The Lentago Labs Kubernetes platform — everything above the nodes. A standing k3s cluster on our own LXC guests (on-prem, the machines in our own building) is the default home for workloads; an ephemeral EKS overlay is stood up and torn down per task when a job genuinely needs cloud Kubernetes. Everything is reconciled pull-based via Flux: the controllers run inside the cluster and pull desired state from this repo — CI validates manifests, it never deploys them. The first workload migrating in is n8n (from LXC 113).
Authorship: The manifests, documentation, and configuration in this repo are co-written with Claude (Anthropic). I direct the work and review the output; Claude writes the YAML and prose. I'm an infrastructure operator, not a software engineer — please don't read this repo as a portfolio of coding ability.
osmunda sits above the nodes. Node provisioning and the k3s install live elsewhere (in kalmia); this repo owns the platform: what runs on the clusters and how it gets there.
| Layer | Shape |
|---|---|
| Standing cluster | k3s on the on-prem LXC guests — k3s-1 (pve5), k3s-2 (pve4). Always on, zero standing cloud cost. |
| Cloud overlay | Ephemeral EKS, created for a specific task and torn down immediately. Control plane bills ~$0.10/h while it exists — a deliberately flagged exception to free-tier-first. |
| GitOps | Pull-based via Flux. Controllers reconcile in-cluster from clusters/; CI does not deploy. |
| Workload identity | Continues the fleet's OIDC thesis — IRSA on the EKS side. |
| First workload | n8n, migrating off LXC 113. Manifests in apps/n8n/ are a pre-cutover draft. |
Why it's built this way is recorded in the ADRs, framed as fit-for-this-environment choices rather than claims about the better tool:
- ADR-0001 — k3s on-prem, EKS only when ephemeral (cost sovereignty).
- ADR-0002 — Flux for GitOps (lighter footprint for a 2-node on-prem cluster; reconcilers match the pull-not-push thesis).
| Path | Purpose |
|---|---|
clusters/lab/ |
Flux entrypoint for the standing k3s cluster: flux-system/ bootstrap placeholder + Kustomizations (infra → apps) |
clusters/eks-ephemeral/ |
Overlay skeleton for the on-demand EKS cluster |
apps/n8n/ |
n8n Deployment / PVC / Service / Ingress — pre-cutover draft |
infra/ |
Ingress controller + storage notes and the infrastructure reconcile target |
runbooks/ |
eks-up.md / eks-down.md — stand-up / tear-down with the cost gate |
docs/adr/ |
Architecture decision records |
.github/workflows/kubeconform.yml |
Validates every manifest under apps/ + clusters/ on each PR |
The one rule that is load-bearing: the EKS control plane must never be left up idle. It bills ~$0.10/hour for as long as it exists — the single flagged exception to the fleet's free-tier-first stance. The runbooks make standing it up inseparable from tearing it down:
runbooks/eks-up.md— stand up for a specific, time-boxed task.runbooks/eks-down.md— stop the meter the moment the task is done.
Durable state never lives on the ephemeral side; it stays on-prem or in a managed service.
- Reconciliation is pull-based.
flux bootstrapinstalls the GitOps-toolkit controllers into the cluster and points them atclusters/lab/. They then reconcileinfrastructure.yaml(ingress, storage) beforeapps.yaml(n8n, …) on an interval. Nothing is pushed from CI. Seeclusters/lab/README.md. - CI validates, it does not deploy.
kubeconform.ymlruns on every PR and validates the manifests underapps/andclusters/against the Kubernetes schemas. Custom resources (Flux, kustomize) are skipped; core resources are checked strictly. - Images are digest-pinned. e.g. n8n is pinned by
@sha256:…so the deployed bits never drift from the reviewed ones.
🌱 Lentago Labs is a pro-bono operations practice for organizations that run on volunteers, donations, and one overworked tech person. Everything here is free to take, and we practice what we publish: our own estate runs this way, in the open. Start at the org profile.