home-ops

KO | EN

gitlite — search

#javascript #hacktoberfest #react #llm #go #android #deep-learning #linux #macos #nodejs #windows #kubernetes #pytorch #ios

(★ 13)

A comprehensive Kubernetes-based home lab infrastructure implementing enterprise-grade observability, data analytics, chaos engineering, incident response, and comprehensive security controls.

home-ops Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Home-Ops: Enterprise-Grade Infrastructure & Security Platform

A comprehensive Kubernetes-based home lab infrastructure implementing enterprise-grade observability, data analytics, chaos engineering, incident response, and **comprehensive security controls**.

## Core components

| Icon | Name | Description |
|------|------|-------------|
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/cilium/icon/color/cilium_icon-color.svg"> | [Cilium](https://cilium.io/) | Provides network routing, network security, exposing apps via LoadBalancers and other networking functionality. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/istio/icon/color/istio-icon-color.svg"> | [Multus](https://github.com/k8snetworkplumbingwg/multus-cni) | Provides secondary network connectivity aside from Cilium, such as connecting pods and KubeVirt VMs to specific VLANs' L2 domains directly. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/rook/icon/color/rook-icon-color.svg"> | [Rook-Ceph](https://rook.io/) | Provides and manages highly available networked persistent storage within the Kubernetes cluster itself. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/velero/icon/color/velero-icon-color.svg"> | [VolSync](https://volsync.backube.io/) | Provides and manages automated backups and restores of persistent storage. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/openebs/icon/color/openebs-icon-color.svg"> | [democratic-csi](https://github.com/democratic-csi/democratic-csi) | Wildcard storage CSI driver supporting multiple backends like local-hostpath. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/flux/icon/color/flux-icon-color.svg"> | [Flux](https://fluxcd.io/) | Provides GitOps automation for syncing desired state of resources. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/vault/icon/color/vault-icon-color.svg"> | [external-secrets](https://external-secrets.io/) | Syncs secrets from external sources like 1Password as Kubernetes secrets, with a templating engine. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/istio/icon/color/istio-icon-color.svg"> | [k8s-gateway](https://gateway-api.sigs.k8s.io/) | Internal DNS resolver for exposing apps via Ingress, Gateway API and LoadBalancer Services. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/coredns/icon/color/coredns-icon-color.svg"> | [external-dns](https://github.com/kubernetes-sigs/external-dns) | Syncs DNS records against upstream resolvers' records, such as Cloudflare DNS. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/cert-manager/icon/color/cert-manager-icon-color.svg"> | [cert-manager](https://cert-manager.io/) | Automated TLS management for generating and rotating signed and trusted TLS certificates stored as Kubernetes secrets. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/nginx/icon/color/nginx-icon-color.svg"> | [Ingress-NGINX](https://kubernetes.github.io/ingress-nginx/) | Kubernetes Ingress controller for automated configuration of NGINX to reverse proxy HTTP/S apps with automated TLS from cert-manager. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/istio/icon/color/istio-icon-color.svg"> | [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide/) | Expose specific apps publicly via Cloudflare Zero Trust tunnel. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/postgresql/icon/color/postgresql-icon-color.svg"> | [Crunchy Postgres Operator](https://www.crunchydata.com/products/crunchy-postgresql-for-kubernetes/) | Automated HA Postgres cluster and backups management. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/prometheus/icon/color/prometheus-icon-color.svg"> | [VictoriaMetrics](https://victoriametrics.com/) | Pull-based monitoring platform. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/prometheus/icon/color/prometheus-icon-color.svg"> | [kube-prometheus-stack](https://github.com/prometheus-operator/kube-prometheus) | Automated configuration and service discovery for Prometheus (and thus VictoriaMetrics), with shipped defaults for Kubernetes-focused monitoring and alerting. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/kyverno/icon/color/kyverno-icon-color.svg"> | [Kyverno](https://kyverno.io/) | Kubernetes API webhook policy engine, for validating, mutating and generating resources. Also abused as The Jank Engine. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/harbor/icon/color/harbor-icon-color.svg"> | [Spegel](https://github.com/spegel-org/spegel) | Transparent container registry cache mirror within cluster. |
| <img width="32" src="https://github.com/cncf/artwork/raw/main/projects/kubernetes/icon/color/kubernetes-icon-color.svg"> | [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller) | Auto-update of cluster components' versions such as Talos OS and Kubernetes versions. Combined with GitOps + Renovate for a PR-based auto-updating workflow. |

