Entity: TazLab K8s (GitOps Layer)
K8s v1.35.0 on Talos v1.12.0 (1CP+1W). CNI: Flannel.
This page is the repository hub for the provider-agnostic Flux GitOps desired-state layer.
Overview
tazlab-k8s/ defines the entire desired state of the cluster after Talos bootstrap. It is managed by Flux CD, which continuously reconciles the cluster against the master branch of github.com/tazzo/tazlab-k8s.
Repository Structure
tazlab-k8s/
├── clusters/tazlab-k8s/ # 21 Flux Kustomization entrypoints (the DAG)
├── infrastructure/
│ ├── operators/ # HelmReleases for cluster controllers
│ │ ├── core/ # cert-manager, traefik, reloader, dex, auth, cloudflare-ddns, tailscale
│ │ ├── data/ # postgres-operator (Crunchy PGO)
│ │ ├── monitoring/ # kube-prometheus-stack + dashboards
│ │ └── namespaces/ # Explicit namespace declarations (incl. tailscale/)
│ ├── configs/ # Static cluster configuration (secrets delivered via VSO)
│ │ ├── cert-manager/ # Let's Encrypt prod + staging ClusterIssuers
│ │ └── tazlab-db/ # Reserved (empty — S3 backup creds delivered via VSO)
│ ├── instances/ # Deployed workload instances (PostgresCluster, Services)
│ │ ├── tazlab-db/ # PostgresCluster CR (Crunchy PGO)
│ │ ├── traefik/ # Traefik Service + Ingress
│ │ ├── longhorn/ # Longhorn Ingress
│ │ ├── dex/ # Dex Deployment + Ingress + ConfigMap
│ │ ├── pgadmin/ # PGAdmin Deployment + PVC
│ │ ├── homepage/ # Homepage dashboard (pinned image, tailnet ingress)
│ │ ├── cloudflare-ddns/ # DDNS Deployment (image pinned favonia/cloudflare-ddns:1.17.0)
│ ├── cluster-instances/ # Aggregator: instances + automation
│ ├── cluster-bridge/ # Aggregator: bridge
│ ├── bridge/ # IngressClass + ClusterIssuer + DNSConfig (raw manifests)
│ ├── automation/ # Flux image automation (ImageRepository + ImagePolicy + ImageUpdateAutomation)
│ │ ├── hugo-blog/
│ │ ├── hugo-wiki/
│ │ ├── mnemosyne-mcp/
│ │ └── homepage/
│ ├── auth/ # OAuth2 Proxy (Deployment + Ingress + Middleware)
│ └── common/ # Shared patches (wait-for-db-patch.yaml)
├── apps/
│ ├── base/ # Cluster-agnostic app manifests
│ │ ├── hugo-blog/
│ │ ├── hugo-wiki/
│ │ ├── mnemosyne-mcp/
│ │ └── hindsight/
│ └── cluster/ # Thin Kustomize overlays (→ apps/base/)
│ ├── hugo-blog/
│ ├── hugo-wiki/
│ ├── mnemosyne-mcp/
│ └── hindsight/
└── tests/
└── verify_manifest_purity.sh
Quick Facts
| Property | Value |
|---|---|
| Repository | tazlab-k8s/ |
| Default branch | master |
| Git remote | github.com/tazzo/tazlab-k8s |
| Flux interval | 1m (source), 1h (kustomizations) |
| Secret backend | Vault (tazlab-secrets-vault) |
| Kubeconfig | ../ephemeral-castle/clusters/tazlab-k8s/proxmox/configs/kubeconfig |
Canonical Starting Pages for Agents
Architecture & Design
- Flux DAG — Reconciliation order and dependency graph
- Kustomize Structure — Base vs cluster layering
- Bootstrap Logic — Handoff from ephemeral-castle
Operators & Infrastructure
- Operators Inventory — All cluster controllers
- Repository Mapping — File-by-file responsibility map
- Conventions — Naming, purity, resource standards
Secrets & Delivery
- Secrets Mapping — VSO → Vault (ESO removed 2026-08-27; Infisical fully decommissioned)
- Image Automation — Flux image update pipeline
Networking & Auth
- Ingress & Auth — Traefik, MetalLB, Dex/OAuth2
- Monitoring & Dashboards — Prometheus, Grafana, dashboards as code
- Homepage Dashboard — Homepage app, image automation, and the 2026-08 outage
Details (Implementation)
- Flux Kustomizations Detail — All 21 Kustomizations with exact spec
- Image Automation Detail — 4 pipeline specs with tags
History
The repository was made public on 2026-07-16 after a git-filter-repo history purge: the Grafana DB temporary password and Talos reference configs were removed, and the Grafana adminPassword was reset to the placeholder change-me (infrastructure/operators/monitoring/helmrelease.yaml). Never assume pre-purge commits contain accurate credentials.
Known Issues
| TD | Area | Summary |
|---|---|---|
| TD-041 | VaultDynamicSecret resilience | VaultDynamicSecret lacks native lease renewal — periodic Flux re-reconciliation required (vso-psql-dynamic rotation) |
| TD-042 | Tailscale DNS stale | Tailscale operator DNS forwarding delivery unreliable — Flux DAG marks tailscale-dns ready before full propagation |
| TD-043 | ProxyGroupInvalid | cert-manager ClusterIssuer intermittent ProxyGroupInvalid when connecting to Let’s Encrypt via HTTP01 |
| TD-057 | Alertmanager receivers | Alertmanager has no alerting receivers configured — the Discord receiver fix (VSS reading Vault tazlab-k8s/static/infra/monitoring/ALERTMANAGER_DISCORD_WEBHOOK) was reverted in commit b0b46bc pending a Discord webhook URL. Open. |
Relationships
- Base infrastructure: ephemeral-castle — provisions VMs, Talos, Flux bootstrap
- Semantic memory: mnemosyne-mcp-server — deployed as
apps-data - Static sites: blog-src, wiki.tazlab.net — deployed as
apps-static/apps-static-wiki - Context governance: the root
/workspace/SKILLS/ecosystem — operational memory and rules for agents - Services: Homepage — TazLab service dashboard app