Cumulus infrastructure

A single k3s node on one rented dedicated server. Cilium is CNI and ingress via Gateway API, with the Gateway's Envoy on the host network. FluxCD drives GitOps and image automation. State lives on local-path volumes on the node's RAID1 root and is protected by nightly logical dumps to S3-compatible object storage, not by replication. External Secrets Operator pulls from the configured secret provider. cert-manager and external-dns handle TLS and records automatically. Images come from a self-hosted registry that CI authenticates to by OIDC.

One box shapes most of the decisions below: no HA, one public address, and object storage as the only thing that survives losing it.

This skill holds what's true because of how this cluster is built, not general Kubernetes knowledge. Assume you already know the rest.

Domains, namespaces, and versions are deliberately absent. They're in the repo's CLAUDE.md, or discover them:

kubectl get gateway -A -o wide
kubectl get ns

Rule zero: use the right secret skill

When a task involves BWS, Bitwarden, or provider-side credential retrieval, creation, or rotation, use the bws-secrets skill first. It owns credential access and handling; do not reproduce its commands or policies here.