Cluster infrastructure

This catalogue view groups diagrams that explain cluster boundaries and shared infrastructure dependencies.

Cluster fleet

The fleet view maps the four environment overlays currently declared in the Talos automation repository. It shows their site boundary, configured Talos and Kubernetes versions, and the conditional bootstrap path in the provisioning workflow.

Open the interactive cluster fleet architecture

The platform model places Sandbox and Test in CSLab and Staging and Production in GPN. Each environment has three control-plane hosts and five worker hosts. The playbook can bootstrap Argo CD and Vault Secrets Operator, but every current environment overlay disables that conditional path.

Talos cluster runtime

The runtime view explains the internal control and workload planes of one cluster: the API virtual IP, API server policy, controller manager, scheduler, etcd, kubelets, IPVS service routing, pods, and registry mirrors.

Open the interactive Talos runtime architecture

The diagram presents the intended Talos runtime architecture and its main components.

Environment promotion model

The promotion workflow captures the operating model described for Sandbox, Test, Staging, and Production. It makes the validation gates explicit without claiming that promotion between environments is automated.

Open the interactive environment promotion workflow

The service description also contains a separate three-cluster statement. The four-environment view is used as the general operating model; the physical cluster history is outside the scope of this architecture overview.

GitOps control plane

The Argo CD production GitOps architecture documents the cluster-management path:

  • a self-managed Argo CD control plane reconciles envs/prod from GitLab;

  • Application and ApplicationSet resources deploy platform services and workloads into the registered production and staging clusters;

  • Dex, ESS LDAP, and Argo CD RBAC control operator access;

  • Vault Secrets Operator supplies TLS, LDAP, repository, and remote-cluster credentials;

  • Prometheus service discovery and a Grafana dashboard provide operational visibility.

Backup-specific infrastructure dependencies are documented under Backup and recovery, with the generic CSI and storage path under Platform layers.