infra/clusters/vntx/DEPLOYMENT.md

VNTX Cluster Deployment Guide

This guide walks through deploying the VNTX K3s cluster on Proxmox to consolidate all infrastructure services.

Prerequisites

• Proxmox cluster with sufficient resources
• OpenTofu/Terraform installed locally
• Ansible installed locally
• SSH access to Proxmox nodes

Step 1: Deploy Flatcar VMs with OpenTofu

cd clusters/vntx/terraform

# Copy and edit the example vars
cp terraform.tfvars.example terraform.tfvars
vim terraform.tfvars

# Set Proxmox password
export TF_VAR_proxmox_password="your-proxmox-password"

# Initialize and deploy
tofu init
tofu plan
tofu apply

This creates:

• 3 control plane nodes (4 CPU, 8GB RAM, 50GB disk)
• 2 worker nodes (8 CPU, 16GB RAM, 50GB + 200GB disks)

Step 2: Bootstrap K3s Cluster

cd ../ansible

# Prepare Flatcar nodes
ansible-playbook -i inventory.yml prepare-flatcar.yml

# Install K3s cluster
ansible-playbook -i inventory.yml k3s-install.yml

# Verify cluster
export KUBECONFIG=./kubeconfig
kubectl get nodes

Step 3: Deploy Core System Services

cd ..

# Install MetalLB for load balancing
kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.13.12/config/manifests/metallb-native.yaml
kubectl apply -f system/metallb/config.yaml

# Install Longhorn for storage
kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.5.3/deploy/longhorn.yaml

# Install cert-manager
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cert-manager.yaml

# Create namespaces
kubectl apply -f system/base/namespaces.yaml

Step 4: Deploy Infrastructure Services

Deploy MariaDB (shared database)

kubectl apply -f infrastructure/monitoring/mariadb/

# Create databases for services
kubectl exec -it -n monitoring mariadb-0 -- mysql -u root -p
CREATE DATABASE icinga2;
CREATE DATABASE icingaweb2;
CREATE USER 'icinga2'@'%' IDENTIFIED BY 'secure-password';
GRANT ALL ON icinga2.* TO 'icinga2'@'%';
CREATE USER 'icingaweb2'@'%' IDENTIFIED BY 'secure-password';
GRANT ALL ON icingaweb2.* TO 'icingaweb2'@'%';

Deploy Monitoring Stack

# Create secrets
kubectl create secret generic -n monitoring icinga2-mysql \
  --from-literal=password='secure-password'
kubectl create secret generic -n monitoring icingaweb2-mysql \
  --from-literal=password='secure-password'

# Deploy Icinga2
kubectl apply -f infrastructure/monitoring/icinga2/

Deploy Network Services

# Deploy Unbound DNS
kubectl apply -f infrastructure/network-services/unbound/

# Deploy FreeRADIUS
kubectl apply -f infrastructure/network-services/freeradius/

Step 5: Configure Ingress and Access

# Get MetalLB assigned IPs
kubectl get svc -A | grep LoadBalancer

# Configure DNS entries for services
# icinga.vntx.net -> Icinga2 LoadBalancer IP
# radius.vntx.net -> FreeRADIUS LoadBalancer IP

Service Migration Checklist

From monitor.vntx.net (Icinga2):

• Export Icinga2 configuration
• Export monitoring database
• Migrate custom check scripts
• Update monitored hosts to point to new IP
• Verify all checks working

From DNS servers:

• Export zone files
• Update forwarders configuration
• Test resolution
• Update DHCP to use new DNS

From RADIUS server:

• Export user database
• Export clients configuration
• Test authentication
• Update network devices to use new RADIUS

Maintenance

Cluster Updates

# Flatcar auto-updates by default
# K3s updates:
curl -sfL https://get.k3s.io | sh -s - upgrade

Backup

# Install Velero for cluster backup
# Backup to S3-compatible storage

Monitoring

• Access Icinga2 Web: http://icinga.vntx.net
• Kubernetes dashboard: Install via Rancher or Lens

Troubleshooting

Check pod logs

kubectl logs -n monitoring deployment/icinga2
kubectl logs -n network-services deployment/freeradius

Node issues

# SSH to Flatcar node
ssh core@10.0.0.101

# Check K3s service
sudo systemctl status k3s
sudo journalctl -u k3s -f