Kubernetes on Landry Zetam - Tech Blog

The Full Architecture of My Kubernetes Agents

Mon, 10 Aug 2026 00:00:00 +0000

Five agents run against my K3s cluster. Three of them form a closed loop — one detects problems, one fixes them, one reviews the fix — and none of the three can do another’s job. This is everything about how they’re built: the framework, the prompt assembly, every tool, both safety gates, the memory layers, and a real pull request one of them opened.

Then I merged it and spent a day fixing what production found. Eight more bugs, none of them in the agent logic — §17 onward is that day, and it’s the more useful half.

NetworkPolicy vs AuthorizationPolicy: One Decides If the Call Connects, the Other Decides If Anyone Answers

Thu, 11 Jun 2026 00:00:00 +0000

Kubernetes gives you two resources that both look like “firewall rules for pods,” and most teams deploy one and assume they got the other for free. They didn’t. The two policies operate at different layers, speak different languages, and fail in completely different ways — and you almost certainly need both.

The Setup

Picture a cluster running a service mesh (Istio, in my case) with a typical three-tier layout: an ingress gateway, a handful of API services, and a PostgreSQL database listening on port 5432. The security requirement sounds simple: only the API services should reach the database, and only the gateway should reach the APIs. The first instinct is to reach for a policy — and Kubernetes hands you two that both claim to do this. NetworkPolicy ships with Kubernetes itself (enforced by your CNI — Cilium, Calico). AuthorizationPolicy ships with Istio (enforced by the Envoy sidecar). Same goal on paper, very different machinery underneath.

Building a Production-Grade Home Network with UniFi VLANs

Tue, 23 Dec 2025 00:00:00 +0000

Your home network doesn’t have to be a flat, insecure mess where your smart toaster can talk to your NAS. With UniFi gear and some intentional design, you can build network segmentation that rivals enterprise setups—without the enterprise price tag. This is how I architected a 10-VLAN home network that isolates everything from security cameras to a 7-node Kubernetes cluster.

Part 1: The Design Philosophy

Why Segment at All?

Most home networks run everything on a single subnet. Your laptop, your Ring cameras, your kids’ tablets, and your IoT light bulbs all share the same network space. This creates several problems:

GitOps Framework: How the Fako Cluster Repository is Organized

Sun, 21 Dec 2025 00:00:00 +0000

Overview

The Fako Cluster uses a GitOps approach where Git is the single source of truth for all cluster state. Every deployment, configuration change, and infrastructure update flows through Git commits. FluxCD watches the repository and automatically reconciles the cluster to match the desired state defined in code.

This post explains the repository structure, the reasoning behind each directory, and how the pieces work together.

Repository Structure

fako-cluster/
├── apps/ # Application deployments
│ ├── base/ # Base Kustomize configurations
│ └── staging/ # Environment overlay (what actually deploys)
├── clusters/ # Cluster bootstrap and Flux config
│ └── staging/ # Flux Kustomizations that orchestrate everything
├── infrastructure/ # Platform components
│ ├── controllers/ # Operators (Cert-Manager, CloudNative-PG, etc.)
│ └── configs/ # Configuration for controllers
├── monitoring/ # Observability stack
│ ├── controllers/ # Prometheus, Loki, Grafana, etc.
│ └── configs/ # Dashboards, alerting rules
├── scripts/ # Deployment and maintenance scripts
└── notes/ # Documentation and troubleshooting

The Base/Staging Pattern

The most important concept to understand is the base/staging pattern used throughout the repository.

From Transcripts to Summaries: Completing the Audio Pipeline

Sat, 20 Dec 2025 00:00:00 +0000

Remember that audio transcription pipeline I built? Raw recordings flow in, get compressed, transcribed by Whisper, and stored as JSON. Great for archival, but 204 transcript files sitting on NFS storage aren’t exactly useful. Today I’ll show you how I completed the loop—automatically summarizing transcripts with an LLM and publishing everything to my Obsidian vault.

