Clusters: Hyperion and Cronos
The homelab plans two K3s clusters with deliberately different stacks. Hyperion is for services used every day; Cronos is for learning alternatives without risking them.
Hyperion: the stable cluster
Section titled “Hyperion: the stable cluster”Hyperion favors stability, security and observability. Its stack:
| Area | Choice |
|---|---|
| CNI and mesh | Cilium |
| Gateway API | Cilium’s built-in controller |
| GitOps | ArgoCD |
| Certificates | cert-manager + Cloudflare DNS-01 |
| LoadBalancer | K3s ServiceLB (node IP) |
| Secrets | Infisical + Kubernetes operator |
| Policy engine | Kyverno |
| Storage | Rook + Ceph (planned) |
| Observability | Prometheus, Grafana, Loki (planned) |
Why K3s runs without Traefik, Flannel and kube-proxy
Section titled “Why K3s runs without Traefik, Flannel and kube-proxy”K3s ships with Flannel, kube-proxy, a network policy controller and Traefik. Cilium does all of those jobs with eBPF, so Hyperion turns them off (--flannel-backend=none --disable-kube-proxy --disable-network-policy --disable traefik). Running both would mean two components fighting over the same packets.
One consequence: a fresh node has no networking until Cilium is installed. That is why Cilium is the first thing the Hyperion OpenTofu stack installs, followed by a 120-second wait.
What the stack expects from K3s
Section titled “What the stack expects from K3s”The Hyperion stack is validated only on K3s (v1.37.1+k3s1 on Rocky Linux 10.2). It assumes K3s in these places, and each would need changes on another distribution:
- Gateway API CRDs. K3s installs them through its bundled
gateway-api-crdchart. The bootstrap kustomization (crds/) does not include them, so on another distribution nothing would install them. - API server address. Cilium uses
k8sServiceHost=127.0.0.1andk8sServicePort=6443, which matches a K3s server node where the API server listens locally. - Install flags. Flannel, kube-proxy, the network policy controller and Traefik are turned off with K3s flags (see Install K3s on Hyperion).
- LoadBalancer IP. The Gateway’s
LoadBalancerService gets the node IP from the K3s ServiceLB (svclb-*pods). Cilium’s LB IPAM is not configured. - Service CIDR. Pods reach the API at
10.43.0.1, the first address of the K3s default service CIDR.
One Gateway, one wildcard certificate
Section titled “One Gateway, one wildcard certificate”All apps share a single Gateway in the cilium-gateway namespace, with one wildcard certificate for *.home.cervant.net. Apps only add an HTTPRoute. This keeps certificate issuance to one DNS-01 challenge, works for internal-only hostnames that aren’t reachable from the internet, and keeps per-app manifests small.
Cronos: the experimental cluster
Section titled “Cronos: the experimental cluster”Cronos is planned. It uses the alternative for each area, so both approaches can be compared on similar workloads:
| Area | Choice |
|---|---|
| CNI | Flannel (K3s default) |
| Service mesh | Linkerd |
| Gateway API | NGINX Gateway Fabric |
| GitOps | FluxCD |
| Certificates | cert-manager + Cloudflare DNS-01 |
| LoadBalancer | kube-vip |
| Secrets | Vault + External Secrets Operator |
| Policy engine | OPA Gatekeeper |
| Storage | Longhorn |
| Observability | Prometheus, Grafana, Loki (via FluxCD) |
Roadmap
Section titled “Roadmap”- Deploy Rook + Ceph on Hyperion.
- Build Cronos with FluxCD and Linkerd.
- Add observability and dashboards per cluster.