## Core Components Architecture

```mermaid
graph TB
    subgraph "External World"
        Internet[Internet]
        Cloudflare[Cloudflare DNS]
        OnePassword[1Password]
        GitRepo[Git Repository]
    end

subgraph "Edge & Ingress Layer"
 CloudflaredTunnel[Cloudflared Zero Trust Tunnel]
 IngressNGINX[Ingress-NGINX Reverse Proxy + TLS]
 K8sGateway[k8s-gateway Internal DNS Resolver]
 ExternalDNS[external-dns DNS Record Sync]
 end

subgraph "Network Infrastructure"
 Cilium[Cilium CNI + Security + LoadBalancers]
 Multus[Multus Multi-Network + VLANs]
 end

subgraph "Security & Policy Layer"
 CertManager[cert-manager Automated TLS Management]
 ExternalSecrets[external-secrets Secret Sync + Templating]
 Kyverno[Kyverno Policy Engine + Validation]
 end

subgraph "GitOps & Automation"
 Flux[Flux GitOps Automation]
 SystemUpgrade[system-upgrade-controller Auto-updates + Renovate]
 end

subgraph "Storage Infrastructure"
 RookCeph[Rook-Ceph HA Networked Storage]
 VolSync[VolSync Automated Backups/Restores]
 DemocraticCSI[democratic-csi Wildcard Storage Driver]
 end

subgraph "Data Layer"
 CrunchyPostgres[Crunchy Postgres Operator HA Database Clusters]
 end

subgraph "Observability Stack"
 VictoriaMetrics[VictoriaMetrics Pull-based Monitoring]
 PrometheusStack[kube-prometheus-stack + prometheus-operator Config + Service Discovery]
 end

subgraph "Container Registry"
 Spegel[Spegel Registry Cache Mirror]
 end

subgraph "Applications & Workloads"
 Apps[Applications Services & Workloads]
 end

%% Data Layer
    CrunchyPostgres -->|Database Services| Apps

%% Registry
    Spegel -->|Container Images| Apps

%% Network Services
    Cilium -->|Load Balancing| Apps
    Cilium -->|Network Security| Apps
```

## Observability architecture overview

```mermaid
graph TB
    subgraph "Users/DevOps"
        Users
    end

subgraph "Kubernetes Cluster"
        subgraph "Applications"
            Apps
        end

subgraph "Observability Stack"
            Prometheus
            KubeStateMetrics
            OtelCollector
            Alloy

subgraph "Storage Layer"
                Loki
                Tempo
                Mimir
            end

Grafana
        end

subgraph "Dashboards"
            K8sDashboards
        end
    end

subgraph "Cloud Storage"
        LogsStorage
        TracesStorage
        MetricsStorage
    end

Loki --> LogsStorage
    Tempo --> TracesStorage
    Mimir --> MetricsStorage

Grafana --> K8sDashboards
    Users --> Grafana

subgraph "Cloud Storage"
        LogsStorage
        TracesStorage
        MetricsStorage
    end

%% Data source connections
    MetricsStorage --> Grafana
    TracesStorage --> Grafana
    LogsStorage --> Grafana
```

