Skip to content

ARCH-PLATFORM-TOPOLOGY: Platform topology — global three-layer map

The handover map: one diagram, three layers, every node linked to its pill. This is the page a new technician reads first; from here they navigate the entire platform — physical infrastructure, the K8s platform layer, and the deployed services — without guessing where anything lives.

How to read this map

  • Bottom-up is the dependency direction: infrastructure hosts the platform; the platform hosts the services. Read the layers in order (infra → platform → services) when taking over.
  • Every node is clickable (on the rendered site) and is listed in the node→pill table below with its relative link. The pills carry the depth; this page carries the shape.
  • Dated facts only: the "verified state" section below is a snapshot as of last_verified. Live state always wins (DocOps §1) — re-read it with kubectl before relying on it.
  • What is NOT here: decision rationale (→ decisions), how to operate (→ operations), and the handover procedure itself (→ taking-over-the-platform.md).

The global diagram

flowchart TB
  subgraph L1["Layer 1 — INFRASTRUCTURE (OVH · Proxmox · Ceph)"]
    direction TB
    OVH["OVH — 8 dedicated servers · one vRack"]
    PX["Proxmox VE cluster wetopi7 — 8 nodes · VMs 8001-8042"]
    IAC["IaC — OpenTofu (bpg) + Cloudflare + Ansible · state 0600, never in Git"]
    BAST["wetopi-ops01 — SSH bastion · 92.222.245.91"]
    NAT["natgw — LAN egress · 92.222.245.83"]
    CEPH["Ceph LAN 192.168.96.0/20 — VLAN 2 · pre-existing"]
    OVH --> PX
    OVH --> BAST
    OVH --> NAT
    IAC -.->|"Proxmox HTTPS API"| PX
  end
  subgraph L2["Layer 2 — PLATFORM (RKE2 · Cilium · Edge · GitOps)"]
    direction TB
    K8S["RKE2 cluster wetopi3 — 3 CP + 3 platform + 2 edge workers · API VIP 10.72.0.20"]
    CILIUM["Cilium CNI + Hubble (no Canal — ADR-0005)"]
    EDGE["WAN edge v1 — Traefik on rke-wan01/02 · Gateway wetopi-edge"]
    GITOPS["GitOps — Argo CD v3.4.8 · AppProject platform"]
    K8S --- CILIUM
    K8S --- EDGE
    K8S --- GITOPS
  end
  subgraph L3["Layer 3 — SERVICES (deployed via GitOps)"]
    direction LR
    SVCARGO["Argo CD — argo.wetopi.net"]
    SVCVAULT["Vault / Infisical — vault.wetopi.net"]
    SVCTRAEFIK["Traefik edge — public routing"]
    SVCCSI["Ceph CSI — StorageClass ceph-rbd"]
    SVCCERT["cert-manager — Let's Encrypt DNS-01"]
    SVODOCS["Docs site — docs.wetopi.net"]
  end
  PX -->|"VMs 8001-8042 host the nodes"| K8S
  BAST -->|"SSH + kubectl (kubeconfig from rke-cp01)"| K8S
  CEPH -->|"workers eth1 · ADR-0007"| SVCCSI
  GITOPS -->|"syncs kubernetes/ tree"| L3
  EDGE --- SVCTRAEFIK
  SVCTRAEFIK --- SVCARGO
  SVCTRAEFIK --- SVCVAULT
  SVCTRAEFIK --- SVODOCS
  SVCCERT -->|"argo-tls · docs-tls · vault-tls"| EDGE
  SVCCSI -->|"PVCs on ceph-rbd"| SVCVAULT

