Skip to content

K3s Master Node (OCI)

The Master Node functions as the control plane for the production K3s cluster hosted on OCI.

Role: Production Cluster Control Plane
Instance: Private Oracle Ampere A1 control-plane node OS: Ubuntu 24.04.5 LTS (ARM64)

1. Hardware Specification

The master node is the primary compute resource for cluster management:

Component Specification Description
CPU 2 OCPU Current Oracle free-tier allocation
RAM 12 GB Current Oracle free-tier allocation for control plane and core apps
Storage 150 GB Block Volume (High Performance)
Network Private overlay access Tailscale-managed administration

2. Software Architecture

Core Components

  • Orchestrator: K3s v1.34.3+k3s1 (Lightweight Kubernetes).
  • Container Runtime: containerd 2.1.5-k3s1.
  • Storage Provider: Longhorn for selected persistent workloads, with local-path for node-bound data.
  • Network CNI: Flannel (standard K3s configuration).
  • Ingress: Traefik with internal HTTPS certificates issued by cert-manager.
  • Delivery: ArgoCD reconciles declarative manifests from the infrastructure repository.

3. Deployment and Provisioning

Infrastructure is provisioned using the following standard procedures:

  1. Base OS: Ubuntu 24.04.5 LTS Minimal is deployed with cloud-init configuration.

  2. K3s Installation: Executed via the official install script with specific flags for ARM64 optimization:

    curl -sfL https://get.k3s.io | sh -s - server --cluster-init

  3. Token Management: The cluster-join token is secured and stored within the secret management system.

4. Security Hardening

Control plane security is maintained through:

  • Access Boundary: Tailscale-only administration and internal service access.
  • Authentication: RBAC (Role-Based Access Control) is strictly enforced.
  • NetworkPolicy: Enforcement is enabled with staged, selector-based application rules.
  • Pod Security: warn and audit are set to baseline for application namespaces; enforcement remains unset.
  • Kubeconfig: /etc/rancher/k3s/k3s.yaml is persistently 0600 root:root.

5. Resource Management

To maintain optimal performance for hosted applications like OpenClaw, heavy compute services are offloaded:

  • Ollama Offloading: The local Ollama deployment has been removed from the K3s cluster.
  • External Failover: AI inference tasks are routed to an external Ollama instance (Windows PC) or cloud providers via OpenRouter to preserve OCPU and RAM for core application services.

6. Current Security Controls

The control plane is operated as an internal, Tailscale-only environment. NetworkPolicy enforcement is enabled and application access is defined with namespace and pod selectors. Direct NodePort access remains available only for explicitly required paths.

Kubeconfig permissions are restricted to the root account. Container images and stateful chart revisions are pinned through GitOps, while persistent application data remains protected by Longhorn backups.

Internal service domains are terminated by Traefik using certificates issued by cert-manager v1.21.2 from a private certificate authority. The private CA must be installed on trusted administrative clients before browser verification succeeds.

7. Current Health

  • Node: k3s-master, Ready
  • ArgoCD applications: Synced / Healthy
  • K3s service: active
  • Tailscale service: active
  • No workloads are currently outside Running or expected Completed state.