devata is a three-node Talos Kubernetes homelab built as a small but real platform: Kubernetes state is reconciled from Git, Cilium owns the dataplane, Longhorn replicates selected volumes, Velero sends selected backups off-cluster, and the observability stack records how the system behaves.
This is not a generated inventory or a collection of chat transcripts. It is a field guide for a human operator. Each path connects four questions:
- What was built?
- Why was it built this way?
- What mechanism makes it work?
- What evidence and inputs would let someone rebuild it?
First visit
Read start-here, then devata-system-map. Use reconstructing-devata when you want the authoritative rebuild order rather than the chronological story.
Understand the platform
- devata-system-map maps hardware, Talos, Kubernetes, GitOps, networking, storage, backup, secrets, and observability into one current architecture.
- kubernetes builds the controller and API-object mental model used throughout the vault.
- talos explains why nodes have no SSH or package manager, what the machine configuration owns, and how that changes recovery.
- concept-map groups the reusable concepts independently of the project that first introduced them.
Reconstruct and operate it
- reconstructing-devata orders trust material, Talos nodes, Kubernetes access, Argo CD, secrets, storage, workloads, and end-to-end proof.
- devata-troubleshooting-method generalizes the incident method used across the strongest case studies.
- recovering-loki-wal-replay-oom is the strongest incident learning path: symptom, retained failure loop, recovery ceiling, declarative handoff, and synthetic log proof.
- deleting-the-hypervisor is a dated bare-metal migration record with rollback gates and reboot-level persistence evidence.
- streaming-aggregate-hubble-traffic traces a closed aggregate from Prometheus through an outbound producer and Cloudflare relay to a public WebSocket consumer, including two failures that appeared only after merge.
- longhorn-and-velero explains the current replicated-storage and off-cluster-backup design that followed the bare-metal migration.
Follow the build story
These are historical walkthroughs. Their opening state is intentionally preserved, while each page now points to the current successor design.
- bootstrapping-argocd establishes the first reconciliation root and proves self-heal.
- migrating-the-imperative-stack adopts existing infrastructure without recreating healthy workloads.
- installing-sealed-secrets makes encrypted credentials reconstructable from Git plus an off-cluster controller key.
- publishing-the-cluster-snapshot gives the public site a bounded, read-only view of cluster health.
Trace important data paths
- going-cilium-only follows DNS to a Service, EndpointSlice, Cilium eBPF service translation, and a real backend without kube-proxy.
- building-devata-overview traces a Grafana dashboard from Git and ConfigMap JSON through a sidecar and shared volume to PromQL results.
- streaming-aggregate-hubble-traffic follows aggregate Hubble rates across the private-cluster, Cloudflare, and browser trust boundaries, including stale snapshot fallback.
- recovering-loki-wal-replay-oom traces logs from Promtail through Loki’s write-ahead log and durable storage, including the failure path.
See what is still missing
kubernetes-coverage rates this vault as a human learning and reconstruction system. It uses the current CKA, CKAD, and CKS domains as a coverage benchmark, not as a substitute curriculum. The largest remaining gaps are workload lifecycle and scheduling, systematic troubleshooting drills, cluster and supply-chain security, upgrades, and a full destructive rebuild rehearsal.
The dated journey records how the work unfolded. It is useful evidence, but architecture and operations pages take precedence when the two disagree.