## Storage architecture overview

### Storage Components Overview

```mermaid
graph TB
 subgraph "Production Storage Infrastructure"
 subgraph "Block Storage Layer"
 subgraph "Rook-Ceph Cluster"
 CEPH_OSD1[" Ceph OSD-1 Node 1"]
 CEPH_OSD2[" Ceph OSD-2 Node 2"]
 CEPH_OSD3[" Ceph OSD-3 Node 3"]
 CEPH_MON[" Ceph Monitors 3 replicas"]
 CEPH_MGR[" Ceph Manager 2 replicas"]
 CEPH_MDS[" Ceph MDS CephFS"]
 CEPH_RGW[" Ceph RGW Object Gateway"]
 end

subgraph "Storage Classes"
 SC_BLOCK[" ceph-block (Default RBD)"]
 SC_FS[" ceph-filesystem (CephFS)"]
 SC_BUCKET[" ceph-bucket (Object Storage)"]
 end
 end

subgraph "NFS & External Storage"
 subgraph "Democratic CSI"
 TRUENAS[" TrueNAS 192.168.8.161"]
 SC_NFS[" truenas-nfs (NFS Storage)"]
 end

subgraph "OpenEBS"
 OPENEBS_LOCAL[" OpenEBS LocalPV (Local Storage)"]
 OPENEBS_HOSTPATH[" OpenEBS Hostpath (Node Storage)"]
 end
 end

subgraph "Database Storage Layer"
 subgraph "CloudNative PostgreSQL"
 PG_PRIMARY[" PostgreSQL Primary 5 instances"]
 PG_REPLICA1[" PostgreSQL Replica-1 Sync Replica"]
 PG_REPLICA2[" PostgreSQL Replica-2 Sync Replica"]
 PG_WAL[" WAL Storage 100Gi dedicated"]
 PG_BACKUP[" Backup Storage S3 Compatible"]
 end

subgraph "Redis & Cache"
 REDIS_CLUSTER[" Redis Cluster High Availability"]
 DRAGONFLY[" Dragonfly Redis-compatible"]
 end

subgraph "Other Databases"
 MARIADB[" MariaDB SQL Database"]
 INFLUXDB[" InfluxDB Time Series"]
 end
 end

subgraph "Backup & Recovery Layer"
 subgraph "Velero Backup"
 VELERO[" Velero Cluster Backup"]
 VELERO_STORAGE[" Cloud Storage Backup Repository"]
 end

subgraph "VolSync"
 VOLSYNC[" VolSync PV Replication"]
 VOLSYNC_DEST[" Destination Remote Storage"]
 end

subgraph "Database Backups"
 PG_BARMAN[" Barman PostgreSQL Backup"]
 BACKUP_S3[" S3 Storage 192.168.8.161:9000"]
 end
 end

subgraph "Snapshot Management"
 SNAPSHOT_CTRL[" Snapshot Controller CSI Snapshots"]
 SNAPSHOT_CRD[" VolumeSnapshot CRDs"]
 end

subgraph "Storage Monitoring"
 subgraph "Performance Monitoring"
 PROMETHEUS_STORAGE[" Storage Metrics Prometheus"]
 GRAFANA_STORAGE[" Storage Dashboards Grafana"]
 SMART_EXPORTER[" SMART Exporter Disk Health"]
 end

subgraph "Alerting"
 STORAGE_ALERTS[" Storage Alerts Disk Usage/Health"]
 CEPH_ALERTS["Cluster Health"]
 end
 end

subgraph "Applications & Workloads"
            OBSERVABILITY["LGTM Stack"]
            DATA_SCIENCE["ClickHouse/Jupyter"]
            SERVICES["Web Applications"]
            SECURITY["Auth/Secrets"]
        end
    end

%% Storage Connections
    CEPH_OSD1 --> CEPH_MON
    CEPH_OSD2 --> CEPH_MON
    CEPH_OSD3 --> CEPH_MON
    CEPH_MON --> CEPH_MGR
    CEPH_MGR --> SC_BLOCK
    CEPH_MGR --> SC_FS
    CEPH_MGR --> SC_BUCKET
    CEPH_MDS --> SC_FS
    CEPH_RGW --> SC_BUCKET

TRUENAS --> SC_NFS
    OPENEBS_LOCAL --> OPENEBS_HOSTPATH

%% Database Storage
    SC_BLOCK --> PG_PRIMARY
    SC_BLOCK --> PG_WAL
    PG_PRIMARY --> PG_REPLICA1
    PG_PRIMARY --> PG_REPLICA2
    PG_PRIMARY --> PG_BACKUP

SC_BLOCK --> REDIS_CLUSTER
    SC_BLOCK --> DRAGONFLY
    SC_BLOCK --> MARIADB
    SC_BLOCK --> INFLUXDB

%% Backup Connections
    VELERO --> VELERO_STORAGE
    VOLSYNC --> VOLSYNC_DEST
    PG_BARMAN --> BACKUP_S3

%% Snapshot Management
    SC_BLOCK --> SNAPSHOT_CTRL
    SC_FS --> SNAPSHOT_CTRL
    SNAPSHOT_CTRL --> SNAPSHOT_CRD

%% Monitoring
    CEPH_MGR --> PROMETHEUS_STORAGE
    PG_PRIMARY --> PROMETHEUS_STORAGE
    SMART_EXPORTER --> PROMETHEUS_STORAGE
    PROMETHEUS_STORAGE --> GRAFANA_STORAGE
    PROMETHEUS_STORAGE --> STORAGE_ALERTS
    PROMETHEUS_STORAGE --> CEPH_ALERTS

%% Application Storage Usage
    SC_BLOCK --> OBSERVABILITY
    SC_FS --> DATA_SCIENCE
    SC_NFS --> SERVICES
    SC_BUCKET --> SECURITY

## Data platform architecture overview

