Platform¶

The core infrastructure components that run the cluster. Everything here is managed by ArgoCD; each component's own page documents its directory layout and configuration.

That is a lot of components for a homelab, and every one of them exists because bare metal does not come with the thing a cloud provider would have handed you. No load balancer, no managed certificates, no block storage API, no identity provider, no backup service. This section is the bill for not having those.

Components¶

Alphabetical, with the namespace it lands in and the sync wave it lands at. The wave ordering below explains why those numbers are what they are.

Traffic Flow¶

flowchart LR
    Client([Client]) --> LB[Cilium LoadBalancer]
    LB --> GW[Gateway API]

    subgraph Cluster
        GW -->|HTTPRoute| Svc[Service]
        Svc --> Pod[App Pod]
    end

    style Client fill:#f9f,stroke:#333

Four hops, and Cilium is three of them. When a hostname stops answering, the question is which hop stopped: does the Gateway still hold its LoadBalancer IP, does the HTTPRoute still say Accepted, does the Service still have endpoints. In that order — the answer is usually the first one.

HTTPRoute Locations¶

HTTPRoutes are co-located with their respective apps:

Usage¶

Bootstrap (before ArgoCD)¶

make install-core  # Gateway API + Prometheus operator CRDs, Cilium, cert-manager
make install-argo  # ArgoCD

GitOps (after ArgoCD)¶

Two parent ArgoCD Applications manage the cluster:

A third parent, workloads, is added back alongside the first workload. See Adding a Workload.

Excluded from sync:

• cilium/values.yaml, values.yaml (Helm values)
• README.md (documentation)
• **/*.template (credential templates)

Sync wave ordering. This is the dependency graph made explicit, and it is the reason a fresh bootstrap converges rather than deadlocking on a CRD that does not exist yet:

Waves 1 through 3 are where a component and its own children separate: logging is the parent Application at 1, and it brings Loki at 2 and Alloy at 3, in that order because a collector with nowhere to ship is just a collector. The same split puts backup at 1 ahead of the snapshot controller it needs at 2 and the Velero that needs both at 3.

The negative waves are the interesting half: nothing above wave 0 can work until networking, storage and certificates exist, so those get to go first and everything else waits its turn.

External Secrets sits at the very front despite needing OpenBao, which arrives six waves later, because what the wave has to guarantee is the CRD, not a working secret store. An ExternalSecret whose CRD is missing is not applied at all, and ArgoCD keeps the operation open waiting for the rest of the wave — so cert-manager's Route53 credential, which sits beside the Certificate resources that cannot go Ready without it, would wait for a retry that never comes. A store that is not ready yet is a normal, self-correcting state; a resource that was never applied is not.