Place core services and web-petting on external core nodes

2026-10-12 13:44:16 +01:00
1 parent ee7a82b0b8
commit 8e4201621d
@@ -20,6 +20,8 @@ spec:
    spec:
      dnsPolicy: Default
      nodeSelector:
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: internal
        workload/ai: "true"
      tolerations:
        - key: workload
@@ -16,6 +16,9 @@ spec:
      annotations:
        reloader.stakater.com/auto: "true"
    spec:
+      nodeSelector:
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: external
      containers:
        - name: web-petting
          image: ultradesu/web-petting:latest
@@ -1,6 +1,9 @@
 # Argo CD Helm Chart Values (k8s-ng cluster)

 global:
+  nodeSelector:
+    homelab.hexor.cy/pool: core
+    homelab.hexor.cy/exposure: external
  domain: ag.btwiusearch.net
  logging:
    format: text
@@ -1,2 +1,12 @@
 crds:
  enabled: true
+
+nodeSelector: &externalCore
+  homelab.hexor.cy/pool: core
+  homelab.hexor.cy/exposure: external
+webhook:
+  nodeSelector: *externalCore
+cainjector:
+  nodeSelector: *externalCore
+startupapicheck:
+  nodeSelector: *externalCore
@@ -1,4 +1,8 @@
 # CloudNativePG operator (chart 0.29.x = operator 1.30.x)

+nodeSelector:
+  homelab.hexor.cy/pool: core
+  homelab.hexor.cy/exposure: external
+
 crds:
  create: true
@@ -1 +1,9 @@
 installCRDs: true
+
+nodeSelector: &externalCore
+  homelab.hexor.cy/pool: core
+  homelab.hexor.cy/exposure: external
+webhook:
+  nodeSelector: *externalCore
+certController:
+  nodeSelector: *externalCore
@@ -20,6 +20,8 @@ spec:
        app: gitea
    spec:
      nodeSelector:
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: external
        kubernetes.io/hostname: music
      volumes:
        - name: storage
@@ -35,6 +35,8 @@ spec:
          - name: ndots
            value: "2"
      nodeSelector:
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: internal
        workload/ai: "true"
      tolerations:
        - key: workload
@@ -18,6 +18,8 @@ spec:
        spec:
          restartPolicy: OnFailure
          nodeSelector:
+            homelab.hexor.cy/pool: core
+            homelab.hexor.cy/exposure: external
            kubernetes.io/hostname: music
          volumes:
            - name: storage
@@ -22,5 +22,7 @@ patches:
      - op: replace
        path: /spec/template/spec/nodeSelector
        value:
+          homelab.hexor.cy/pool: core
+          homelab.hexor.cy/exposure: internal
          kubernetes.io/arch: amd64
          workload/ai: "true"
@@ -31,5 +31,7 @@ tolerations:

 node_selector_enabled: true
 node_selector:
+  homelab.hexor.cy/pool: core
+  homelab.hexor.cy/exposure: internal
  kubernetes.io/arch: amd64
  workload/ai: "true"
@@ -31,6 +31,8 @@ spec:
          immich.hexor.cy/volume: postgres
  affinity:
    nodeSelector:
+      homelab.hexor.cy/pool: core
+      homelab.hexor.cy/exposure: external
      kubernetes.io/hostname: music
  postgresql:
    shared_preload_libraries: [vectors.so]
@@ -11,6 +11,8 @@ spec:
    spec:
      restartPolicy: OnFailure
      nodeSelector:
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: external
        kubernetes.io/hostname: music
      containers:
        - name: prepare
@@ -20,6 +20,9 @@ spec:
      labels:
        app: auth-proxy
    spec:
+      nodeSelector:
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: external
      containers:
        - name: auth-proxy
          image: ultradesu/rsauth2-proxy:latest
@@ -1,5 +1,9 @@
 replicas: 1

+nodeSelector:
+  homelab.hexor.cy/pool: core
+  homelab.hexor.cy/exposure: external
+
 image:
  repository: quay.io/keycloak/keycloak
  tag: "26.5.6"
@@ -6,7 +6,7 @@
 # master. A failover swaps the roles; switch back with
 #   kubectl cnpg promote main <instance on music>
 #
-# Nodes eligible for instances carry the label workload/postgres=true. To move a
+# Eligible nodes are core/external and carry workload/postgres=true. To move a
 # replica: label the new node, unlabel the old one, then recreate the instance
 # (kubectl cnpg destroy main <N>); the operator re-clones it from the primary.
 #
@@ -36,6 +36,8 @@ spec:
    podAntiAffinityType: required
    topologyKey: kubernetes.io/hostname
    nodeSelector:
+      homelab.hexor.cy/pool: core
+      homelab.hexor.cy/exposure: external
      workload/postgres: "true"

  resources:
@@ -14,6 +14,12 @@ chunks, or Grafana database are copied from the old cluster.
 - Grafana state is stored in the `main` CNPG cluster; metrics and logs stay on
  the large local disk of node `music`.