```mermaid
graph TD
    subgraph DataSources [External Data Sources]
        A[APIs & Webhooks]
        B[File Uploads]
        C[Application Logs]
        D[Metrics & Events]
    end

subgraph Ingestion [Data Ingestion Layer]
        E[Vector Log Aggregator 192.168.8.113]
        F[Alloy Telemetry Collector]
        G[Kafka Streaming Platform]
        H[Schema Registry]
    end

subgraph Analytics [Analytics Databases]
        I[ClickHouse OLAP Cluster]
        J[Druid Real-time Analytics]
        K[InfluxDB Time Series]
    end

subgraph OLTP [OLTP Databases]
        L[PostgreSQL Primary 192.168.8.101]
        M[PostgreSQL Read Replicas]
        N[MariaDB Cluster]
        O[Redis HA Cluster]
        P[Dragonfly Redis-Compatible]
    end

subgraph Storage [Object Storage]
        Q[TrueNAS Enterprise 192.168.8.161]
        R[MinIO S3-Compatible]
        S[Ceph Distributed Storage]
    end

subgraph Processing [Data Processing]
        T[Apache Spark Cluster]
        U[Airflow Workflows]
        V[JupyterHub Data Science]
        W[DBT Transformations]
    end

subgraph Visualization [Analytics & Visualization]
        X[Apache Superset Production 3 Replicas]
        Y[Grafana Analytics Dashboards]
        Z[Jupyter Notebooks]
        AA[Custom Analytics Apps]
    end

subgraph MLPlatform [ML Platform]
        BB[MLflow Model Registry]
        CC[Kubeflow Pipelines]
        DD[TensorFlow Serving]
        EE[Model APIs]
    end

subgraph DataGov [Data Governance]
        FF[Data Catalog]
        GG[Data Lineage Tracking]
        HH[Data Quality Monitoring]
        II[Compliance Controls]
    end

subgraph Backup [Backup & Recovery]
        JJ[Velero Cluster Backup]
        KK[PostgreSQL Continuous Backup]
        LL[ClickHouse Backup Service]
        MM[Cross-Region S3 Backup]
    end

%% Data Flow Connections
    A --> E
    B --> G
    C --> F
    D --> E

E --> I
    E --> J
    F --> E
    G --> J
    H --> G

E --> L
    F --> K
    G --> I

L --> M
    O --> P

I --> Q
    J --> R
    L --> S

I --> T
    J --> T
    L --> W
    T --> U
    U --> V

X --> I
    X --> J
    X --> L
    X --> O
    X --> N
    X --> P
    Y --> I
    Z --> I
    Z --> J
    AA --> J

T --> BB
    BB --> CC
    CC --> DD
    DD --> EE

I --> FF
    J --> FF
    FF --> GG
    GG --> HH
    HH --> II

L --> KK
    I --> LL
    Q --> MM
    JJ --> MM
```

### Data Platform Service Interconnections

```mermaid
graph TD
    subgraph DataIngestion [Production Data Ingestion Pipeline]
        VectorAggregator[Vector Log Aggregator 192.168.8.113]
        AlloyCollector[Alloy Telemetry Collector]
        KafkaCluster[Kafka Streaming Cluster]
        SchemaRegistry[Confluent Schema Registry]
        KafkaConnect[Kafka Connect Connectors]
    end

subgraph AnalyticsEngines [Analytics & OLAP Engines]
        ClickHouseCluster[ClickHouse Production Cluster]
        DruidCluster[Apache Druid Analytics Platform]
        InfluxDBCluster[InfluxDB Time Series Database]
    end

subgraph TransactionalDBs [Transactional Databases - OLTP]
        PostgresPrimary[CloudNative PostgreSQL Primary]
        PostgresReplicas[PostgreSQL Read Replicas HA]
        MariaDBCluster[MariaDB Galera Cluster]
        RedisCluster[Redis Sentinel HA Cluster]
        DragonflyDB[Dragonfly Redis-Compatible Cache]
    end

subgraph ObjectStorage [Enterprise Object Storage]
        TrueNASEnterprise[TrueNAS Enterprise Storage 192.168.8.161]
        MinIODistributed[MinIO Distributed S3 Storage]
        CephCluster[Ceph Distributed Storage Cluster]
        CephObjectGateway[Ceph RADOS Gateway]
    end

subgraph DataProcessing [Big Data Processing Platform]
        ApacheSparkCluster[Apache Spark Distributed Processing]
        AirflowOrchestration[Apache Airflow Workflow Orchestration]
        JupyterHubPlatform[JupyterHub Multi-User Data Science]
        DBTTransformations[DBT Data Transformations]
        FlinkStreamProcessing[Apache Flink Stream Processing]
    end

subgraph MLOpsStack [MLOps & Model Serving]
        MLflowRegistry[MLflow Model Registry & Tracking]
        KubeflowPipelines[Kubeflow ML Pipelines]
        TensorFlowServing[TensorFlow Model Serving]
        ModelAPIs[REST/gRPC Model APIs]
        FeatureStore[Feature Store]
    end