Part 1: The Problem with Raw Transcripts

The original pipeline worked beautifully. Every morning, new transcripts appeared as JSON files:

Complete Kubernetes Security Pipeline - Kube-bench and Kubescape to Obsidian

Fri, 19 Dec 2025 00:00:00 +0000

What if your Kubernetes cluster could write comprehensive security reports directly into your second brain every night? Not just one perspective, but two complementary views: infrastructure security and workload security. I built exactly that—a pipeline combining kube-bench (CIS benchmarks) and kubescape (NSA/MITRE frameworks) that publishes human-readable reports to Obsidian automatically. Here’s how the complete system works.

Part 1: Why You Need Both Tools

The Security Visibility Gap

Running a Kubernetes homelab means wearing many hats. Security scanning tools exist, but most people either:

Prometheus WAL Replay: When Your Metrics Database Can't Start Fast Enough

Thu, 18 Dec 2025 00:00:00 +0000

There’s a special kind of frustration that comes from watching a pod restart 90 times over 37 hours, each time getting just a little further before Kubernetes kills it again. Today I debugged a Prometheus instance stuck in an infinite crash loop, and the root cause was surprisingly subtle: the database was simply too large to start within the default health check window.

This is the story of startup probes, Write-Ahead Logs, and why your monitoring system might be the hardest thing to monitor.

Building a Kubernetes Security Reporter for Obsidian

Wed, 17 Dec 2025 00:00:00 +0000

What if your Kubernetes cluster could automatically write security reports directly into your second brain? Today I built exactly that—a system that runs CIS benchmark scans against my K3s cluster and publishes the results as beautifully formatted Obsidian notes. No more checking dashboards or parsing JSON files; just open your vault and see your cluster’s security posture.

Part 1: The Problem

Security Visibility in a Homelab

Running a Kubernetes homelab means wearing many hats: developer, operator, and security engineer. Tools like kube-bench exist to scan your cluster against CIS benchmarks, but they typically output JSON or text that sits in a PersistentVolume gathering dust.

Enabling DNS-01 TLS for Internal Kubernetes Services

Tue, 16 Dec 2025 00:00:00 +0000

Ever visited a website and seen that little padlock icon in your browser? That’s TLS at work, encrypting the connection between you and the server. But what happens when you want that same security for services running on your home network that aren’t accessible from the internet? Today I solved this exact problem, and I want to walk you through not just how I did it, but why each piece matters.

Building an Automated Audio Transcription Pipeline on Kubernetes

Fri, 12 Dec 2025 00:00:00 +0000

Every day, raw audio recordings land on an SFTP server. By morning, they’re compressed, transcribed, and stored as searchable JSON - all without human intervention. Here’s how I built this pipeline on my homelab Kubernetes cluster.

The Problem

I had a growing collection of audio recordings that needed transcription. Manual processing wasn’t sustainable: download files, compress them, run through a transcription service, organize the output. This needed automation.

The requirements were straightforward:

Building an Oura Ring Health Dashboard with Streamlit

Fri, 08 Aug 2025 00:00:00 +0000

Overview

Oura Dashboard is a Streamlit-based web application deployed in the Fako cluster that provides interactive visualization of health data collected from the Oura Ring. It connects to the PostgreSQL database populated by the Oura Collector service and presents comprehensive health insights through charts, graphs, and analytics. The dashboard is secured with OAuth2 authentication and provides personalized health tracking capabilities for sleep, activity, readiness, and heart rate metrics.