+Stack services select `homelab.hexor.cy/pool=core` and
+`homelab.hexor.cy/exposure=external`. Prometheus, Alertmanager and Loki also
+select `music` because their volumes are local. Grafana, the operators, Alloy
+and the Loki gateway can run on either `master` or `music`. Node Exporter and
+Loki Canary are not restricted to these groups.
+
 ## Storage and retention

 The PreSync hook creates these directories on `music`:
@@ -123,7 +123,8 @@ controller:
  type: deployment
  replicas: 1
  nodeSelector:
-    kubernetes.io/hostname: music
+    homelab.hexor.cy/pool: core
+    homelab.hexor.cy/exposure: external
  priorityClassName: monitoring-critical
  minReadySeconds: 10
  terminationGracePeriodSeconds: 60
@@ -37,6 +37,8 @@ singleBinary:
  replicas: 1
  sidecar: false
  nodeSelector:
+    homelab.hexor.cy/pool: core
+    homelab.hexor.cy/exposure: external
    kubernetes.io/hostname: music
  priorityClassName: monitoring-critical
  terminationGracePeriodSeconds: 120
@@ -78,14 +80,12 @@ sidecar:

 gateway:
  enabled: true
-  # A second replica cannot improve availability while both replicas are pinned
-  # to the only storage node, and the chart's anti-affinity prevents scheduling.
+  # Gateway replicas can run on either external core node; Loki storage stays on music.
  replicas: 1
  nodeSelector:
-    kubernetes.io/hostname: music
-  # The chart defaults to required pod anti-affinity. With a single eligible
-  # node that deadlocks every rolling update because the surge pod cannot be
-  # scheduled until the old pod is gone. Both pods may briefly share music.
+    homelab.hexor.cy/pool: core
+    homelab.hexor.cy/exposure: external
+  # Allow a surge pod to share a node during rolling updates.
  affinity: null
  priorityClassName: monitoring-critical
  verboseLogging: false
@@ -41,6 +41,8 @@ alertmanager:
    replicas: 1
    retention: 120h
    nodeSelector:
+      homelab.hexor.cy/pool: core
+      homelab.hexor.cy/exposure: external
      kubernetes.io/hostname: music
    priorityClassName: monitoring-critical
    alertmanagerConfigSelector:
@@ -73,6 +75,8 @@ prometheus:
  prometheusSpec:
    replicas: 1
    nodeSelector:
+      homelab.hexor.cy/pool: core
+      homelab.hexor.cy/exposure: external
      kubernetes.io/hostname: music
    priorityClassName: monitoring-critical
    scrapeInterval: 30s
@@ -147,7 +151,8 @@ grafana:
  annotations:
    reloader.stakater.com/auto: "true"
  nodeSelector:
-    kubernetes.io/hostname: music
+    homelab.hexor.cy/pool: core
+    homelab.hexor.cy/exposure: external
  priorityClassName: monitoring-critical
  resources:
    requests:
@@ -229,8 +234,14 @@ grafana:
          - gf.hexor.cy

 prometheusOperator:
+  admissionWebhooks:
+    patch:
+      nodeSelector:
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: external
  nodeSelector:
-    kubernetes.io/hostname: music
+    homelab.hexor.cy/pool: core
+    homelab.hexor.cy/exposure: external
  priorityClassName: monitoring-critical
  resources:
    requests:
@@ -250,7 +261,8 @@ prometheusOperator:

 kube-state-metrics:
  nodeSelector:
-    kubernetes.io/hostname: music
+    homelab.hexor.cy/pool: core
+    homelab.hexor.cy/exposure: external
  priorityClassName: monitoring-critical
  resources:
    requests:
@@ -15,6 +15,8 @@ spec:
    spec:
      restartPolicy: OnFailure
      nodeSelector:
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: external
        kubernetes.io/hostname: music
      containers:
        - name: prepare
@@ -16,6 +16,9 @@ reloader:
  rbac:
    enabled: true
  deployment:
+    nodeSelector:
+      homelab.hexor.cy/pool: core
+      homelab.hexor.cy/exposure: external
    replicas: 2
    resources:
      requests:
@@ -29,6 +29,8 @@ spec:
        app.kubernetes.io/instance: bitwarden-cli
    spec:
      nodeSelector:
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: external
        kubernetes.io/arch: amd64
      containers:
        - name: bitwarden-cli
@@ -17,6 +17,8 @@ spec:
        app: vaultwarden
    spec:
      nodeSelector:
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: external
        kubernetes.io/hostname: music
      containers:
        - name: vaultwarden