subgraph AnalyticsPlatform [Analytics & Visualization Platform]
        SupersetProduction[Apache Superset Production 3 Replicas]
        GrafanaAnalytics[Grafana Analytics Dashboards]
        JupyterNotebooks[Jupyter Notebook Analytics]
        CustomDashboards[Custom Analytics Applications]
        ReportingEngine[Automated Reporting Engine]
    end

subgraph DataGovernance [Enterprise Data Governance]
        ApacheAtlas[Apache Atlas Data Catalog]
        DataLineage[Data Lineage & Impact Analysis]
        DataQuality[Great Expectations Data Quality]
        SchemaEvolution[Schema Evolution Management]
        ComplianceAuditing[GDPR/SOX Compliance Auditing]
    end

subgraph MonitoringObservability [Data Platform Monitoring]
        PrometheusDataMetrics[Prometheus Data Platform Metrics]
        LokiDataLogs[Loki Data Platform Logs]
        JaegerDataTracing[Jaeger Data Pipeline Tracing]
        AlertManagerData[AlertManager Data Platform Alerts]
        GrafanaMonitoring[Grafana Monitoring Dashboards]
    end

subgraph BackupRecovery [Backup & Disaster Recovery]
        VeleroClusterBackup[Velero Full Cluster Backup]
        PostgresWALBackup[PostgreSQL WAL-E Continuous Backup]
        ClickHouseBackupService[ClickHouse Backup Service]
        DruidDeepStorageBackup[Druid Deep Storage Backup]
        CrossRegionReplication[Cross-Region Data Replication]
    end

