# Cluster infrastructure

This catalogue view groups diagrams that explain cluster boundaries and shared
infrastructure dependencies.

## Cluster fleet

The fleet view maps the four environment overlays currently declared in the
Talos automation repository. It shows their site boundary, configured Talos and
Kubernetes versions, and the conditional bootstrap path in the provisioning
workflow.

<a class="archify-open"
   href="../_static/archify/kubernetes/infrastructure/cluster-fleet.html"
   target="_blank" rel="noopener">Open the interactive cluster fleet architecture</a>

<iframe
  class="archify-frame archify-frame--architecture"
  src="../_static/archify/kubernetes/infrastructure/cluster-fleet.html"
  title="ICS Kubernetes cluster fleet architecture"
  loading="lazy"
  allowfullscreen>
</iframe>

The platform model places Sandbox and Test in CSLab and Staging and Production
in GPN. Each environment has three control-plane hosts and five worker hosts.
The playbook can bootstrap Argo CD and Vault Secrets Operator, but every current
environment overlay disables that conditional path.

## Talos cluster runtime

The runtime view explains the internal control and workload planes of one
cluster: the API virtual IP, API server policy, controller manager, scheduler,
etcd, kubelets, IPVS service routing, pods, and registry mirrors.

<a class="archify-open"
   href="../_static/archify/kubernetes/infrastructure/talos-runtime.html"
   target="_blank" rel="noopener">Open the interactive Talos runtime architecture</a>

<iframe
  class="archify-frame archify-frame--architecture"
  src="../_static/archify/kubernetes/infrastructure/talos-runtime.html"
  title="Talos Kubernetes cluster runtime architecture"
  loading="lazy"
  allowfullscreen>
</iframe>

The diagram presents the intended Talos runtime architecture and its main
components.

## Environment promotion model

The promotion workflow captures the operating model described for Sandbox,
Test, Staging, and Production. It makes the validation gates explicit without
claiming that promotion between environments is automated.

<a class="archify-open"
   href="../_static/archify/kubernetes/infrastructure/environment-promotion.html"
   target="_blank" rel="noopener">Open the interactive environment promotion workflow</a>

<iframe
  class="archify-frame"
  src="../_static/archify/kubernetes/infrastructure/environment-promotion.html"
  title="Kubernetes environment promotion model"
  loading="lazy"
  allowfullscreen>
</iframe>

The service description also contains a separate three-cluster statement. The
four-environment view is used as the general operating model; the physical
cluster history is outside the scope of this architecture overview.

## GitOps control plane

The <a class="archify-open"
href="../_static/archify/kubernetes/apps/argocd/production-gitops-architecture.html"
target="_blank" rel="noopener">Argo CD production GitOps architecture</a>
documents the cluster-management path:

- a self-managed Argo CD control plane reconciles `envs/prod` from GitLab;
- Application and ApplicationSet resources deploy platform services and
  workloads into the registered production and staging clusters;
- Dex, ESS LDAP, and Argo CD RBAC control operator access;
- Vault Secrets Operator supplies TLS, LDAP, repository, and remote-cluster
  credentials;
- Prometheus service discovery and a Grafana dashboard provide operational
  visibility.

Backup-specific infrastructure dependencies are documented under
[Backup and recovery](backup.md), with the generic CSI and storage path under
[Platform layers](layers.md).