agent-company
d621b211b0
Document current cluster state including nodes, namespaces, ingress, Flux kustomizations/Helm releases, storage classes, and resource headroom analysis. Flags cp-1 as near capacity and notes missing metrics-server. Closes #1 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
162 lines
6.0 KiB
Markdown
162 lines
6.0 KiB
Markdown
# Cluster State Audit
|
|
|
|
**Date:** 2026-05-19
|
|
**Cluster:** testing1/first-cluster (Talos Linux)
|
|
**Audited by:** Repo Manager (agent)
|
|
|
|
---
|
|
|
|
## Nodes
|
|
|
|
3-node control-plane cluster. No dedicated worker nodes.
|
|
|
|
```
|
|
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
|
|
cp-0 Ready control-plane 84d v1.33.0 10.0.1.3 <none> Talos (v1.11.5) 6.12.57-talos containerd://2.1.5
|
|
cp-1 Ready control-plane 84d v1.33.0 10.0.1.4 <none> Talos (v1.11.5) 6.12.57-talos containerd://2.1.5
|
|
cp-2 Ready control-plane 84d v1.33.0 10.0.1.54 <none> Talos (v1.11.5) 6.12.57-talos containerd://2.1.5
|
|
```
|
|
|
|
**Per-node capacity:** 4 CPU, ~7.7 GiB memory, 110 pods max
|
|
**Cluster totals:** 12 CPU, ~23.1 GiB memory, 330 pods max
|
|
|
|
---
|
|
|
|
## Namespaces
|
|
|
|
21 namespaces total. Workload namespaces (excluding system):
|
|
|
|
| Namespace | Age | Purpose |
|
|
|---|---|---|
|
|
| agent-company | 59d | Agent company workloads |
|
|
| authentik | 64d | Identity provider (SSO) |
|
|
| cert-manager | 64d | TLS certificate management |
|
|
| coredns | 64d | DNS |
|
|
| gatus | 64d | Uptime monitoring |
|
|
| gitea-actions-runner | 48d | CI runner for Gitea |
|
|
| gitea-mobile | 53d | Gitea mobile app |
|
|
| logging | 52d | Logging stack (Grafana) |
|
|
| mail | 62d | Mail services |
|
|
| metallb-system | 64d | Bare-metal load balancer |
|
|
| monitoring | 51d | Monitoring stack |
|
|
| nfs-provisioner | 64d | NFS storage provisioner |
|
|
| nixos-dev | 64d | NixOS dev environment |
|
|
| sealed-secrets | 55d | Sealed secrets controller |
|
|
| sparc | 64d | Sparc application |
|
|
| traefik | 64d | Ingress / reverse proxy |
|
|
|
|
---
|
|
|
|
## Ingress Setup
|
|
|
|
No standard Kubernetes `Ingress` resources found. The cluster uses **Traefik IngressRoutes** (CRD-based):
|
|
|
|
| Namespace | IngressRoute | Age |
|
|
|---|---|---|
|
|
| authentik | authentik | 64d |
|
|
| authentik | authentik-http | 64d |
|
|
| gatus | gatus | 64d |
|
|
| gatus | gatus-http | 64d |
|
|
| gitea-mobile | gitea-mobile | 53d |
|
|
| gitea-mobile | gitea-mobile-http | 53d |
|
|
| logging | grafana | 52d |
|
|
| logging | grafana-http | 52d |
|
|
| sparc | sparc | 64d |
|
|
| sparc | sparc-http | 64d |
|
|
| traefik | traefik-dashboard | 64d |
|
|
|
|
---
|
|
|
|
## Resource Usage (Headroom)
|
|
|
|
> **Note:** `kubectl top nodes` is unavailable -- Metrics API (metrics-server) is not installed. Resource requests/limits from `kubectl describe nodes` are used instead.
