This is the window where the homelab stops being a set of machines and becomes something with a pipeline.
The k3s migration is the spine. It arrives as code in one scaffold — VM
IaC, Ansible roles, Helm charts (8e1892f) — and then gets a pipeline that
covers the whole lifecycle: provision, bootstrap, deploy (7c128e2). Standing up
the cluster becomes a workflow run. That distinction matters more than the
cluster itself; a cluster you can rebuild from a commit is a different asset
from one you can only repair.
Secrets move to OpenBao across the same days. CI secrets come out of the
forge (6a3d71c) and services start reading theirs from the vault at runtime
(4d7b32c), with the Grafana secrets getting their own k8s-secrets module
(30b9787). Epic-Secret-Vault goes code-complete on 06-21 and done on 06-26,
with the AIService integration story closing inside it. Doing this before the
migration rather than after is the reason the migration could be automated at
all — anything else would have needed secrets copied by hand into the new
cluster.
The ADP edge cuts over to k3s on 07-01 (#25): Caddy routing the UI, its API
and websocket paths, the MCP server and AIService onto the cluster. It is
accompanied by an unglamorous discovery — the k3s VMs have non-AVX CPUs, so the
document database has to be pinned to mongo:4.4 with a TCP socket probe
(#24). Hardware assumptions surfacing at deploy time, as they always do.
A run of observability fixes follows, and it is worth being blunt about what
they were: the collector’s logs were not reaching Grafana at all (#30), the
exporter’s mapping mode was set to a value this search engine version rejects
until it is set to none (#44, #45), and readiness flapped on a single-node
cluster because it expects quorum health (#42). An observability stack that
cannot see its own failures actively misleads.
Two Power Management stories move in-progress → backlog on 06-29 — WoL and
idle power. Deferring them is recorded, not hidden.
shared-workflows takes four minor releases across the window (v1.7.0 through
v1.10.0) as the library absorbs the runner and pipeline automation it now has to
support.
Lessons learned
- Move secrets out of the forge before the migration, not after. Anything else turns an automated cluster bring-up into a manual secret-copying session, and the automation stops being trustworthy.
- Pin images to what the hardware actually supports before you discover it in production. The non-AVX CPU was a deploy-time surprise that cost a PR, a probe change and a day.
- An observability stack that cannot see its own failures is worse than none. A dashboard showing nothing because the collector is quietly broken reads exactly like a healthy quiet system.