Files

T

agent-company d621b211b0 Add cluster state audit document (Phase 0)

Document current cluster state including nodes, namespaces, ingress,
Flux kustomizations/Helm releases, storage classes, and resource
headroom analysis. Flags cp-1 as near capacity and notes missing
metrics-server.

Closes #1

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-05-19 00:11:19 +00:00

6.0 KiB

Raw Permalink Blame History

Cluster State Audit

Date: 2026-05-19 Cluster: testing1/first-cluster (Talos Linux) Audited by: Repo Manager (agent)

Nodes

3-node control-plane cluster. No dedicated worker nodes.

NAME   STATUS   ROLES           AGE   VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE          KERNEL-VERSION   CONTAINER-RUNTIME
cp-0   Ready    control-plane   84d   v1.33.0   10.0.1.3      <none>        Talos (v1.11.5)   6.12.57-talos    containerd://2.1.5
cp-1   Ready    control-plane   84d   v1.33.0   10.0.1.4      <none>        Talos (v1.11.5)   6.12.57-talos    containerd://2.1.5
cp-2   Ready    control-plane   84d   v1.33.0   10.0.1.54     <none>        Talos (v1.11.5)   6.12.57-talos    containerd://2.1.5

Per-node capacity: 4 CPU, ~7.7 GiB memory, 110 pods max Cluster totals: 12 CPU, ~23.1 GiB memory, 330 pods max

Namespaces

21 namespaces total. Workload namespaces (excluding system):

Namespace	Age	Purpose
agent-company	59d	Agent company workloads
authentik	64d	Identity provider (SSO)
cert-manager	64d	TLS certificate management
coredns	64d	DNS
gatus	64d	Uptime monitoring
gitea-actions-runner	48d	CI runner for Gitea
gitea-mobile	53d	Gitea mobile app
logging	52d	Logging stack (Grafana)
mail	62d	Mail services
metallb-system	64d	Bare-metal load balancer
monitoring	51d	Monitoring stack
nfs-provisioner	64d	NFS storage provisioner
nixos-dev	64d	NixOS dev environment
sealed-secrets	55d	Sealed secrets controller
sparc	64d	Sparc application
traefik	64d	Ingress / reverse proxy

Ingress Setup

No standard Kubernetes Ingress resources found. The cluster uses Traefik IngressRoutes (CRD-based):

Namespace	IngressRoute	Age
authentik	authentik	64d
authentik	authentik-http	64d
gatus	gatus	64d
gatus	gatus-http	64d
gitea-mobile	gitea-mobile	53d
gitea-mobile	gitea-mobile-http	53d
logging	grafana	52d
logging	grafana-http	52d
sparc	sparc	64d
sparc	sparc-http	64d
traefik	traefik-dashboard	64d

Resource Usage (Headroom)

Note: kubectl top nodes is unavailable -- Metrics API (metrics-server) is not installed. Resource requests/limits from kubectl describe nodes are used instead.

Per-Node Allocated Resources (Requests)

Node	CPU Requests	CPU %	Memory Requests	Memory %
cp-0	1710m	43%	2738Mi	37%
cp-1	3360m	85%	5950Mi	81%
cp-2	2100m	53%	4018Mi	54%

Per-Node Limits (for overcommit awareness)

Node	CPU Limits	CPU %	Memory Limits	Memory %
cp-0	7300m	184%	8320Mi	113%
cp-1	9700m	245%	13908Mi	190%
cp-2	6500m	164%	11008Mi	150%

Headroom

WARNING -- The following nodes have less than 20% free capacity by requests:

cp-1 CPU: 85% requested -- only 15% headroom. This node is near capacity for CPU requests.
cp-1 Memory: 81% requested -- only 19% headroom. This node is near capacity for memory requests.

ADVISORY -- Overcommit risk:

All three nodes have CPU and memory limits exceeding 100%. This means actual usage spikes could cause OOM kills or CPU throttling. This is common in non-production clusters but should be monitored.

cp-0: CPU limits at 184%, memory limits at 113%
cp-1: CPU limits at 245%, memory limits at 190%
cp-2: CPU limits at 164%, memory limits at 150%

Recommendation: Install metrics-server to enable kubectl top and real-time resource monitoring. Consider adding a dedicated worker node if workloads continue to grow, as cp-1 is already heavily loaded.

Flux Kustomizations

All kustomizations are reconciled and ready.

NAMESPACE    NAME            REVISION                SUSPENDED  READY  MESSAGE
flux-system  apps            main@sha1:c48d8414      False      True   Applied revision: main@sha1:c48d8414
flux-system  authentik       main@sha1:c48d8414      False      True   Applied revision: main@sha1:c48d8414
flux-system  cert-config     main@sha1:c48d8414      False      True   Applied revision: main@sha1:c48d8414
flux-system  flux-config     main@sha1:c48d8414      False      True   Applied revision: main@sha1:c48d8414
flux-system  infrastructure  main@sha1:c48d8414      False      True   Applied revision: main@sha1:c48d8414
flux-system  traefik         main@sha1:c48d8414      False      True   Applied revision: main@sha1:c48d8414
flux-system  traefik-config  main@sha1:c48d8414      False      True   Applied revision: main@sha1:c48d8414

Flux Helm Releases

All Helm releases are reconciled and ready.

NAMESPACE       NAME            REVISION   SUSPENDED  READY  MESSAGE
authentik       authentik       2026.2.3   False      True   Helm upgrade succeeded
cert-manager    cert-manager    v1.14.7    False      True   Helm install succeeded
sealed-secrets  sealed-secrets  2.18.5     False      True   Helm upgrade succeeded
traefik         traefik         28.3.0     False      True   Helm upgrade succeeded

Storage Classes

NAME                   PROVISIONER                                   RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE
nfs-client (default)   k8s-sigs.io/nfs-subdir-external-provisioner   Delete          Immediate           false                  64d

Single storage class using NFS. Volume expansion is not enabled. Reclaim policy is Delete (PVCs are cleaned up on release).

Summary

Item	Status
Nodes	3x control-plane, all Ready, Talos v1.11.5, K8s v1.33.0
Namespaces	21 total (16 workload, 5 system)
Ingress	Traefik IngressRoutes (11 routes across 6 namespaces)
Flux	7 kustomizations, 4 Helm releases -- all healthy
Storage	NFS-backed default StorageClass
Headroom	cp-1 is near capacity (85% CPU, 81% memory requests)
Metrics	metrics-server NOT installed -- no real-time usage data

6.0 KiB Raw Permalink Blame History