This project automates independent development and production Talos Kubernetes environments on Proxmox using OpenTofu and GitHub Actions, with optional stateless AWS workers connected through KubeSpan. Each cluster runs its own Argo CD for GitOps application management, while Doppler and External Secrets supply credentials and persistent workloads stay on Proxmox.
This is Part 4 of the Hashicorp Vault series. In Part 1, we bootstrapped Vault. In Part 2, we built our CI/CD pipeline. In Part 3, we finally killed the static kubeconfig.
This is Part 3 of the Hashicorp Vault series. In Part 1, we bootstrapped Vault. In Part 2, we built the full CI/CD pipeline. Now, we’re solving the final, massive headache: getting secure, dynamic kubectl access.
This is Part 2 of the Hashicorp Vault series. Part 1 covered bootstrapping and configuring HashiCorp Vault (the one-time terraform-admin work) and the design goals for Zero Trust secrets management.
In the last two parts of the On-Premise 101 series, I showed you how to provision and bootstrap a full Kubernetes cluster. Now, I’m tearing part of it down and rebuilding the entire workflow. Why? The project’s goal was always automation, but I hit a wall. The manual steps to set up that automation - like managing secrets and SSH keys - became a huge liability.