|
|
|
|
### Per-Node Allocated Resources (Requests)
|
|
|
|
| Node | CPU Requests | CPU % | Memory Requests | Memory % |
|
|
|---|---|---|---|---|
|
|
| cp-0 | 1710m | 43% | 2738Mi | 37% |
|
|
| cp-1 | 3360m | 85% | 5950Mi | 81% |
|
|
| cp-2 | 2100m | 53% | 4018Mi | 54% |
|
|
|
|
### Per-Node Limits (for overcommit awareness)
|
|
|
|
| Node | CPU Limits | CPU % | Memory Limits | Memory % |
|
|
|---|---|---|---|---|
|
|
| cp-0 | 7300m | 184% | 8320Mi | 113% |
|
|
| cp-1 | 9700m | 245% | 13908Mi | 190% |
|
|
| cp-2 | 6500m | 164% | 11008Mi | 150% |
|
|
|
|
## Headroom
|
|
|
|
**WARNING -- The following nodes have less than 20% free capacity by requests:**
|
|
|
|
- **cp-1 CPU: 85% requested** -- only 15% headroom. This node is near capacity for CPU requests.
|
|
- **cp-1 Memory: 81% requested** -- only 19% headroom. This node is near capacity for memory requests.
|
|
|
|
**ADVISORY -- Overcommit risk:**
|
|
|
|
All three nodes have CPU and memory limits exceeding 100%. This means actual usage spikes could cause OOM kills or CPU throttling. This is common in non-production clusters but should be monitored.
|
|
|
|
- cp-0: CPU limits at 184%, memory limits at 113%
|
|
- cp-1: CPU limits at 245%, memory limits at 190%
|
|
- cp-2: CPU limits at 164%, memory limits at 150%
|
|
|
|
**Recommendation:** Install metrics-server to enable `kubectl top` and real-time resource monitoring. Consider adding a dedicated worker node if workloads continue to grow, as cp-1 is already heavily loaded.
|
|
|
|
---
|
|
|
|
## Flux Kustomizations
|
|
|
|
All kustomizations are reconciled and ready.
|
|
|
|
```
|
|
NAMESPACE NAME REVISION SUSPENDED READY MESSAGE
|
|
flux-system apps main@sha1:c48d8414 False True Applied revision: main@sha1:c48d8414
|
|
flux-system authentik main@sha1:c48d8414 False True Applied revision: main@sha1:c48d8414
|
|
flux-system cert-config main@sha1:c48d8414 False True Applied revision: main@sha1:c48d8414
|
|
flux-system flux-config main@sha1:c48d8414 False True Applied revision: main@sha1:c48d8414
|
|
flux-system infrastructure main@sha1:c48d8414 False True Applied revision: main@sha1:c48d8414
|
|
flux-system traefik main@sha1:c48d8414 False True Applied revision: main@sha1:c48d8414
|
|
flux-system traefik-config main@sha1:c48d8414 False True Applied revision: main@sha1:c48d8414
|
|
```
|
|
|
|
---
|
|
|
|
## Flux Helm Releases
|
|
|
|
All Helm releases are reconciled and ready.
|
|
|
|
```
|
|
NAMESPACE NAME REVISION SUSPENDED READY MESSAGE
|
|
authentik authentik 2026.2.3 False True Helm upgrade succeeded
|
|
cert-manager cert-manager v1.14.7 False True Helm install succeeded
|
|
sealed-secrets sealed-secrets 2.18.5 False True Helm upgrade succeeded
|
|
traefik traefik 28.3.0 False True Helm upgrade succeeded
|
|
```
|
|
|
|
---
|
|
|
|
## Storage Classes
|
|
|
|
```
|
|
NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE
|
|
nfs-client (default) k8s-sigs.io/nfs-subdir-external-provisioner Delete Immediate false 64d
|
|
```
|
|
|
|
Single storage class using NFS. Volume expansion is **not** enabled. Reclaim policy is **Delete** (PVCs are cleaned up on release).
|
|
|
|
---
|
|
|
|
## Summary
|
|
|
|
| Item | Status |
|
|
|---|---|
|
|
| Nodes | 3x control-plane, all Ready, Talos v1.11.5, K8s v1.33.0 |
|
|
| Namespaces | 21 total (16 workload, 5 system) |
|
|
| Ingress | Traefik IngressRoutes (11 routes across 6 namespaces) |
|
|
| Flux | 7 kustomizations, 4 Helm releases -- all healthy |
|
|
| Storage | NFS-backed default StorageClass |
|
|
| Headroom | cp-1 is near capacity (85% CPU, 81% memory requests) |
|
|
| Metrics | metrics-server NOT installed -- no real-time usage data |
|