Sovereign Kubernetes platform on Talos Linux — staged deployment with OpenBao-backed state, PKI, secrets, and GitOps.
graph LR
B[Bootstrap<br/>Podman pod] -->|PKI + state backend| C[Cluster<br/>6 Talos nodes]
C -->|CNI + PKI + ESO| F[Flux v2<br/>GitOps]
F -->|install and reconcile| K[Platform<br/>management services]
style B fill:#4a9,stroke:#333,color:#fff
style K fill:#36f,stroke:#333,color:#fff
style F fill:#f90,stroke:#333,color:#fff
For an existing cluster, follow the ownership migration before publishing this revision to the Git reference watched by Flux. KaaS and VM/Elastic Metal transitions remain experimental.
# Prerequisites: opentofu, podman, kubectl, scw, jq, helm
make bootstrap && make bootstrap-export # Platform pod
make scaleway-iam-apply # IAM stage
make scaleway-image-apply REGION=fr-par # Talos image
make scaleway-bootstrap-vm ENV=dev INSTANCE=shared REGION=fr-par # CI/shared PN
make scaleway-up ENV=dev INSTANCE=mgmt REGION=fr-par # Cluster + stacks
make scaleway-headlamp ENV=dev INSTANCE=mgmt REGION=fr-par # Dashboard| Stack | Components | Owner |
|---|---|---|
| CNI | Cilium + local-path default StorageClass | Tofu |
| PKI | OpenBao x2 + cert-manager + 3-tier CA + ESO | Tofu; Flux PKI initialization Job |
| Monitoring | VictoriaMetrics + VictoriaLogs + Grafana + Headlamp | Flux |
| Identity | CNPG + Ory Kratos + Hydra + Pomerium (OIDC/SSO) | Flux |
| Security | Trivy + Tetragon + Kyverno + Cosign policies | Flux |
| Storage | Garage S3 + Velero + zot | Flux |
| Autoscaling | VPA + KEDA + Prometheus Adapter; optional native VM/EM Karpenter | Flux; provider owns dynamic VMs and reserved EM power state, Tofu owns pre-imaged EM stock |
| GitOps | Flux v2 (SSH → Gitea) | Tofu bootstrap |
Zero secrets in Git. Values are generated by Terraform, stored in the bootstrap OpenBao KMS, seeded into OpenBao Infra, then synced to Kubernetes by ESO.
The native provider is disabled by default. Local tests do not establish functional VPA, Talos bootstrap or hardware-tested VM/metal transitions. Follow the laboratory activation gates.
| Environment | Provider | Method |
|---|---|---|
| Scaleway | scaleway/scaleway |
OpenTofu (IAM → image → CI/shared PN → cluster → stacks) |
| Local | dmacvicar/libvirt |
OpenTofu (Linux libvirt/KVM VMs) |
| VMware air-gap | Shell scripts | Legacy/manual OVA + embedded image cache + static IPs |
make scaleway-up ENV=dev INSTANCE=mgmt REGION=fr-par # Cloud
make local-up # Local KVMbootstrap (podman pod, local or remote VM)
├── OpenBao KMS (single-node Raft) → state backend + PKI CA chain
├── vault-backend :8080 → HTTP backend for OpenTofu state
├── Gitea :3000 → Git server
└── Woodpecker :8000 → CI/CD
↓ kms-output/ (certs + tokens)
cluster (3 CP + 3 workers, Talos Linux)
├── stacks/cni/ → Cilium
├── stacks/pki/ → OpenBao Infra + App + cert-manager + ESO source secrets
├── stacks/monitoring/ → VictoriaMetrics + VictoriaLogs + Headlamp
├── stacks/identity/ → Kratos + Hydra + Pomerium
├── stacks/security/ → Trivy + Tetragon + Kyverno + Cosign
├── stacks/storage/ → Garage S3 + Velero + zot
├── stacks/autoscaling/ → VPA + KEDA + adapter; native provider opt-in
└── stacks/flux-bootstrap/ → Flux v2 → clusters/management/
↓ installation and day-2
Flux reconciles HelmReleases from Git (Gitea → flux-system)
ESO syncs secrets from in-cluster OpenBao → K8s Secrets
Each stack co-locates Terraform code, Helm values, and Flux manifests in one folder. The identity, security and storage Terraform states now only transfer existing objects to Flux without deletion. Monitoring retains its credential seed. Woodpecker validates changes; it no longer provisions infrastructure on push.
brew install scw # macOS
scw init # Interactive setup
scw iam api-key create user-id=<uid> description="talos-admin"Then create envs/scaleway/iam/secret.tfvars:
scw_access_key = "<from api-key create>"
scw_secret_key = "<from api-key create>"
scw_organization_id = "<your-org-id>"| Need | Go to |
|---|---|
| First deployment walkthrough | Getting Started |
| Deploy to a specific environment | How to Deploy |
| Upgrade an existing deployment | Upgrade Guide |
| Troubleshoot a problem | Troubleshooting |
| All Makefile targets | Command Reference |
| Configuration parameters | Configuration Reference |
| CI/CD pipeline details | CI/CD Reference |
| Architecture deep dive | Architecture |
| Bootstrap mechanics | Bootstrap Mechanics |
| Security model | Security Model |
| High-level design | HLD |
| Low-level designs | LLDs |
| Component inventory | Technology Stack |
| Architecture decisions | ADRs (30+ ADRs) |
| Flux ownership and migration | ADR-043 |
| VM / bare-metal policy and blockers | ADR-044 |
| Current audit and validation limits | Adversarial review |
| Version inventory and compatibility | Dependency audit |
| Renovate configuration and operating evidence | Renovate audit |
| Schema coverage and CI replay | Schema validation |
| AI agent context | AGENTS.md |
st4ck/
├── bootstrap/ # Platform pod: OpenBao + Gitea + Woodpecker
├── contexts/ # One YAML context per env/instance/region
├── envs/ # Provider-specific infra (Scaleway, local libvirt, legacy VMware airgap)
├── modules/ # Shared Terraform module (talos-cluster)
├── stacks/ # 1 stack = 1 folder (TF + values + flux/)
├── clusters/management # Thin kustomization → stacks/*/flux/
├── patches/ # Machine config patches (Cilium, registry mirror)
├── docs/ # Diátaxis structure (tutorials, how-to, reference, explanation)
├── scripts/ # Day-2 operations
└── tests/ # Cross-stack and E2E checks
make scaleway-down # Destroy k8s stacks + cluster (correct order)
make bootstrap-stop # Stop local platform pod
make scaleway-nuke # Destroy EVERYTHING including IAM (requires confirmation)See CONTRIBUTING.md.