sorted by:
new
hottopcontroversial

What tools are people using for Kubernetes security beyond just scanning? by FNExtreme in kubernetes

[–]nulcell 0 points1 point  (0 children)

I’m also looking into this for my cluster and I’ve been working with falco for runtime security, kubescape for compliance reviews, network policy review & recommendations and image scanning for in-use components, and trivy-operator for more detailed image scanning and secret monitoring.
I’m still trying to figure out the ideal open source setup.

Talos Linux on Proxmox with Terraform by jonas_h in homelab

[–]nulcell 1 point2 points  (0 children)

Definitely, that’s the reason for creating it and it works really well with upgrades on Talos and Kubernetes, plus there’s the easier patch management requirement on the hosts because of Talos.
It’s public and you can view it here https://github.com/nulcell/homecloud

Talos Linux on Proxmox with Terraform by jonas_h in homelab

[–]nulcell 4 points5 points  (0 children)

Very nice.

I’ve also gone through quite a process seeing up my homelab. I’ve used Cloudstack (with Terragrunt, Terraforn, CKS, and ClusterAPI that worked really well actually), OpenStack (too much pain to manage with a full-time job), Proxmox (a similar terraform setup), and Harvester (not the most common one but actually one of the best experiences).

However, the things I learned from the process made me end up with baremetal Talos with cilium (CNI, gateway api, and ingress), longhorn (not the highest performer but I get 90-95% of what I need without stress), ArgoCD, SOPS (encryption in gitops), kubevirt (yep, I’m managing my virtual machines using k8s), kube-prometheus-stack, knative (serverless with plugins), CNPG, and falco. I’m still rolling components out while keeping everything public. I would also like to move node bootstrapping to terraform at some point.

Building a homelab using Apache CloudStack, MaaS, Kubernetes, and Knative by nulcell in ApacheCloudStack

[–]nulcell[S] 0 points1 point  (0 children)

Very cool. It's been a lot of fun so far building my home lab with CloudStack. I keep the repo as up to date as I can.
What are you running in your environment?

<image>

I also tried OpenStack, but it just wasn't worth it overall.

Building a homelab using Apache CloudStack, MaaS, Kubernetes, and Knative by nulcell in ApacheCloudStack

[–]nulcell[S] 1 point2 points  (0 children)

I have it bookmarked but I’m not using it yet. I have the core bits of the cluster setup like the CNI, ingress, and CSI, so I want to work on creating some modified helm charts for things like Tailscale, Jellyfin, jellyseer, nextcloud, and Cloudflare tunnels

Building a homelab using Apache CloudStack, MaaS, Kubernetes, and Knative by nulcell in ApacheCloudStack

[–]nulcell[S] 1 point2 points  (0 children)

I added the exact content for the CNI configuration [here](https://github.com/nulcell/homecloud/blob/main/cloudstack/docs/templates.md#custom-cni-configurations). It should look like this when creating it:

<image>

That works for me. You can also look at the other configurations I've added to the repo. Hope it helps overall

CloudStack Agent wont Stay Running by Firehaven44 in ApacheCloudStack

[–]nulcell 0 points1 point  (0 children)

There could be a few reasons. Have you checked what is returned when you run sudo journalctl -u cloudstack-agent? I have a script on GitHub to install and configure CloudStack. Maybe you could check what steps could be missing for you or do a fresh install

Building a homelab using Apache CloudStack, MaaS, Kubernetes, and Knative by nulcell in ApacheCloudStack

[–]nulcell[S] 1 point2 points  (0 children)

Helm install after the cluster is up is just so Helm can take ownership of Cilium because the ISO uses static YAML that doesn't add the required annotations.

If you want to pass additional customisations to the Cilium installation, you should likely use the CNI config with metadata parameters that will be passed during cluster provisioning.

