemosyne-mcp/:

• Go MCP server (tazzo/mnemosyne-mcp)
• LoadBalancer Service port 8004 → 8080
• ExternalSecret for GEMINI_API_KEY
• wait-for-db initContainer patch
• RBAC for secret reading
• Reloader annotation on tazlab-db-pguser-mnemosyne + mnemosyne-mcp-secrets

• PVCs for config and workspace (5Gi + 10Gi, tazlab-storage)
• MetalLB LoadBalancer IP (192.168.1.242)
• ExternalSecrets for gateway token, telegram, OpenAI, ElevenLabs

15. infrastructure-auth

Deploys:

• OAuth2 Proxy Deployment + Service + Ingress
• ForwardAuth middleware
• RBAC for the oauth2-proxy ServiceAccount

Wait Policy Truth Table

DAG Integrity Rules

1. Namespaces must exist before their operators are installed
2. ClusterIssuer / IngressClass must exist before ExternalSecrets can reference them
3. ExternalSecrets must be available before workloads that consume them
4. PGO must be installed before PostgresCluster CRs are applied
5. Infrastructure instances must be ready before auth layer depends on them
6. Never apply instances before their operator is ready — dependsOn enforces this

See Also

• Parent hub: tazlab-k8s
• Sibling topics: Flux DAG, Repository Mapping
• Sibling details: Image Automation Detail
• Reference: Kustomization Example