Homelab / A three-member control plane and a Gateway that terminates TLS.
Kubernetes cluster
Three control nodes share etcd and a virtual address; worker nodes sit behind a Gateway that terminates TLS with a wildcard certificate cert-manager renews over DNS-01. A non-voting etcd member keeps snapshots off the server.
Three control nodes share etcd and a virtual address.
A Gateway terminates TLS with a wildcard certificate cert-manager renews over DNS-01.
A non-voting etcd member keeps snapshots off the server.
How I built it
Three etcd voters tolerate losing one; the non-voting member does not change quorum and exists so the backup leaves the hardware it protects. Renewal goes over DNS-01 rather than HTTP-01 because the nodes are not exposed, and validating a certificate should not be the reason to expose them.