Working on a split staging/prod hybrid-cloud k3s setup using nixos, tailscale, systemd-nspawn and fluxcd. If someone has advice for running k3s in unprivileged (mounts idmapped) nspawn containers, I’m all👂.
This will run
- (openwisp)[https://openwisp.org/] to make it feasible to provide lots of less tech-savvy people in the local community with secure, simple, privacy-respecting wifi using free software and recycled routers.
- Various libre software I’m helping community, unions and political orgs adopt. Notably Discourse and Peertube.
Cool, I haven’t tried either of those.
I’m the type of person who likes to upgrade my systems via the terminal because I like to know the detailed processes, but I’ve also burned myself numerous times; hence my preference for declarative and immutable/atomic solutions.
It’s (quite) a bit more of a hassle, but I’ve lost trust in GUIs.
k3s is fairly simple (as far as k8s distros go). Helm is good to start with but for the long run I recommend using kubernetes manifests directly (i.e.
kubectl apply -f pvc.yaml
, deployment.yaml, etc) rather than helm, because there are quite a few gotchas with helm which can cause trouble. Besides that, it’s good practice to use the--secrets-encryption
flag on the server node(s), and if you’re deploying agent nodes it’s good to use bootstrap tokens (k3s token create
)