Skip to content

Architecture Overview

devhome

devhome's compute, storage, and Kubernetes footprint all live on-prem, reachable through a single UniFi core switch (Office-Aggregation) trunking one native LAN and two tagged VLANs down from pfSense: LAN (10.10.10.0/24, clients), VLAN 20 (10.10.20.0/24, management/storage), and VLAN 30 (10.10.30.0/24, VM workloads).

Architecture overview diagram

Design principles worth calling out

  • Everything is provisioned by IAC, nothing is clicked. Terraform owns hosts/clusters/VMs, Packer owns golden images, Ansible owns day-2 configuration, ArgoCD owns what runs inside clusters.
  • Secrets live in Vault, never in git. — see Vault Overview.
  • DHCP over static reservations, by default. Most lab nodes get DHCP leases with no reservation, which is fine in steady state but has bitten the management cluster more than once during network churn — see Kubernetes Troubleshooting.
  • Floating VIPs over pinned IPs, going forward. The kube-vip design (terraform/vsphere/modules/k8s) decouples a cluster's API endpoint from any single node's IP using BGP-advertised addresses, the same mechanism Calico already uses for LoadBalancer IPs. New clusters get this from day one; dke-mgmt gets it when rebuilt.

See Network Design for VLAN layout and Compute & Storage for the ESXi/datastore layout.