Operations

Operations

Day-to-day operations for the pitower Kubernetes cluster running on Talos Linux.

Overview

Cluster lifecycle is managed declaratively with topf. talos/pitower/ contains a topf.yaml (cluster identity, node inventory, Talos/Kubernetes versions, schematic references) plus layered machine-config patches. Secrets stay SOPS-encrypted on disk; topf decrypts secrets.sops.yaml transparently with the age key that the root mise.toml points SOPS_AGE_KEY_FILE at.

Run topf from talos/pitower as mise exec -- topf ..., or through the justfile recipes that wrap it. The Talos Apply workflow also runs topf apply for the whole cluster on every merge to main that touches talos/.

talosctl is still used for read-only diagnostics (logs, services, dashboards) and Kubernetes minor upgrades (talosctl upgrade-k8s).

flowchart TD
    Operator((Operator))
    CI[Talos Apply workflow]
    Just[justfile recipes]
    Topf[topf]
    Talosctl[talosctl]
    Kubectl[kubectl]
    ArgoCD[ArgoCD]

    Operator -->|mise exec -- topf| Topf
    Operator --> Just
    CI -->|on merge to main| Topf
    Just -->|apply, upgrade, reset, render| Topf
    Just -->|diagnostics| Talosctl
    Just -->|addons| Kubectl
    ArgoCD -->|sync| Kubectl

    Topf -->|sops + age| Secrets[(secrets.sops.yaml)]
    Topf --> Nodes[Talos Nodes]
    Talosctl --> Nodes
    Kubectl --> API[Kubernetes API]

Quick Reference

Run from talos/pitower. apply and upgrade prompt y/n per node; review --dry-run first and add the global --confirm=false only when running non-interactively.

Sections

Node Layout (pitower)

All nodes sit on VLAN 20. worker-01..03 are the control planes behind the API VIP 10.20.10.0.