## Security architecture overview

```mermaid
graph TB
 subgraph "Production Security Infrastructure"
 subgraph "Identity & Access Management"
 subgraph "Authentication Layer"
 AUTHELIA[" Authelia Multi-Factor Auth"]
 LLDAP[" LLDAP LDAP Directory"]
 AUTHENTIK[" Authentik Identity Provider"]
 KEYCLOAK[" Keycloak SSO Provider"]
 end

subgraph "Authorization & Proxy"
 OAUTH2_PROXY[" OAuth2-Proxy Auth Middleware"]
 GLAUTH[" GLAuth Lightweight LDAP"]
 end
 end

subgraph "Network Security Layer"
 subgraph "Zero-Trust Network"
 NETWORK_POLICIES[" Network Policies Micro-segmentation"]
 CILIUM[" Cilium CNI Security"]
 TAILSCALE[" Tailscale Mesh VPN"]
 end

subgraph "DNS Security"
 ADGUARD[" AdGuard DNS Filtering"]
 BLOCKY[" Blocky DNS Blocker"]
 PIHOLE[" Pi-hole Network-wide blocking"]
 end
 end

subgraph "Runtime Security & Monitoring"
 subgraph "Intrusion Detection"
 FALCO[" Falco Runtime Security"]
 TETRAGON[" Tetragon eBPF Security"]
 CROWDSEC[" CrowdSec Behavioral Analysis"]
 WAZUH[" Wazuh SIEM/HIDS"]
 end

subgraph "Behavioral Analysis"
 BEHAVIOR_ENGINE[" Behavior Analysis ML Anomaly Detection"]
 THREAT_INTEL[" Threat Intelligence IOC Feeds"]
 end
 end

subgraph "Vulnerability Management"
 subgraph "Security Scanning"
 TRIVY[" Trivy Container Scanner"]
 TRIVY_OPERATOR[" Trivy Operator K8s Security Scans"]
 CONTAINER_SCAN[" Container Scanning CI/CD Pipeline"]
 SAST_SCAN[" SAST Scanner Static Analysis"]
 DAST_SCAN[" DAST Scanner Dynamic Analysis"]
 end

subgraph "Compliance"
 DEPENDENCY_SCAN[" Dependency Scanner SCA Analysis"]
 CIS_BENCHMARK[" CIS Benchmarks Compliance Checks"]
 NIST_COMPLIANCE[" NIST Framework Security Controls"]
 end
 end

subgraph "Secrets Management"
 subgraph "External Secrets"
 EXTERNAL_SECRETS[" External Secrets Operator"]
 ONEPASSWORD[" 1Password Secrets Provider"]
 SECRET_STORES[" Secret Stores Vault Integration"]
 end

subgraph "Encryption"
 SOPS[" SOPS Secret Encryption"]
 AGE_KEYS[" Age Keys Encryption Keys"]
 end
 end

subgraph "Security Monitoring & Response"
 subgraph "SIEM/SOAR"
 SECURITY_DASHBOARD[" Security Dashboard Grafana"]
 INCIDENT_RESPONSE[" Incident Response Automated Workflow"]
 THREAT_HUNTING[" Threat Hunting Proactive Detection"]
 end

subgraph "Alerting & Notification"
 SECURITY_ALERTS[" Security Alerts Prometheus Rules"]
 GOTIFY[" Gotify Push Notifications"]
 SMTP_RELAY[" SMTP Relay Email Alerts"]
 end
 end

subgraph "Application Security"
 subgraph "Web Application Security"
 WAF[" Web App Firewall Ingress Protection"]
 RATE_LIMITING[" Rate Limiting DDoS Protection"]
 SECURITY_HEADERS[" Security Headers HTTP Security"]
 end

subgraph "API Security"
 API_GATEWAY[" API Gateway Request Validation"]
 JWT_VALIDATION[" JWT Validation Token Security"]
 end
 end

subgraph "Security Orchestration"
 subgraph "Automated Response"
 QUARANTINE[" Auto Quarantine Threat Isolation"]
 SECURITY_POLICIES[" Security Policies Pod Security Standards"]
 ADMISSION_CTRL[" Admission Controller Policy Enforcement"]
 end
 end
 end

%% Authentication Flow
    LLDAP --> AUTHELIA
    AUTHELIA --> OAUTH2_PROXY
    AUTHENTIK --> OAUTH2_PROXY
    KEYCLOAK --> OAUTH2_PROXY
    GLAUTH --> AUTHELIA

%% Network Security
    NETWORK_POLICIES --> CILIUM
    TAILSCALE --> CILIUM
    ADGUARD --> BLOCKY
    BLOCKY --> PIHOLE

%% Runtime Security
    FALCO --> BEHAVIOR_ENGINE
    TETRAGON --> BEHAVIOR_ENGINE
    CROWDSEC --> THREAT_INTEL
    WAZUH --> THREAT_INTEL
    BEHAVIOR_ENGINE --> INCIDENT_RESPONSE

%% Vulnerability Management
    TRIVY --> TRIVY_OPERATOR
    TRIVY_OPERATOR --> SECURITY_DASHBOARD
    CONTAINER_SCAN --> TRIVY
    SAST_SCAN --> SECURITY_DASHBOARD
    DAST_SCAN --> SECURITY_DASHBOARD
    DEPENDENCY_SCAN --> CIS_BENCHMARK
    CIS_BENCHMARK --> NIST_COMPLIANCE

%% Secrets Management
    ONEPASSWORD --> EXTERNAL_SECRETS
    SECRET_STORES --> EXTERNAL_SECRETS
    EXTERNAL_SECRETS --> SOPS
    SOPS --> AGE_KEYS

%% Security Monitoring
    FALCO --> SECURITY_ALERTS
    TRIVY --> SECURITY_ALERTS
    WAZUH --> SECURITY_ALERTS
    SECURITY_ALERTS --> SECURITY_DASHBOARD
    SECURITY_ALERTS --> GOTIFY
    SECURITY_ALERTS --> SMTP_RELAY
    THREAT_HUNTING --> SECURITY_DASHBOARD

%% Application Security
    OAUTH2_PROXY --> WAF
    WAF --> RATE_LIMITING
    RATE_LIMITING --> SECURITY_HEADERS
    API_GATEWAY --> JWT_VALIDATION

%% Automated Response
    INCIDENT_RESPONSE --> QUARANTINE
    SECURITY_POLICIES --> ADMISSION_CTRL
    ADMISSION_CTRL --> QUARANTINE

### Secrets Management Integration

```mermaid
graph TB
 subgraph "Secrets Management Integration"
 subgraph "External Secrets Sources"
 ONEPASSWORD[" 1Password"]
 VAULT[" HashiCorp Vault"]
 CLOUD_SECRETS[" Cloud Providers"]
 end

subgraph "Secrets Core"
 EXTERNAL_SECRETS[" External Secrets Operator"]
 K8S_SECRETS[" Kubernetes Secrets"]
 SOPS[" SOPS GitOps Encryption"]
 end

subgraph "Identity & Access"
 AUTHELIA[" Authelia"]
 OAUTH2_PROXY[" OAuth2-Proxy"]
 LLDAP[" LLDAP"]
 end

subgraph "Security Monitoring"
 FALCO[" Falco"]
 WAZUH[" Wazuh"]
 TRIVY[" Trivy"]
 end

subgraph "Observability"
 PROMETHEUS[" Prometheus"]
 GRAFANA[" Grafana"]
 LOKI[" Loki"]
 end

subgraph "Data & Storage"
 POSTGRES[" PostgreSQL"]
 REDIS[" Redis"]
 S3_STORAGE[" S3 Storage"]
 end

subgraph "Network & Ingress"
 CERT_MANAGER[" Cert-Manager"]
 INGRESS[" Ingress NGINX"]
 CILIUM[" Cilium"]
 end
 end

