ricsanfre/pi-cluster v1.12.0

on GitHub

[v1.12.0] - 2026-07-06

Major update of the cluster platform: Ansible Runner refactoring, secrets migration to HashiCorp Vault, Ubuntu 24.04 upgrade, ingress migration from NGINX to Envoy Gateway, control plane load balancing with Kube-VIP, MinIO replacement with RustFS, Valkey shared database service, Grafana Operator, OpenTelemetry refactoring, and infrastructure-as-code expansion with OpenTofu Controller and Terraform-based external services configuration.

Release Scope

• Ansible Runner Refactoring
  • Dual execution environment: Docker-based and local UV-based
  • Migrate Python dependency management from pip to uv (10–100× faster, reproducible lockfile)
  • Wrapper script for consistent command interface across environments
  • Multi-stage Docker build with tool versioning from official images
  • Removal of Ansible Vault and GPG key management from the runner
• Migrate Ansible Credentials to HashiCorp Vault
  • Replace file-based Ansible Vault encryption with on-demand HashiCorp Vault lookups
  • Standardize secret naming conventions across Ansible, Kubernetes, and Terraform
  • Integrate Terraform (OpenTofu) for Vault and MinIO configuration
• Ubuntu 24.04 Upgrade
  • Upgrade all cluster nodes from Ubuntu 22.04 to 24.04 (Noble Numbat)
  • Update cloud-init, PXE boot, and K3s configurations for Noble compatibility
• HAProxy to Kube-VIP Migration
  • Replace HAProxy load balancer with Kube-VIP for K3s API server VIP
  • Deploy via FluxCD HelmRelease with K3s installation integration
  • Prometheus monitoring and Grafana dashboard for Kube-VIP
• Replace NGINX Ingress Controller with Envoy Gateway
  • Migrate from retired NGINX Ingress to Envoy Gateway (Kubernetes Gateway API)
  • Decommission OAuth2 Proxy and NGINX-specific monitoring
  • Reconfigure all applications (Bookinfo, Kafka, OTEL demo) for Gateway API
• OpenTofu Controller
  • Deploy FluxCD Tofu Controller for GitOps-driven infrastructure-as-code
  • Cross-namespace references for Terraform CRDs
• Terraform to Configure External Services
  • Elastic Stack: users, roles, ILM policies, index templates via Terraform
  • Keycloak: realm configuration via Terraform, replacing keycloak-config-cli
  • Data-driven pattern with structured resource definition files
• Common Redis-Valkey Database Service
  • Deploy Valkey Operator for shared Redis-compatible datastore
  • Consolidate database operators in shared databases namespace
  • Prometheus monitoring and anti-affinity scheduling rules
• MinIO Replacement with RustFS
  • Migrate from MinIO to RustFS S3-compatible object storage
  • Maintain Terraform provider compatibility (aminueza/minio)
  • Update Vault secrets, service backends, and documentation
• MongoDB Monitoring
  • Enable Prometheus monitoring for MongoDB via Percona PMM agent
  • Adapted Grafana dashboard from MongoDB Ops Manager
  • Istio PeerAuthentication for metrics scraping compatibility
• Kafka Security
  • Enable TLS encryption, SASL/SCRAM authentication, and ACL authorization
  • Manage credentials via Vault + External Secrets Operator
  • Reconfigure external listener for Envoy Gateway TLS passthrough
• Grafana Operator
  • Migrate from Helm-based Grafana to Grafana Operator
  • Kubernetes CRDs for Dashboards, Datasources, and Folders
  • GitOps-native observability configuration
• Observability Solution (OpenTelemetry) Refactoring
  • Deploy dedicated OTEL Collector for unified signal processing
  • Metrics → Prometheus, Logs → Elasticsearch, Traces → Tempo
  • Trace-to-log correlation, span metrics, service-level observability
• New Observability/Service Mesh Demo Application
  • Custom SpringBoot + React e-commerce app (7 microservices) replacing official OpenTelemetry Demo
  • Illustrates distributed architecture: databases (PostgreSQL, MongoDB, Valkey), Kafka messaging, Keycloak OAuth2/OIDC, Istio ambient mesh, OpenTelemetry observability
  • Upgrade and reconfigure Tempo (metrics-generator, HTTP streaming, resource limits)
• Additional Improvements
  • Helm Repository Refactoring
  • OpenWRT TLS Automation
  • Istio Ambient Mesh enhancement
  • New documentation for Envoy Gateway, Grafana Operator, OTEL Collector, and RustFS