Cumulus infrastructure

A single k3s node on one rented cloud VM. Cilium is CNI and ingress via Gateway API, with the Gateway's Envoy on the host network. FluxCD drives GitOps and image automation. Longhorn stores state at one replica, backed up off-box to S3-compatible object storage. External Secrets Operator pulls from the configured secret provider; Reloader restarts on change. cert-manager and external-dns handle TLS and records automatically. Images come from a self-hosted registry that CI authenticates to by OIDC.

Being one rented VM shapes most of the decisions below: no HA, one public address, and object storage as the only thing that survives losing the box.

This skill holds what's true because of how this cluster is built, not general Kubernetes knowledge. Assume you already know the rest.

Domains, namespaces, and versions are deliberately absent. They're in the repo's CLAUDE.md, or discover them:

kubectl get gateway -A -o wide
kubectl get ns

Rule zero: use the right secret skill

When a task involves BWS, Bitwarden, or provider-side credential retrieval, creation, or rotation, use the bws-secrets skill first. It owns credential access and handling; do not reproduce its commands or policies here.