%% External Sources to Core
    ONEPASSWORD --> EXTERNAL_SECRETS
    VAULT --> EXTERNAL_SECRETS
    CLOUD_SECRETS --> EXTERNAL_SECRETS

%% Core Secret Management
    EXTERNAL_SECRETS --> K8S_SECRETS
    SOPS --> K8S_SECRETS

%% Identity & Access
    K8S_SECRETS --> AUTHELIA
    K8S_SECRETS --> OAUTH2_PROXY
    K8S_SECRETS --> LLDAP

%% Security Monitoring
    K8S_SECRETS --> FALCO
    K8S_SECRETS --> WAZUH
    K8S_SECRETS --> TRIVY

%% Observability
    K8S_SECRETS --> PROMETHEUS
    K8S_SECRETS --> GRAFANA
    K8S_SECRETS --> LOKI

%% Data & Storage
    K8S_SECRETS --> POSTGRES
    K8S_SECRETS --> REDIS
    K8S_SECRETS --> S3_STORAGE

%% Network & Ingress
    K8S_SECRETS --> CERT_MANAGER
    K8S_SECRETS --> INGRESS
    K8S_SECRETS --> CILIUM

## Networking architecture overview

```mermaid
graph TD
    A[Internet] --> B[Cloudflare Production CDN/WAF]
    B --> C[Cloudflare Secure Tunnel]
    C --> D[Production External Gateway 192.168.8.139]

A --> E[Enterprise Edge Router 192.168.8.1]
    E --> F[Production BGP Peer 192.168.8.145]
    E --> G[Enterprise Storage Array 192.168.8.161]

A --> H[Enterprise VPN Infrastructure]
    H --> I[Twingate Zero Trust Access]
    H --> J[Tailscale Production Mesh]
    H --> K[WireGuard Production Gateway]
    H --> L[OpenVPN Enterprise Gateway]

subgraph M[Production Kubernetes Infrastructure]
        N[HA Control Plane VIP 192.168.8.136]
        O[Cilium Production CNI with eBPF]
        P[Multus Enterprise Multi-Network]
        Q[Production BGP Control Plane]

R[Production External Gateway 192.168.8.139]
        S[Production Internal Gateway 192.168.8.138]
        T[Enterprise DNS Gateway 192.168.8.137]

U[Production Network Policies]
        V[Cilium Enterprise Security Policies]
        W[Zero Trust Production Network]
        X[Enterprise Service Mesh Security]

Y[Production CoreDNS Cluster]
        Z[Enterprise AdGuard DNS Security]
        AA[Production Blocky DNS Filter]
        BB[Enterprise Pi-hole Protection]
        CC[Production DNS Threat Protection]

DD[Production Authentik Identity Platform]
        EE[Enterprise Authelia Authentication]
        FF[Production LLDAP Directory]
        GG[Enterprise OAuth2 Proxy]
        HH[Production Keycloak SSO]

II[Production Falco Runtime Security]
        JJ[Enterprise Tetragon eBPF Security]
        KK[Production CrowdSec IPS/IDS]
        LL[Enterprise Wazuh SIEM Platform]
        MM[Production Behavior Analysis Engine]

NN[Enterprise External Secrets Operator]
        OO[Production Cert Manager TLS]
        PP[Enterprise 1Password Integration]
        QQ[Production SOPS Encryption]

RR[Production OPA Gatekeeper Policies]
        SS[Enterprise Pod Security Standards]
        TT[Production Admission Controllers]
        UU[Enterprise Trivy Vulnerability Scanner]

VV[Production Security Operations Center]
        WW[Enterprise Incident Response Automation]
        XX[Production Threat Hunting Platform]
        YY[Enterprise Vector Log Aggregation 192.168.8.113]
        ZZ[Production Alertmanager Security]

AAA[Production PostgreSQL Cluster 192.168.8.101]
        BBB[Enterprise Syncthing Service 192.168.8.117]
        CCC[Production VerneMQ MQTT Broker 192.168.8.127]
        DDD[Enterprise Graphite Metrics 192.168.8.109]
    end

E --> M
    F --> Q
    H --> M

O --> R
    O --> S
    O --> T
    O --> U

T --> Y
    Y --> Z
    Z --> AA
    AA --> BB
    BB --> CC

R --> GG
    GG --> DD
    DD --> FF
    EE --> FF

II --> KK
    JJ --> MM
    KK --> LL

OO --> R
    OO --> S
    NN --> PP

RR --> TT
    SS --> TT
    UU --> VV

II --> VV
    VV --> WW
    VV --> XX

M --> G
```

