Kubernetes Homelab


Thanks for the videos and helping me. https://blog.mattjarrett.dev/homelab/

## Platform Stack

| Layer | Technology |
|---|---|
| **Cluster** | k3s on 4× Raspberry Pi 5 (1 controller 16gb , 3 workers 8gb ) |
| **Storage** | Longhorn - distributed block storage with 3× NVMe replication |
| **GitOps** | Argo CD - cluster state driven from this repo |
| **Observability** | Prometheus + Grafana + Alertmanager + Loki |
| **Ingress + TLS** | Traefik + cert-manager (local CA for `*.local.lab`, Let's Encrypt for public) |
| **DNS** | AdGuard Home - wildcard `*.local.lab → 192.168.10.100` for all network devices |
| **CNI** | flannel - k3s's own pod networking, with kube-router enforcing NetworkPolicy |
| **Service Mesh** | Istio - sidecar mesh for workload mTLS |
| **Tunnel** | Cloudflare Tunnel - zero-trust public ingress, no exposed firewall ports |
| **Remote Access** | Tailscale subnet router on ctrl-1 |
| **Workload Identity** | SPIRE - SPIFFE identity per pod, published over OIDC so AWS and Entra trust it |
| **Platform API** | Crossplane - XRDs and Compositions expose self-service infrastructure APIs |

## Hardware

| Item | Qty |
|---|---|
| Raspberry Pi 5 16GB (Controller) | 1 |
| Raspberry Pi 5 8GB (Workers) | 3 |
| GeeekPi P31 M.2 NVMe PoE+ HAT (Pi 5) | 4 |
| 256GB M.2 2230 NVMe SSD | 4 |
| Netgear GS305PP 5-Port PoE+ Switch | 1 |
| GeeekPi DeskPi RackMate T0 Plus 10" 4U Rack | 1 |
| GeeekPi 6.91" 1U Rack LCD (1424×280) | 1 |

The issue describes a Kubernetes homelab and links to blog.mattjarrett.dev/homelab/, but it does not name a repository file, test, or requested change. First clarify whether this is intended as a build submission or documentation update, then identify the repository location and acceptance criteria for the contribution.

Written by the indexing model from the issue text.