  click L1 "infrastructure section map" "infrastructure/index.html"
  click OVH "ARCH-INFRA-OVH" "infrastructure/ovh-and-network.html"
  click PX "ARCH-INFRA-PROXMOX" "infrastructure/proxmox-cluster.html"
  click IAC "ARCH-INFRA-PROVIDERS" "infrastructure/providers.html"
  click BAST "bastion ops01 (in ARCH-INFRA-OVH)" "infrastructure/ovh-and-network.html"
  click NAT "natgw (in ARCH-INFRA-OVH)" "infrastructure/ovh-and-network.html"
  click CEPH "ARCH-INFRA-CEPH" "infrastructure/ceph.html"
  click L2 "platform section map" "platform/index.html"
  click K8S "ARCH-PLATFORM-RKE2" "platform/rke2-cluster.html"
  click CILIUM "ARCH-PLATFORM-CILIUM" "platform/cilium-network.html"
  click EDGE "ARCH-PLATFORM-EDGE" "platform/edge.html"
  click GITOPS "ARCH-PLATFORM-GITOPS" "platform/gitops.html"
  click SVCARGO "SVC-ARGOCD" "../services/argocd.html"
  click SVCVAULT "SVC-VAULT" "../services/vault.html"
  click SVCTRAEFIK "SVC-TRAEFIK-EDGE" "../services/traefik-edge.html"
  click SVCCSI "SVC-CEPH-CSI" "../services/ceph-csi.html"
  click SVCCERT "SVC-CERT-MANAGER" "../services/cert-manager.html"
  click SVODOCS "SVC-DOCS-SITE" "../services/docs-site.html"

Node → pill map

Every node of the diagram resolves to the pill below. Relative links work from this page; the rendered site mirrors the same mapping.

Layer Node Pill What it covers
1 — infra OVH, bastion (ops01), natgw ARCH-INFRA-OVH Provider, vRack, WAN blocks, VLAN/bridge model, Cloudflare DNS.
1 — infra Proxmox cluster wetopi7 ARCH-INFRA-PROXMOX 8 nodes, template, datastores, VM inventory (8001–8042).
1 — infra IaC toolchain ARCH-INFRA-PROVIDERS OpenTofu/Cloudflare/Ansible split, where state lives, secret handling.
1 — infra Ceph LAN ARCH-INFRA-CEPH Pre-existing storage LAN, storage-native access (ADR-0007).
2 — platform RKE2 cluster wetopi3 ARCH-PLATFORM-RKE2 Topology, control plane, API VIP, node roles.
2 — platform Cilium ARCH-PLATFORM-CILIUM CNI, Hubble, edge-node datapath.
2 — platform WAN edge v1 ARCH-PLATFORM-EDGE Direct Traefik exposure, Gateway API, nftables posture.
2 — platform GitOps plane ARCH-PLATFORM-GITOPS Argo CD bootstrap, AppProject, app layout.
3 — services Argo CD SVC-ARGOCD GitOps control plane, argo.wetopi.net.
3 — services Vault / Infisical SVC-VAULT Secrets system, vault.wetopi.net UI, Universal Auth (private).
3 — services Traefik edge SVC-TRAEFIK-EDGE Public routing for docs/argo/vault hostnames.
3 — services Ceph CSI SVC-CEPH-CSI RBD storage, StorageClass ceph-rbd.
3 — services cert-manager SVC-CERT-MANAGER ACME/Let's Encrypt DNS-01, the edge certificates.
3 — services Docs site SVC-DOCS-SITE docs.wetopi.net, the site you are reading.

Section entry points: infrastructure section · platform section · services section · decisions · runbooks.

Verified state (2026-08-31, live via ops01)

Dated handover snapshot — re-read live before relying on it:

  • Layer 1: 8/8 Proxmox nodes operational; VMs 8001–8042 carrying the platform (VM table: ARCH-INFRA-PROXMOX).
  • Layer 2: 8/8 cluster nodes Ready (3 CP / 3 platform / 2 edge); Gateway wetopi-edge Accepted+Programmed with the web :8000 and https :8443 listeners.
  • Layer 3: five Argo Applications — root, cert-manager, docs-site, argo-edge (all Healthy/Synced) and vault (Synced; its Degraded health is the documented false positive of the fail-closed deny rules — pods 3/3 Running, see SVC-VAULT); 4 certificates Ready (argo-tls, docs-tls, vault-tls, edge-test-tls).

Taking over

This map is the shape. The procedure is taking-over-the-platform.md (PROC-PLATFORM-TAKEOVER): access by location, sources of truth, day-1 verification, frequent operations, escalation and the no-go rules.