This site is one small, stateless workload on a shared Linode Kubernetes Engine (LKE) cluster that also runs several unrelated applications and the platform services that support them. This post is a tour of what’s underneath — the infrastructure layer — without the tenant-specific details.
Compute
A deliberately small node pool:
- A small pool of modest dedicated nodes — a few vCPUs and a few GB of RAM apiece. Enough to run real workloads, cheap enough to leave running.
- Kubernetes v1.35, nodes on Debian 12 with containerd as the runtime.
- Calico for the CNI / network policy, CoreDNS (2 replicas behind an autoscaler) for in-cluster DNS.
It’s a single-region pool, which is the honest tradeoff here: one failure domain in exchange for low cost and operational simplicity. The whole thing is sized like a homelab but runs like production.
What runs on it
Across roughly a dozen namespaces the cluster carries on the order of 30 deployments, a handful of StatefulSets and DaemonSets, scheduled CronJobs, and ~70 pods at any given time. That’s a mix of static sites, application workloads with separate dev / staging / production environments, a few API and integration services, and the shared platform components described below. Workloads are namespaced and isolated from each other.
Networking, ingress & TLS
Traffic enters through Linode NodeBalancers (managed L4 load balancers) fronting in-cluster ingress controllers, which route by host/path to the backend Services and pods. TLS is fully automated:
- cert-manager issues certificates from Let’s Encrypt using the HTTP-01 challenge.
- Every public host gets its own certificate, and they auto-renew — the oldest has been renewing itself for 600+ days without intervention.
Certificates are stored as Kubernetes Secrets and wired to the ingress automatically; there’s no manual cert handling anywhere in the flow.
Storage & state
The cluster is kept as stateless as possible:
- Persistent storage comes from the Linode Block Storage CSI driver, with a retain policy as the default so data outlives a volume’s claim.
- The main piece of in-cluster state is a highly available Redis + Sentinel cluster (with a pod disruption budget), its members each backed by their own block volume.
- The primary relational database lives outside the cluster as a managed service, reached through an in-cluster connection pooler — so the cluster itself holds very little durable data and nodes stay disposable.
Observability
A full monitoring and logging stack runs in-cluster:
- Prometheus + Alertmanager + Grafana (the kube-prometheus stack) with the usual exporters — node, kube-state, blackbox, and a database exporter.
- Loki + Promtail for centralized log aggregation.
Security posture
Security is layered rather than relying on any single control:
- Least-privilege RBAC. Day-to-day deploys use narrowly scoped credentials bound to a single namespace, not cluster-admin. Roles grant only the verbs a given workflow actually needs.
- Zero-trust networking around the most sensitive workloads: default-deny NetworkPolicies on both ingress and egress, with explicit allow-rules for exactly the traffic that’s expected (DNS, outbound HTTPS, and the specific internal ports a service needs).
- Hardened containers on the services that handle credentials — non-root users, read-only root filesystems, all Linux capabilities dropped, a seccomp profile, and no privilege escalation.
- A locked-down control plane. The Kubernetes API sits behind an IP allowlist; CI opens it only for the duration of a deploy and closes it again (see Security).
- Supply-chain care. Critical images are pinned by immutable digest, and build inputs are vendored into the repo rather than pulled from third parties at build time.
Honest rough edges
It’s a real cluster, so it has real cleanup on the list: a single region is a single failure domain; a small node pool means resource budgeting matters; there’s some historical baggage being consolidated; and a few older components predate the current hardening standard and are working their way through it. Documenting those is part of keeping it honest — and part of why this site exists.