Bootstrap¶

Full cluster rebuild from zero. You need this repo, aKeyless access, and Backblaze B2 credentials.

Prerequisites¶

• Three nodes on the network with Talos ISO booted
• mise installed locally with all tools activated (just, talosctl, kubectl, flux, helm)
• aKeyless credentials available
• Backblaze B2 credentials for CNPG database recovery

Stage Order¶

flowchart TD
    A["1. Install Talos"] --> B["2. Bootstrap K8s"]
    B --> C["3. Fetch kubeconfig"]
    C --> D["4. Wait for nodes"]
    D --> E["5. Apply namespaces"]
    E --> F["6. Apply resources"]
    F --> G["7. Apply CRDs"]
    G --> H["8. Apply core apps ¹"]
    H --> I(["9. Flux takes over"])
    I --> J["10. Restore CNPG from B2"]

    style I fill:#4051b5,color:#fff

¹ Cilium → CoreDNS → cert-manager → external-secrets

Post-Bootstrap Checks¶

# Ceph cluster healthy
kubectl get cephcluster -n rook-ceph

# All Kustomizations ready
kubectl get ks -A | grep -v True

# DNS resolving
dig @10.43.0.10 kubernetes.default.svc.cluster.local

# Pangolin operator + Newt tunnel running
kubectl get pods -n network -l app.kubernetes.io/name=pangolin-operator
kubectl get newtsite -n network

# CNPG clusters healthy
kubectl get cluster -n database

Restoring Kopiur Backups¶

For apps with PVC data (config, state — not databases):

just kube restore <ns> <name> <previous>

This handles the full flow: suspend the app → delete the existing PVC → Kopiur Volume Populator creates a new PVC from the backup → resume the app.

Important Notes¶

Always upgrade Talos first (just talos upgrade-node <node>), then Kubernetes (just talos upgrade-k8s <version>). Never the other way around.

CNPG recovery uses Barman-cloud backups from B2. Use just bootstrap cnpg — it handles the restore process.

• Talos configs are templates — edit kubernetes/talos/, never the rendered output
• Flux is the source of truth — once it's running, everything else deploys from Git automatically