Infrastructure on Kubernetes

My projects run on two Kubernetes clusters: a production one on dedicated servers and a home one, where I learn and try changes first. I built both from scratch in 2026 and I keep them running myself.

Everything that runs on a cluster is described in a repository. Argo CD compares the repository with the cluster and shows every difference, and I start each deployment deliberately, one application at a time. So every change can be reviewed before it ships and rolled back after. Passwords enter the repository only in encrypted form.

The servers run Talos Linux: a system with no SSH and no shell, managed only through its API. Cilium handles traffic inside the cluster, and every application has its own network rules: deny everything first, then explicitly list the connections it really needs.

Image and Helm chart updates are proposed by Renovate as pull requests, after a waiting period once a release is out. Nothing merges on its own. Monitoring checks the sites from outside, as well as certificates, disks, databases and game servers, and a missing fresh backup triggers an alert just like a site that is down. Alerts reach my phone.

Below are a few terminal sessions. Machine names, addresses and versions of internet-facing services are left out on purpose.

Applications on the production cluster

# 07.2026 – Kubernetes from zero on the home cluster; 08.2026 – the same setup in production
$ kubectl get applications -n argocd -o name
application.argoproj.io/argocd
application.argoproj.io/bwitek
application.argoproj.io/cert-manager
application.argoproj.io/cilium
application.argoproj.io/databases
application.argoproj.io/discourse
application.argoproj.io/gameservers
application.argoproj.io/gamingplatform
application.argoproj.io/ghostpizza
application.argoproj.io/gitea
application.argoproj.io/monitoring
application.argoproj.io/sealed-secrets
application.argoproj.io/traefik

Every application starts from deny-all; allowed connections are listed explicitly

$ kubectl get networkpolicy -n ghostpizza -o name
networkpolicy.networking.k8s.io/default-deny
networkpolicy.networking.k8s.io/allow-dns-egress
networkpolicy.networking.k8s.io/allow-ingress-from-nodes
networkpolicy.networking.k8s.io/allow-mariadb-egress

Since 08.2026 updates arrive as pull requests from Renovate; I merge them by hand

$ git log --merges --format=%s -4
Merge pull request 'deps: Update Helm release traefik' (#33) from renovate/traefik into main
Merge pull request 'deps: Update base images' (#27) from renovate/base-images into main
Merge pull request 'deps: Update Helm release argo-cd' (#29) from renovate/argo-cd into main
Merge pull request 'deps: Update Helm release cert-manager' (#34) from renovate/cert-manager into main

An alert is not only "the site is down": a backup that did not happen raises one too

$ kubectl get prometheusrules -n monitoring -o jsonpath='{..alert}' | tr ' ' '\n'
BlackboxProbeFailed
BlackboxCertExpiringSoon
HostDiskSpaceLow
MariadbDown
MariadbBackupStale
GiteaDataBackupStale
GhostpizzaUploadsBackupStale
GameServerDown
ContainerOOMKilled