### Service Interconnection Architecture

```mermaid
graph TD
    %% External Layer
    Internet[Internet/WAN]
    CloudFlare[Cloudflare CDN/WAF]
    CloudflareTunnel[Cloudflare Tunnel]
    EdgeRouter[Enterprise Edge Router 192.168.8.1]
    BGPPeer[BGP Peer 192.168.8.145]
    TrueNAS[TrueNAS Storage 192.168.8.161]

%% VPN Layer
    Twingate[Twingate Zero Trust]
    Tailscale[Tailscale Mesh]
    WireGuard[WireGuard Gateway]
    OpenVPN[OpenVPN Gateway]

%% Kubernetes Core
    ControlPlane[Control Plane VIP 192.168.8.136]
    Cilium[Cilium CNI eBPF]
    BGPControl[BGP Control Plane]

%% Gateways
    ExtGW[External Gateway 192.168.8.139]
    IntGW[Internal Gateway 192.168.8.138]
    K8sGW[K8s Gateway 192.168.8.137]

%% DNS Stack
    CoreDNS[CoreDNS]
    AdGuard[AdGuard Home]
    Blocky[Blocky Filter]
    PiHole[Pi-hole]

%% Identity Stack
    Authentik[Authentik IDP]
    OAuth2Proxy[OAuth2 Proxy]
    LLDAP[LLDAP Directory]
    Authelia[Authelia Auth]

%% Security Stack
    Falco[Falco Runtime Security]
    Tetragon[Tetragon eBPF]
    CrowdSec[CrowdSec IPS]
    WazuhSIEM[Wazuh SIEM]

%% Network Security
    NetworkPolicies[Network Policies]
    CiliumNetPol[Cilium Policies]
    ServiceMesh[Service Mesh]

%% Secrets & Certs
    ExternalSecrets[External Secrets]
    CertManager[Cert Manager]
    OnePassword[1Password]
    SOPS[SOPS Encryption]

%% Monitoring & Alerting
    Vector[Vector 192.168.8.113]
    Alloy[Alloy Collector]
    Prometheus[Prometheus]
    Grafana[Grafana]
    Alertmanager[Alertmanager]

%% SOC Platform
    SecurityDashboard[Security Dashboard]
    IncidentResponse[Incident Response]
    ThreatHunting[Threat Hunting]

%% Application Services
    PostgresLB[PostgreSQL 192.168.8.101]
    SyncthingLB[Syncthing 192.168.8.117]
    VerneMQLB[VerneMQ 192.168.8.127]
    GraphiteLB[Graphite 192.168.8.109]

%% Policy & Compliance
    OPAGatekeeper[OPA Gatekeeper]
    AdmissionController[Admission Controllers]
    TrivyOperator[Trivy Scanner]

%% Application Services defined for clarity
    subgraph ApplicationServices [Application Services]
        PostgresLB
        SyncthingLB
        VerneMQLB
        GraphiteLB
    end
```

## FinOps(Kubecost) architecture overview

```mermaid
graph TB
    subgraph "External"
        U[Users] --> LB[Load Balancer]
        LB --> IG[Ingress Gateway]
    end

subgraph "Security Layer"
        IG --> OA[OAuth2 Proxy]
        GK[Gatekeeper] --> |Policy Enforcement| KF
        NP[NetworkPolicies] --> |Zero-Trust| KF
    end

subgraph "Kubecost Application"
        OA --> KF[Frontend Pods x5]
        KF --> KC[Cost Model Pods x3]
        KC --> KO[Cost Optimizer x2]
        KC --> KCC[Cluster Controller x2]
    end

subgraph "Data Layer"
        KC --> PVC[Persistent Storage 500GB]
        KC --> MIN[MinIO Object Storage]
        KC --> PROM[Prometheus]
    end

subgraph "Monitoring"
        KF --> SM[ServiceMonitor]
        KC --> PR[PrometheusRules]
        SM --> PROM
        PR --> AM[AlertManager]
    end

subgraph "Auto-scaling"
        HPA[HPA] --> |Scale| KF
        VPA[VPA] --> |Resources| KC
    end
```

### 🤝 Thanks

I want to give credit to a few great resources:
- The (cluster-template)[https://github.com/onedr0p/cluster-template] on GitHub.
- The (Home Operations)[https://discord.gg/home-operations] Discord community.
- For deployment ideas and strategies, visit (kubesearch.dev)[https://kubesearch.dev/].

home-ops

home-ops Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

home-ops

home-ops Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README