01-proxmox-infra/index.ts

@@ -303,7 +303,7 @@ k3sVms.forEach((vmResource, i) => {
     (nic) => nic[0].macAddress,
   );
 
-  return new pfsense.Dhcpv4Staticmapping(
+  new pfsense.Dhcpv4Staticmapping(
     `${nodeConfigs[i].name}-dhcp`,
     {
       interface: "lan",
@@ -315,8 +315,6 @@ k3sVms.forEach((vmResource, i) => {
   );
 });
 
-// Individual vmId exports — used by k8s-bootstrap to start VMs.
-// Order matches nodeConfigs: master-1, master-2, worker-1, master-3, worker-2.
 export const vmIds = {
   master1: k3sVms[0].vmId,
   master2: k3sVms[1].vmId,
@@ -328,8 +326,6 @@ export const vmIds = {
 // CI runner SSH private key — consumed by k8s-bootstrap via StackReference.
 export const ciRunnerPrivateKey = pulumi.secret(ciRunnerKey.privateKeyOpenssh);
 
-// Proxmox API credentials — consumed by k8s-bootstrap via StackReference.
 export { pve1Endpoint, pve1ApiToken, pve2Endpoint, pve2ApiToken };
 
-//k3s instance ips consumed by k8s-bootstrap.
 export { master1Ip, master2Ip, worker1Ip, master3Ip, worker2Ip };

03-k8s-infra/CLAUDE.md

@@ -26,7 +26,7 @@ CI installs the `helm` CLI (`azure/setup-helm`) before running Pulumi.
 | kube-vip-cloud-provider | Allocates LoadBalancer IPs from a single-address pool (`kubeVipAddress`) — k3s's built-in ServiceLB is not used |
 | `traefik` ServicePatch | Pins Traefik's LoadBalancer IP to `kubeVipAddress` |
 
-**Export**: `storageClass = "truenas-nfs"`.
+**Export**: `nfsStorageClass = "truenas-nfs"`.
 
 ## Required Pulumi config
 

03-k8s-infra/index.ts

@@ -8,10 +8,14 @@ const bootstrapRef = new pulumi.StackReference(
 );
 
 const kubeconfig = bootstrapRef.requireOutput("kubeconfig");
+
+export const nfsStorageClass = "truenas-nfs";
 const truenasHost = config.requireSecret("truenasHost");
 const truenasNfsPath = config.requireSecret("truenasNfsPath");
+
 const cloudflareToken = config.requireSecret("cloudflareApiToken");
 const letsencryptEmail = config.requireSecret("letsencryptEmail");
+
 const kubeVipAddress = config.requireSecret("kubeVipAddress");
 const kubeVipInterface = config.require("kubeVipInterface");
 
@@ -41,9 +45,9 @@ const nfsCsiDriver = new k8s.helm.v3.Release(
 );
 
 new k8s.storage.v1.StorageClass(
-  "truenas-nfs",
+  nfsStorageClass,
   {
-    metadata: { name: "truenas-nfs" },
+    metadata: { name: nfsStorageClass },
     provisioner: "nfs.csi.k8s.io",
     parameters: {
       server: truenasHost,
@@ -321,6 +325,11 @@ const cloudProviderClusterRoleBinding = new k8s.rbac.v1.ClusterRoleBinding(
   opts(),
 );
 
+const kubeVipCloudProviderLabels = {
+  app: "kube-vip",
+  component: "kube-vip-cloud-provider",
+};
+
 // IP pool the cloud-provider allocates from — scoped to exactly the one VIP we
 // want, so it can never hand the address to some other LoadBalancer Service.
 const kubeVipPool = new k8s.core.v1.ConfigMap(
@@ -339,11 +348,11 @@ const kubeVipCloudProvider = new k8s.apps.v1.Deployment(
     spec: {
       replicas: 1,
       selector: {
-        matchLabels: { app: "kube-vip", component: "kube-vip-cloud-provider" },
+        matchLabels: kubeVipCloudProviderLabels,
       },
       template: {
         metadata: {
-          labels: { app: "kube-vip", component: "kube-vip-cloud-provider" },
+          labels: kubeVipCloudProviderLabels,
         },
         spec: {
           serviceAccountName: cloudProviderServiceAccount.metadata.name,
@@ -379,4 +388,3 @@ new k8s.core.v1.ServicePatch(
   opts({ dependsOn: [kubeVip, kubeVipCloudProvider] }),
 );
 
-export const storageClass = "truenas-nfs";

04-k8s-apps/index.ts

@@ -16,7 +16,7 @@ const opts = (extras?: pulumi.ResourceOptions): pulumi.ResourceOptions => ({
   ...extras,
 });
 
-const ns = new k8s.core.v1.Namespace(
+const heimdallNs = new k8s.core.v1.Namespace(
   "heimdall",
   { metadata: { name: "heimdall" } },
   opts(),
@@ -25,7 +25,7 @@ const ns = new k8s.core.v1.Namespace(
 const pvc = new k8s.core.v1.PersistentVolumeClaim(
   "heimdall-config",
   {
-    metadata: { name: "heimdall-config", namespace: ns.metadata.name },
+    metadata: { name: "heimdall-config", namespace: heimdallNs.metadata.name },
     spec: {
       accessModes: ["ReadWriteOnce"],
       storageClassName: "longhorn",
@@ -42,7 +42,7 @@ new k8s.apps.v1.Deployment(
   {
     metadata: {
       name: "heimdall",
-      namespace: ns.metadata.name,
+      namespace: heimdallNs.metadata.name,
       annotations: { "pulumi.com/patchForce": "true" },
     },
     spec: {
@@ -80,7 +80,7 @@ new k8s.apps.v1.Deployment(
 const svc = new k8s.core.v1.Service(
   "heimdall",
   {
-    metadata: { name: "heimdall", namespace: ns.metadata.name },
+    metadata: { name: "heimdall", namespace: heimdallNs.metadata.name },
     spec: {
       selector: labels,
       ports: [{ port: 80, targetPort: 80 }],
@@ -97,7 +97,7 @@ new k8s.networking.v1.Ingress(
   {
     metadata: {
       name: "heimdall",
-      namespace: ns.metadata.name,
+      namespace: heimdallNs.metadata.name,
       annotations: {
         "cert-manager.io/cluster-issuer": "letsencrypt-prod",
       },

05-monitoring/index.ts

@@ -16,7 +16,7 @@ const grafanaAdminPassword = config.requireSecret("grafanaAdminPassword");
 
 const k8sProvider = new k8s.Provider("k3s", { kubeconfig });
 
-const ns = new k8s.core.v1.Namespace(
+const monitoringNs = new k8s.core.v1.Namespace(
   "monitoring",
   { metadata: { name: "monitoring" } },
   { provider: k8sProvider, import: "monitoring" },
@@ -30,7 +30,7 @@ new k8s.helm.v3.Release(
     name: "kube-prometheus-stack",
     chart: "kube-prometheus-stack",
     version: "86.2.0",
-    namespace: ns.metadata.name,
+    namespace: monitoringNs.metadata.name,
     repositoryOpts: {
       repo: "https://prometheus-community.github.io/helm-charts",
     },