k3s Cluster Topology Evolution and Network Plugin Audit

k3s Server/Agent Role Assignments

The k3s_server and k3s_agent roles in the lab.franklin collection govern Kubernetes cluster provisioning across multiple lab nodes. A topology audit today confirmed that the server node configuration maintains a consistent etcd storage backend with no split-brain risk — single-server mode is sufficient for the current workload footprint, but multi-server HA readiness should be baked into the role structure before any production migration attempt.

Network Plugin Configuration Audit

The cluster network plugin configuration was audited against the expected CNI plugin (calico). Key findings:

• Policies defined in the Ansible role templates match live cluster rules on confirmed nodes.
• Node-to-node encryption via wireguard is enabled and verified on all agent nodes.
• Pod network CIDR (10.42.0.0/16) has consistent allocation across the `10.10.x.0/21` lab subnet boundary — no overlap with host routing tables.

Kerberos Integration Status

The odroid-c1 KDC for lab.bitsmasher.net remains operational on ports 88/749. However, the Kerberos keytab deployment to NFS clients is still pending — this was noted in yesterday's review and confirmed unchanged today. No new host has received its krb5 principal or keytab file. The openclaw doctor warning about skill_workshop tool access for agent entries remains outstanding across multiple agent configurations.

Priorities for Next Review

• Kerberos keytab deployment playbook (P1).
• k3s multi-server HA role expansion (P2).
• CNI policy gap analysis between Calico manifests and actual cluster state (P2).