Key Features

Interactive Visualizations: Real-time charts and graphs using Streamlit
Comprehensive Metrics: Sleep, activity, readiness, and HRV analytics
OAuth2 Authentication: Secure access with OAuth2 proxy
PostgreSQL Integration: Direct database queries for data
Responsive Design: Mobile-friendly interface
Health Trends: Long-term pattern analysis
Custom Reports: Exportable health summaries
Real-time Updates: Auto-refresh capabilities

Architecture

Components

Streamlit App: Python-based web dashboard
OAuth2 Proxy: Authentication layer
Service: ClusterIP on port 8501
Ingress: HTTPS access with authentication
External Secrets: AWS Secrets Manager integration
Database Connection: PostgreSQL read access

Resource Requirements

Memory: 256Mi (request), 512Mi (limit)
CPU: 100m (request), 500m (limit)
Storage: EmptyDir for temporary data
Port: 8501 (Streamlit default)

Configuration

Environment Settings

Parameter	Value	Description
`DATABASE_NAME`	`app`	PostgreSQL database
`DAYS_TO_BACKFILL`	`7`	Default data range
`LOG_LEVEL`	`INFO`	Application logging
`API_TIMEOUT`	`30`	Query timeout

OAuth2 Configuration

Protected by OAuth2 proxy for secure access:

Home Assistant Voice Pipeline with Ollama

Fri, 08 Aug 2025 00:00:00 +0000

Overview

This implementation demonstrates a complete voice assistant pipeline using Wyoming Satellite with Home Assistant and Ollama as the AI brain, achieving natural conversation and smart home control entirely on-premises. The system transforms spoken words into meaningful actions through a sophisticated pipeline of AI models, all running locally for complete privacy.

Why Ollama for Voice?

Voice assistants have unique requirements that Ollama handles beautifully:

Speed Requirements

Response Time: < 2 seconds for natural conversation
Model Loading: Pre-loaded models for instant responses
Streaming: Real-time token generation for faster perceived response

Privacy First

Local Processing: No cloud dependencies
Conversation History: Stored locally, never uploaded
Custom Wake Words: Combined with OpenWakeWord for complete privacy

Components Used

OpenWakeWord: Wake word detection (“Hey Jarvis”)
Whisper: Speech-to-text transcription
Ollama (Qwen2.5:3b & Llama 8B): Natural language understanding and response generation
Piper TTS: Text-to-speech synthesis
Home Assistant: Smart home orchestration and pipeline management
Wyoming Satellite: Voice satellite software on Raspberry Pi

Hardware Setup

Raspberry Pi 5 (2.4GHz, 4GB RAM) - Voice satellite device
ME6S USB Microphone - Audio input device
Bluetooth Speaker (88:92:CC:5D:CB:79) - Audio output via BlueALSA
Mini PC - Home Assistant server
Kubernetes Cluster - Container orchestration for AI services
NVIDIA GPU Node (yeezyai) - GPU acceleration for Ollama

The Voice Pipeline Architecture

The voice pipeline runs entirely on the K8s homelab, with Ollama at its heart:

Powering Open WebUI and Cline with GPUStack: My AI Infrastructure Journey

Fri, 08 Aug 2025 00:00:00 +0000

After building my Mac AI cluster, I needed a way to make it accessible to all my tools. The journey took me through several frameworks before landing on the perfect solution: GPUStack providing an OpenAI-compatible API that seamlessly integrates with everything.

The Evolution: Finding the Right Framework

The Journey

My path to the current setup wasn’t straightforward:

MLX Distributed Computing: Started here for model training and local inference on Apple Silicon
Exo Labs: Experimented with this promising framework, but pivoted when the community began a redesign
GPUStack: The solution that finally clicked - providing OpenAI-compatible endpoints that work with everything

The Current Architecture

Here’s how my AI infrastructure actually works:

From GitHub Notes to Production Blog

Thu, 07 Aug 2025 00:00:00 +0000

Why This Guide Exists

I’ve been doing a lot of dev work, research and hadn’t really thought about sharing the knowledge without having to learn frontend development or maintain complex code. I knew I had a bunch of markdown GitHub notes and thought they could be used as a baseline to catch up on all my lack of documentation. Then I found Hugo.

This guide covers the entire workflow of creating a Hugo blog, containerizing it, and deploying it to Kubernetes - all without writing a single line of frontend code (html, css, js).

