Where It Stands Today
Every migration eventually stops being a migration and becomes ordinary operations. This is that turning point.
Maintenance mode
The days since 16 August look nothing like the frantic weeks earlier in this
account. Chart version bumps — Argo Workflows, the gitlab.com runner, Loki,
Longhorn, the whole kube-prometheus-stack — land in routine batches rather
than firefights. A Longhorn NetworkPolicy regression gets caught and fixed.
talhelper, the tool this cluster’s machine configs have depended on since
day one, was declared archived and end-of-life by its maintainers — its
successor migration is underway, staged deliberately by risk rather than all
at once, with the higher-risk cluster-upgrade jobs paused until the
lower-risk ones have proven themselves.
There’s one more storage scare worth naming honestly: Loki’s PVC filled completely and crashed after a routine chart auto-sync restart exposed how close to full its 20Gi volume already was. The fix — expanding to 60Gi — was simple, but it’s a reminder that “the migration is done” doesn’t mean “nothing will break again.” Steady-state operations still produce incidents; they’re just smaller and faster to resolve than the ones earlier in this story.
The newest addition, on 29 August, is poe-scheduler — a small SNMPv3-based
tool for scheduling PoE power to UniFi switch ports on a per-minute CronJob.
It’s a fittingly modest bookend to a project that started with 19 commits of
“get it working” on day one: five months later, adding a new app is routine
enough to be genuinely small.
What’s actually running now
Stripped of the history, the cluster today is:
- Three physical nodes —
talos-04,talos-05,talos-06— every one of them schedulable control-plane and worker at once, etcd holding quorum at two of three. - Cilium as CNI, kube-proxy replacement, and Gateway API implementation, with L2 announcements and an egress gateway carved out for per-WAN monitoring.
- ArgoCD, still the same app-of-apps pattern from the very first commit, now managing several dozen applications instead of zero.
- External Secrets Operator backed by OpenBao — the inherited Vault’s replacement, running on dedicated Raspberry Pi hardware rather than inside the cluster it serves, on purpose: DNS and secrets are foundational enough that the circularity of hosting them inside their own dependent cluster wasn’t worth the convenience.
- Longhorn and NFS, side by side, each used where it actually fits — Longhorn’s third attempt, back in chapter 5, is the one that stuck.
- cert-manager, Authentik, and — since 12 August — GitHub Actions' own runner controller (ARC), the first GitHub-facing infrastructure in an otherwise all-GitLab cluster.
- No GPU nodes. Chapter 4’s hardware is gone, and hasn’t been replaced.
What’s still unfinished
In keeping with how this account started, it’s worth closing the same way:
honestly. debian-dev01, the VM named in chapter zero as the clearest
surviving picture of “the old world,” still runs Cacti, TFTP and RANCID —
its migration was never fully closed out, five months on. And Proxmox itself
was never given a formal decommission moment at all; it simply stopped being
touched sometime in 2024, long before any of this was written down.
That’s a fair place to end this particular account, not because the work is finished, but because the shape of what’s left is now small, known, and tracked — which is exactly what the old world, back in chapter zero, wasn’t.