菜单
Reference for cluster infrastructure components, Talos configuration, network topology, and auto-managed files. Use when querying component roles, versions, IPs, or understanding what files must not be manually edited.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Audit CloudNativePG (CNPG) clusters for backup health, S3 storage bloat, and disk-space risk — schedule misconfiguration, WAL/archive_timeout churn, orphaned backups, compression, and PVC resize status. Use when investigating CNPG backup storage growth, a "storage near empty" alert on the backup target (e.g. QNAP), a crash-looping/"Not enough disk space" CNPG cluster, or doing a periodic CNPG health check.
Push an updated Coder workspace Terraform template and redeploy running workspaces onto it. Use when workspace-template/main.tf changes (resources, volumes, etc.) need to reach live Coder workspaces.
Diagnose and fix ONLYOFFICE Document Server showing "An error has occurred while opening the file" with no failed requests visible in the browser. Root cause is usually an orphaned task_result row in the docserver's Postgres DB, left over from a conversion interrupted by a pod crash/OOM/restart.
Task commands, bootstrap sequence, CI/CD, branch/PR workflow, linting, and devcontainer setup for the home-ops repository.
Use when auditing disk health, filesystem usage, or I/O on cluster nodes — especially when filesystem queries return incomplete results or a node's second drive is missing from metrics.
Use when removing, replacing, or decommissioning a Talos node — covers the correct talosctl reset workflow
| name | cluster-reference |
| description | Reference for cluster infrastructure components, Talos configuration, network topology, and auto-managed files. Use when querying component roles, versions, IPs, or understanding what files must not be manually edited. |
| when_to_use | Trigger phrases: "talos", "upgrade", "which version", "infrastructure", "what does X do", "network", "IP pool", "LB IP", "egctl", "renovate", "extensions", "do not edit", "clusterconfig", "component", "shutdown node", "power off node", "bring node back", "node maintenance". |
| Component | Purpose |
|---|---|
| Cilium | CNI, kube-proxy replacement, L2 announcements for LoadBalancer IPs |
| Envoy Gateway | Kubernetes Gateway API — envoy-external (.20, internet via Cloudflare Tunnel) and envoy-internal (.21, home network only) |
| Cloudflared | Cloudflare Tunnel client |
| external-dns (cloudflare) | Publishes controller: external DNSEndpoints and dns-controller HTTPRoutes on envoy-external |
| external-dns (adguard) | Publishes controller: internal DNSEndpoints and dns-controller HTTPRoutes on envoy-internal |
| cert-manager | TLS via Cloudflare DNS01; wildcard cert-production used by both gateways |
| Rook-Ceph | Primary persistent storage |
| NFS subdir provisioner | Cold storage on QNAP NAS |
| Keycloak | OIDC identity provider |
| External Secrets Operator | K8s secret sync from Bitwarden |
| kube-prometheus-stack | Prometheus + Grafana |
| CloudNative-PG | PostgreSQL operator |
| VolSync | PVC backup/restore |
For egctl debugging commands, see @docs/src/k8s/egctl.md.
talosctl + envsubst from provision/talos/templates/ and provision/talos/nodes/provision/talos/nodes.yaml; generate: task talos:generatesiderolabs/i915, siderolabs/intel-ucode, siderolabs/nut-clienttalos-config-editing skill — it has the edit decision map, patch semantics, and how to add new config documents.Node subnet: 192.168.48.0/22 · Pod network: 10.244.0.0/16 · Service network: 10.96.0.0/12
LB IP pool: 192.168.48.20–50 (annotate new services with lbipam.cilium.io/ips: "192.168.48.XX")
Full IP allocation and gateway architecture: @docs/src/general/network.md.
To cleanly shut down a node (e.g. mc3 at 192.168.48.4):
# 1. Cordon — prevent new pods scheduling
kubectl cordon <node-name>
# 2. Drain — evict running pods
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data
# 3. Pause Ceph rebalancing (prevents unnecessary data movement during downtime)
kubectl -n rook-ceph exec -it deploy/rook-ceph-tools -- ceph osd set noout
# 4. Verify Ceph is healthy before proceeding
kubectl -n rook-ceph exec -it deploy/rook-ceph-tools -- ceph status
# 5. Shut down via talosctl
TALOSCONFIG=/workspaces/home-ops/provision/talos/clusterconfig/talosconfig \
talosctl shutdown --nodes <node-ip>
Node IPs: mc1=192.168.48.2, mc2=192.168.48.3, mc3=192.168.48.4
# 1. Power on the machine physically (or WoL)
# 2. Wait for node to become Ready
kubectl get node <node-name> -w
# 3. Uncordon FIRST — Rook OSD pods need to schedule before Ceph can see the OSD back
kubectl uncordon <node-name>
# 4. Wait for OSD pod to start and Ceph to register it
kubectl -n rook-ceph exec -it deploy/rook-ceph-tools -- ceph status
# 5. Once OSDs are back up, unset noout
kubectl -n rook-ceph exec -it deploy/rook-ceph-tools -- ceph osd unset noout
# 6. Verify HEALTH_OK
kubectl -n rook-ceph exec -it deploy/rook-ceph-tools -- ceph status
Order matters: uncordon before unsetting
noout— the OSD pod must be running on the node before Ceph can mark itup.
| File/Directory | Managed By | How to Update |
|---|---|---|
provision/talos/clusterconfig/ | talosctl + envsubst | task talos:generate |
Lines prefixed # renovate: datasource=... | Renovate bot | Do not manually bump |
.terraform.lock.hcl | Terraform | task terraform:init:cloudflare |