Running 184 Pods on a 6-Node K3s Homelab Cluster

Thu, 07 Aug 2025 00:00:00 +0000

Project Overview

The Fako Cluster is my production Kubernetes environment that serves as the foundation for all other projects. It’s a self-hosted, production-grade K8s cluster that demonstrates enterprise-level practices while running on homelab hardware.

Why “Fako”?

The name “Fako” holds special significance - it’s named after Mount Fako (Mount Cameroon), the highest peak in West and Central Africa. Just as Mount Fako stands as a towering landmark visible from miles away, this Kubernetes cluster serves as the foundational infrastructure that all other services can rely on.

Securing GitOps: SOPS Secret Management in k8s with FluxCD

Thu, 07 Aug 2025 00:00:00 +0000

The Problem: Secrets in GitOps

When I started my Kubernetes homelab journey, I quickly hit a wall that every GitOps practitioner faces: How do you store secrets in Git without compromising security?

The GitOps philosophy is beautifully simple - everything should be in Git. Your entire cluster state, all your applications, configurations, and yes, even secrets. But committing passwords, API keys, and certificates to a public (or even private) repository feels fundamentally wrong. It is wrong.

Self-Hosting n8n on Kubernetes for AI Automation

Thu, 07 Aug 2025 00:00:00 +0000

Overview

N8N is an open-source workflow automation tool deployed in the Fako cluster. It provides a visual interface for creating complex automation workflows, integrating with hundreds of services and APIs. N8N allows you to automate repetitive tasks, connect different services, and build sophisticated data pipelines without extensive coding.

Key Features

Visual Workflow Builder: Drag-and-drop interface for creating automations
200+ Integrations: Pre-built nodes for popular services
Self-Hosted: Full control over your data and workflows
PostgreSQL Backend: Reliable storage using the cluster’s PostgreSQL
Webhook Support: Trigger workflows via HTTP webhooks
Custom Functions: JavaScript code support for complex logic
Fair-Code License: Source available with sustainable business model

Architecture

Components

Deployment: Single-replica deployment (stateful workflows)
Service: ClusterIP service on port 5678
Ingress: HTTPS access at n8n.landryzetam.net
Storage: PersistentVolumeClaim for workflow data
Database: PostgreSQL for workflow definitions and execution data
External Secrets: Database credentials from AWS Secrets Manager

Resource Requirements

Memory: 512Mi (request), 2Gi (limit)
CPU: 250m (request), 1000m (limit)
Storage: Persistent volume for N8N data and files
Database: Uses shared PostgreSQL cluster

Configuration

Environment Settings

Parameter	Value	Description
`N8N_HOST`	`n8n.landryzetam.net`	External hostname
`N8N_PORT`	`5678`	Application port
`N8N_PROTOCOL`	`https`	External protocol
`WEBHOOK_URL`	`https://n8n.landryzetam.net/`	Webhook base URL
`GENERIC_TIMEZONE`	`America/New_York`	Timezone for scheduling
`N8N_METRICS`	`true`	Enable metrics endpoint
`N8N_TEMPLATES_ENABLED`	`true`	Enable workflow templates

Database Configuration

Type: PostgreSQL
Host: postgres-cluster-rw.postgres.svc.cluster.local
Database: app
User: app
Password: Managed via External Secrets

Usage

Accessing N8N

External access:

GitOps in Practice: Managing k8s with FluxCD

Wed, 06 Aug 2025 00:00:00 +0000

After running the Fako Cluster for several months, I can confidently say that adopting GitOps with FluxCD has been one of the best decisions for managing my Kubernetes infrastructure. In this post, I’ll share practical insights and patterns that have proven invaluable.

What is GitOps?

GitOps is a way of implementing Continuous Deployment for cloud native applications. FluxCD is designed to simplify that, making it easier than ever to manage your Kubernetes environments. Here’s why i leverage it in my workflow: