GitOps on Landry Zetam - Tech Blog

The Full Architecture of My Kubernetes Agents

Mon, 10 Aug 2026 00:00:00 +0000

Five agents run against my K3s cluster. Three of them form a closed loop — one detects problems, one fixes them, one reviews the fix — and none of the three can do another’s job. This is everything about how they’re built: the framework, the prompt assembly, every tool, both safety gates, the memory layers, and a real pull request one of them opened.

Then I merged it and spent a day fixing what production found. Eight more bugs, none of them in the agent logic — §17 onward is that day, and it’s the more useful half.

GitOps Framework: How the Fako Cluster Repository is Organized

Sun, 21 Dec 2025 00:00:00 +0000

Overview

The Fako Cluster uses a GitOps approach where Git is the single source of truth for all cluster state. Every deployment, configuration change, and infrastructure update flows through Git commits. FluxCD watches the repository and automatically reconciles the cluster to match the desired state defined in code.

This post explains the repository structure, the reasoning behind each directory, and how the pieces work together.

Repository Structure

fako-cluster/
├── apps/ # Application deployments
│ ├── base/ # Base Kustomize configurations
│ └── staging/ # Environment overlay (what actually deploys)
├── clusters/ # Cluster bootstrap and Flux config
│ └── staging/ # Flux Kustomizations that orchestrate everything
├── infrastructure/ # Platform components
│ ├── controllers/ # Operators (Cert-Manager, CloudNative-PG, etc.)
│ └── configs/ # Configuration for controllers
├── monitoring/ # Observability stack
│ ├── controllers/ # Prometheus, Loki, Grafana, etc.
│ └── configs/ # Dashboards, alerting rules
├── scripts/ # Deployment and maintenance scripts
└── notes/ # Documentation and troubleshooting

The Base/Staging Pattern

The most important concept to understand is the base/staging pattern used throughout the repository.

From Transcripts to Summaries: Completing the Audio Pipeline

Sat, 20 Dec 2025 00:00:00 +0000

Remember that audio transcription pipeline I built? Raw recordings flow in, get compressed, transcribed by Whisper, and stored as JSON. Great for archival, but 204 transcript files sitting on NFS storage aren’t exactly useful. Today I’ll show you how I completed the loop—automatically summarizing transcripts with an LLM and publishing everything to my Obsidian vault.

Part 1: The Problem with Raw Transcripts

The original pipeline worked beautifully. Every morning, new transcripts appeared as JSON files:

Complete Kubernetes Security Pipeline - Kube-bench and Kubescape to Obsidian

Fri, 19 Dec 2025 00:00:00 +0000

What if your Kubernetes cluster could write comprehensive security reports directly into your second brain every night? Not just one perspective, but two complementary views: infrastructure security and workload security. I built exactly that—a pipeline combining kube-bench (CIS benchmarks) and kubescape (NSA/MITRE frameworks) that publishes human-readable reports to Obsidian automatically. Here’s how the complete system works.

Part 1: Why You Need Both Tools

The Security Visibility Gap

Running a Kubernetes homelab means wearing many hats. Security scanning tools exist, but most people either:

Prometheus WAL Replay: When Your Metrics Database Can't Start Fast Enough

Thu, 18 Dec 2025 00:00:00 +0000

There’s a special kind of frustration that comes from watching a pod restart 90 times over 37 hours, each time getting just a little further before Kubernetes kills it again. Today I debugged a Prometheus instance stuck in an infinite crash loop, and the root cause was surprisingly subtle: the database was simply too large to start within the default health check window.

This is the story of startup probes, Write-Ahead Logs, and why your monitoring system might be the hardest thing to monitor.

Building a Kubernetes Security Reporter for Obsidian

Wed, 17 Dec 2025 00:00:00 +0000

What if your Kubernetes cluster could automatically write security reports directly into your second brain? Today I built exactly that—a system that runs CIS benchmark scans against my K3s cluster and publishes the results as beautifully formatted Obsidian notes. No more checking dashboards or parsing JSON files; just open your vault and see your cluster’s security posture.

Part 1: The Problem

Security Visibility in a Homelab

Running a Kubernetes homelab means wearing many hats: developer, operator, and security engineer. Tools like kube-bench exist to scan your cluster against CIS benchmarks, but they typically output JSON or text that sits in a PersistentVolume gathering dust.

Building an Automated Audio Transcription Pipeline on Kubernetes

Fri, 12 Dec 2025 00:00:00 +0000

Every day, raw audio recordings land on an SFTP server. By morning, they’re compressed, transcribed, and stored as searchable JSON - all without human intervention. Here’s how I built this pipeline on my homelab Kubernetes cluster.

The Problem

I had a growing collection of audio recordings that needed transcription. Manual processing wasn’t sustainable: download files, compress them, run through a transcription service, organize the output. This needed automation.

The requirements were straightforward:

From GitHub Notes to Production Blog

Thu, 07 Aug 2025 00:00:00 +0000

Why This Guide Exists

I’ve been doing a lot of dev work, research and hadn’t really thought about sharing the knowledge without having to learn frontend development or maintain complex code. I knew I had a bunch of markdown GitHub notes and thought they could be used as a baseline to catch up on all my lack of documentation. Then I found Hugo.

This guide covers the entire workflow of creating a Hugo blog, containerizing it, and deploying it to Kubernetes - all without writing a single line of frontend code (html, css, js).

Running 184 Pods on a 6-Node K3s Homelab Cluster

Thu, 07 Aug 2025 00:00:00 +0000

Project Overview

The Fako Cluster is my production Kubernetes environment that serves as the foundation for all other projects. It’s a self-hosted, production-grade K8s cluster that demonstrates enterprise-level practices while running on homelab hardware.

Why “Fako”?

The name “Fako” holds special significance - it’s named after Mount Fako (Mount Cameroon), the highest peak in West and Central Africa. Just as Mount Fako stands as a towering landmark visible from miles away, this Kubernetes cluster serves as the foundational infrastructure that all other services can rely on.

Securing GitOps: SOPS Secret Management in k8s with FluxCD

Thu, 07 Aug 2025 00:00:00 +0000

The Problem: Secrets in GitOps

When I started my Kubernetes homelab journey, I quickly hit a wall that every GitOps practitioner faces: How do you store secrets in Git without compromising security?

The GitOps philosophy is beautifully simple - everything should be in Git. Your entire cluster state, all your applications, configurations, and yes, even secrets. But committing passwords, API keys, and certificates to a public (or even private) repository feels fundamentally wrong. It is wrong.

GitOps in Practice: Managing k8s with FluxCD

Wed, 06 Aug 2025 00:00:00 +0000

After running the Fako Cluster for several months, I can confidently say that adopting GitOps with FluxCD has been one of the best decisions for managing my Kubernetes infrastructure. In this post, I’ll share practical insights and patterns that have proven invaluable.

What is GitOps?

GitOps is a way of implementing Continuous Deployment for cloud native applications. FluxCD is designed to simplify that, making it easier than ever to manage your Kubernetes environments. Here’s why i leverage it in my workflow: