mrcharles
8f1642bf96
Bootstrap a regular (non-ITAR) k3s cluster on cnode1/2/3 with embedded
etcd. All cluster communication — node registration, API server, etcd
peering, flannel VXLAN — runs exclusively over Tailscale IPs. Zero LAN
addresses appear in node status or TLS certificates.
Scripts (k8s/):
- env.sh: shared config (Tailscale IPs, SSH opts, k3s version)
- wipe.sh: remove existing k3s from all cnodes
- install-cp.sh: full bootstrap (cnode1 --cluster-init, then cnode2/3 join)
- join-servers.sh: re-join cnode2/3 only (fixes broken join state)
- post-setup.sh: apply NoSchedule taints, fetch kubeconfig, verify
- verify.sh: 13-point health check (nodes, Tailscale IPs, taints, etcd,
CoreDNS, API server, workload isolation)
- probe-nodes.sh: SSH + Tailscale reachability check
All 3 cnodes are tainted control-plane:NoSchedule so no user workloads
can schedule on the control plane. 13/13 health checks pass.
Docs updated: k8s README TL;DR reflects k3s (not Talos) as the deployed
choice, with Talos preserved for the future ITAR cluster.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
PFVCluster
Unified infrastructure repo for the Known Element Enterprises Proxmox R&D cluster.
→ Current Status · → Documentation Index · → Agent Guidelines
Directory Structure
| Directory | Description |
|---|---|
provisioning/ |
Server provisioning (SetupNewSystem.sh, security hardening, 2FA, NTP/DNS config, SNMP, Dell OMSA) |
tests/ |
Test suite + VM validation harness |
dns-cluster-setup/ |
Technitium DNS cluster replication scripts |
perf/ |
Proxmox performance tuning, fleet audit, iperf, switch diagnostics |
netinfra/ |
pfv-netinfra-01/02 DNS/NTP setup + audit scripts |
switches/ |
Switch configuration captures |
docs/ |
All documentation (see docmap) |
vendor/ |
Vendored KNELShellFramework |
Quick Start
Provision a new server
sudo bash provisioning/SetupNewSystem.sh
Validate on the sandbox VM
VM_ID=6000 ./tests/vm-validation.sh all
Deploy DNS cluster
cd dns-cluster-setup/ && ./setup.sh all
Deploy perf tunings
cd perf/ && ./deploy-tuning.sh
Architecture
- Proxmox hosts: 7 standalone PVE installs managed via PDM
- DNS: Technitium (authoritative) + Pi-hole (recursive) on pfv-netinfra-01/02
- NTP: pfv-netinfra-01/02 (redundant, LAN IPs, stratum 2/3)
- Production: Cloudron VPS in Reston VA (this cluster is R&D only)
- Backups: Proxmox Backup Server (PBS)