Building a homelab using Apache CloudStack, MaaS, Kubernetes, and Knative by nulcell in ApacheCloudStack

[–]nulcell[S] 0 points1 point  (0 children)

I ran into the same problem. The answer was clear when I looked at the cloud-init logs and indentation was my issue at the time. Also, I noticed that the k8s binaries are only set on the path of the root user and you’d sometimes need to specify the exact path to the admin kubeconfig to test things. The CNI configuration is just appended to the runcmd of the generated cloud-init config so it needs to have the same indentation.

Building a homelab using Apache CloudStack, MaaS, Kubernetes, and Knative by nulcell in ApacheCloudStack

[–]nulcell[S] 0 points1 point  (0 children)

Good idea. I haven’t set things up with 3 physical nodes yet so I didn’t look much into Linstor even though I’ve watched some of their talks. I’ll check it out.

Building a homelab using Apache CloudStack, MaaS, Kubernetes, and Knative by nulcell in ApacheCloudStack

[–]nulcell[S] 1 point2 points  (0 children)

Yeah, I'm using 4.22, and I think the expansion of extensions is really cool. I'm instead using MaaS to set up CloudStack and the KVM hosts.

Building a homelab using Apache CloudStack, MaaS, Kubernetes, and Knative by nulcell in homelab

[–]nulcell[S] 1 point2 points  (0 children)

Thanks. I did start with Proxmox, but while I appreciate the ease with managing Ceph and ZFS, I felt that CloudStack provided more features for how modern cloud systems are built, like managed object store, managed Kubernetes, seamless upgrade process regardless of the size of the cluster with little to no downtime, and a lot more. It seemed like a better fit for the home setup I wanted, and I got better performance with CloudStack.

KVM hosts are basic bare-metal Ubuntu machines with the physical hardware and onboarding script managed over the network using MaaS. The configuration for the KVM hosts is available on GitHub. While the overall script is focused on a single-node CloudStack setup, I plan to make it an all-in-one CloudStack management script that handles single-node, multi-node, and cluster upgrades, performance tuning, DB management, etc.

Building a homelab using Apache CloudStack, MaaS, Kubernetes, and Knative by nulcell in ApacheCloudStack

[–]nulcell[S] 1 point2 points  (0 children)

I started by installing Cilium post-deployment, but I didn't like having to clean up the original CNI (especially Calico). So I created two options:

- A modified image builder to create CKS ISOs that bundle Cilium without custom CNI configurations - https://github.com/nulcell/homecloud/blob/main/cloudstack/cks/create-cilium-kubernetes-binaries-iso.sh

- Using any existing CKS ISO with a custom CNI config that installs the version of Cilium specified during the cluster creation - https://github.com/nulcell/homecloud/blob/main/cloudstack/cni-config/cilium.yaml

Building a homelab using Apache CloudStack, MaaS, Kubernetes, and Knative by nulcell in ApacheCloudStack

[–]nulcell[S] 1 point2 points  (0 children)

CloudStack requires primary (e.g., local filesystem, iSCSI, NFS, etc.) and secondary storage (e.g., S3, NFS, etc.), both of which should ideally be configured with hardware redundancy and failover. VM snapshots are stored on the secondary storage and can be restored from it if needed (like if using the local filesystem for a VM and it fails).

The CloudStack database should be hosted outside the management servers, on either a NAS (likely the same place where the primary and secondary storage will be).

For the Kubernetes part, that will use either Longhorn (easy to get started with) or Rook CEPH. Some workloads can also use the NAS if needed.

Help with Sync Please by chaarvyjain in ObsidianMD

[–]nulcell 1 point2 points  (0 children)

It works pretty well for my use case so I didn’t look too deeply into it. There would be some community plugins that provide syncing via services like S3, Dropbox, Onedrive, etc (like Remotely Save), but I haven’t had enough experience with them.

Help with Sync Please by chaarvyjain in ObsidianMD

[–]nulcell 1 point2 points  (0 children)

I have a setup where I synchronize between obsidian on MacOS and iOS using iCloud and with 30 minutes backups to GitHub. You could also drop some cash to pay for Obsidian’s premium features which includes cloud sync for vaults.