series: k0s Cluster Setup
- Traefik → APISIX on a single node: what broke during the ingress migration A direct cutover from Traefik to APISIX on bare-metal k0s: hostNetwork port conflicts, a broken --set with commas, an addPrefix bug causing 404s on assets, and eight more findings.
- Full observability on one VPS: metrics, logs, alerts, dashboards — 452 MiB requested How VictoriaMetrics, VictoriaLogs, Promtail, vmalert, and Grafana fit together on a 2-core VPS: architecture, the full resource bill, and repeating patterns.
- Deploying to k0s with a shell script instead of CI/CD One shell script, a self-hosted Docker registry, and envsubst. No GitHub Actions, no ArgoCD — here's why that's enough.
- Self-hosted Docker registry inside the k0s cluster registry:2 on NodePort 30500, no external dependencies for deploys, and automatic cleanup of old image tags.
- Automatic TLS with cert-manager, Let's Encrypt, and Traefik IngressRoutes ClusterIssuers, HTTP-01 challenges, multi-SAN certificates, and addPrefix middleware for subdomain routing.
- Helm charts declared in k0s config: Flannel, Traefik, cert-manager, Prometheus k0s has a built-in Helm controller. Declare charts in k0s.yaml and they install automatically on startup — no FluxCD required.
- Setting up a Debian VPS for k0s: sysctl, kernel modules, and the install What 01-prepare-vm.sh actually does: disabling swap, tuning inotify limits, loading kernel modules, and installing k0s single-node.
- cert-manager: wildcard certificates with DNS-01 challenge ClusterIssuer with ACME DNS-01 via Yandex Cloud DNS webhook. Certificate CR for *.dev.test.antonnovikov.com, sealed distribution to spoke clusters.
- Traefik Middleware for security headers: HSTS, CSP, and frame protection Traefik Middleware resources for HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Content-Security-Policy. IngressRoute wiring and testing headers with curl.
No posts match the selected filters.