Platform · in production
INFRA
My production Kubernetes cluster, driven entirely from Git: three k3s nodes provisioned and hardened with Ansible, running all my applications.
The cluster my projects run on. It lives in two repositories, because the two things do not change at the same pace: one prepares and hardens the machines with Ansible, the other describes everything that runs in Kubernetes, and Argo CD applies it. Nothing is installed by hand on the cluster, apart from Argo CD itself.
What I built
- Provisioning and hardening with Ansible: CIS level 1, kube-bench with no failures, Lynis audit.
- Argo CD syncs more than 30 applications from Git; secrets are encrypted with Sealed Secrets.
- Defense in depth: CrowdSec WAF (199 OWASP CRS rules), Authelia SSO over OIDC, administration over WireGuard only, continuous CVE scans and Kyverno policies.
- Observability with Prometheus, Grafana, Loki and Tempo; PostgreSQL run by CloudNativePG, with continuous WAL archiving.
Highlights
- No open ports: traffic comes in through an outbound tunnel, with two connectors on two nodes. The server's direct IP returns 404.
- Traefik plugins stored in Git and verified by sha256: the reverse proxy starts even without Internet access.
- Staging environments go to sleep after an hour without traffic and wake up on the first request.
- Kubelet memory reservation enforced by Ansible, which rejects any limit below actual usage.