System
Foundational services bootstrapped by Ansible before GitOps takes over. These run in kube-system (or automation for ArgoCD) and form the immutable base the rest of the platform builds on.
graph TB
classDef gitops fill:#5E8A3F,color:#F4F2EC,stroke:#A3CF7A,stroke-width:2px
classDef svc fill:#1e2b1c,color:#A3CF7A,stroke:#5E8A3F,stroke-width:1px
subgraph GITOPS["🔄 GitOps"]
ARGOCD[ArgoCD]:::gitops
end
subgraph NETWORKING["🌐 Networking"]
TRAEFIK[Traefik]:::svc
EDNS[External-DNS]:::svc
end
subgraph STORAGE["💾 Storage"]
NFS[NFS Subdir Provisioner]:::svc
LONGHORN[Longhorn]:::svc
SNAPSHOT[Snapshot Controller]:::svc
end
subgraph CLUSTER_OPS["⚙️ Cluster Operations"]
REFLECTOR[Kubernetes Reflector]:::svc
RELOADER[Stakater Reloader]:::svc
METRICS[Metrics Server]:::svc
end
subgraph COMPUTE["🖥️ Compute"]
GPU[Nvidia Device Plugin]:::svc
end
ARGOCD -->|"manages"| NETWORKING
ARGOCD -->|"manages"| STORAGE
ARGOCD -->|"manages"| CLUSTER_OPS
ARGOCD -->|"manages"| COMPUTE
TRAEFIK --> EDNS
LONGHORN --> SNAPSHOTStorage
NFS Subdir Provisioner
Bulk shared filesystem backed by the NAS NFS share. Provides a nfs StorageClass that dynamically creates subdirectory-per-PVC on the NAS — used for high-capacity workloads that need shared read-write-many access: media libraries, shared config, and high-capacity object storage (Garage S3 runs on this class for its large data volumes).
Longhorn
Replicated block storage for stateful workloads that need durability and failover. Longhorn replicates volumes across cluster nodes via CSI, provides snapshot scheduling to S3 (via Kopia), and exposes a web UI for volume inspection. Databases, message queues, and other IOPS-sensitive services use Longhorn PVCs.
Snapshot Controller
Implements the VolumeSnapshot Kubernetes API. Works with the Longhorn CSI driver so that VolumeSnapshot objects trigger real point-in-time snapshots, consumed by Velero and Kopia for consistent backup pipelines.
Networking
Traefik
Ingress controller and reverse proxy running as a DaemonSet on every node. Traefik terminates TLS (certificates from cert-manager), routes traffic via IngressRoute resources, and runs OAuth2-Proxy as a ForwardAuth middleware so every annotated route passes through SSO before hitting the backend.
External-DNS
Watches Ingress and Service resources and automatically upserts DNS A/CNAME records in the configured DNS provider. Adding a new service with the right annotation is enough to get a live public DNS record — no manual DNS management.
Cluster Operations
Kubernetes Reflector
Mirrors Secrets and ConfigMaps across namespaces based on annotations. Used to propagate the wildcard TLS certificate and shared credentials (S3 keys, registry pull secrets) from a single source namespace to every consumer without duplication or drift.
Stakater Reloader
Watches ConfigMaps and Secrets for changes and automatically triggers rolling restarts of annotated Deployments and DaemonSets. Annotate a workload with reloader.stakater.com/auto: "true" and config changes roll out without manual intervention.
Metrics Server
Aggregates real-time CPU and memory usage from the kubelet on each node. Powers kubectl top node/pod and is required by the Horizontal Pod Autoscaler for resource-based scaling decisions.
Compute
Nvidia Device Plugin
Runs as a DaemonSet and advertises nvidia.com/gpu as a schedulable resource on the GPU node. Ollama and other inference workloads request the GPU via resources.limits and get exclusive access to it during inference.
GitOps
ArgoCD
The single control plane for the entire platform. Bootstrapped last by Ansible, ArgoCD then takes over management of every other service via Application and ApplicationSet resources pointing at Git repositories. Nothing is applied manually after this point.
Changes flow into the cluster via GitHub and GitHub Actions before ArgoCD picks them up. See the CI/CD page for how repositories, quality gates, Renovate, and the deployment pipeline are wired together.