Production-Replica Kubernetes Stack
A full GitOps cluster on k3s running on a Hetzner cloud server: ArgoCD for continuous delivery, HashiCorp Vault with the Kubernetes auth method, External Secrets Operator, Helm-managed releases, and kube-prometheus-stack with Loki and Promtail for metrics and logs.
- k3s
- ArgoCD
- Vault
- Helm
- Prometheus
- Loki
Why build it
Running a cluster you own, where nobody else is on call, is the fastest way to understand what the managed version is doing for you. This one was built to mirror a production setup rather than a demo.
Delivery
ArgoCD watches the repository and reconciles the cluster to match it, so the deployed state is whatever is in Git. Releases are Helm charts rather than loose manifests, which makes a rollback a version change instead of an archaeology exercise.
Secrets and observability
Vault holds the secrets, using the Kubernetes auth method so pods authenticate with their service account rather than a stored token. External Secrets Operator syncs them into the cluster as needed.
kube-prometheus-stack covers metrics, with Loki and Promtail aggregating logs across workloads.