mjbl-k8s-platform

Imported from 14f3v/claude-skills (skills/mjbl-k8s-platform/SKILL.md). Install upstream with npx skills add 14f3v/claude-skills --skill mjbl-k8s-platform. Copyright stays with the author.

MJBL Kubernetes Estate — Cluster Map & Access Index

Orientation / source-of-truth front door. This host (/home/mjbl, 192.168.1.25 — the MJBL ops / remote runner, NOT a cluster node) holds the kubeconfigs and runbooks. This skill is the distilled live map; for hands-on work in one cluster, hand off to the focused sibling skill. VERIFY a figure against the live cluster (or the referenced doc) before acting — never invent IPs/paths/contexts.

Related knowledge bases: mjbl-mtls-platform (what the mTLS platform runs on prod), k8s-bare-metal (how a bare-metal cluster is provisioned), and memory notes reference_facility_cluster.md / reference_argocd_access.md.

When to use

• "What clusters are there / give me the topology."
• "Which kubeconfig / context do I use for prod (or facility / UAT / DR)?"
• "Where does ArgoCD live and which clusters does it manage?"
• "Which cluster runs ?" or "Where should I deploy ?"
• Sanity-checking a cluster IP / context / ArgoCD destination before acting.
• Onboarding before diving into one cluster (then hand off to the sibling skill).

The estate — four clusters, one ArgoCD

Networks: prod = 10.88.101.x (DMZ/MetalLB) + 10.88.1.x (internal). Facility = 10.88.101.x (same DMZ range as prod — not 192.168.1.x). UAT/ops = 192.168.1.x. DR = 10.99.1.x.

⚠️ The segmentation is narrower than "192.168.1.x can't reach 10.88.x" (verified 2026-09-21):

• 10.88.101.x (DMZ) IS reachable from both the ops box 192.168.1.25 and the Mac — so facility and the prod DMZ nodes are directly usable from the office LAN.
• 10.88.1.x (prod internal) is not reachable from the ops box; test those from a prod-network host (see access below). The Mac reaches some 10.88.1.x via VPN.

ArgoCD topology (the one thing people get wrong)

ArgoCD runs on the facility cluster and manages prod and UAT as registered external clusters — so an Application's destination.server is the target cluster's API URL, NOT https://kubernetes.default.svc (that would target facility itself):

• prod apps → https://rkek8s.vte.mjblao.local:6443
• UAT apps → https://192.168.1.65:6443
• DR is outside the facility ArgoCD — it runs its OWN local Rancher CD (Fleet) on the DR cluster, watching the k8s-config dr/ overlays.

Details + how to register/sync apps live in mjbl-k8s-facility.

Access cheat-sheet

# ⚠️ Bare `kubectl` hits PRODUCTION (corrected 2026-08-31). ALWAYS confirm first:
kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}'; echo
#   https://rkek8s.vte.mjblao.local:6443  = PROD
#   https://192.168.1.65:6443             = UAT

# UAT
KUBECONFIG=~/.kube/mjbl-uat.config kubectl get nodes

# PROD (rkek8s)
KUBECONFIG=~/.kube/mjbl-prod.config kubectl -n <ns> get all

# FACILITY (ArgoCD lives here) — TLS SNI fix is mandatory
KUBECONFIG=~/.kube/mjbl-facility.config kubectl --tls-server-name=registry.k8sapi.local -n argocd get applications.argoproj.io

# DR — runs from the Mac (this ops box has no dr-config; DR net is firewalled from the DC net)
ssh khemphet-mac    # → KUBECONFIG=~/.kube/dr-config kubectl get nodes   (must show node dr-k8s-n1)

# Reach a PROD-NETWORK host from the office LAN (prod IPs aren't routable from 192.168.1.25):
ssh khemphet-mac          # → your Mac jump
  ssh k8s-cp-01           # → prod cp node mjbl-k8s-n01 (10.88.101.32), READ-ONLY

"Which cluster?" decision

• Real production traffic / the mTLS platform / MetalLB L4 IPs → prod (mjbl-k8s-production).
• ArgoCD Application objects, sync/registering apps, the ArgoCD UI → facility (mjbl-k8s-facility).
• Anything proxying to 192.168.1.61/.65/.66 or a UAT/pentest target → UAT (~/.kube/mjbl-uat.config).
• Disaster-recovery standby, *.dr.vte.mjblao.local, the DR-local Rancher CD (Fleet) flow → DR (mjbl-k8s-dr).

Related skills & docs

• mjbl-k8s-production · mjbl-k8s-facility · mjbl-k8s-dr — the per-cluster operational skills.
• mjbl-mtls-platform — the mTLS device-auth platform that runs on prod.
• k8s-bare-metal — provisioning a new bare-metal cluster from scratch.
• DR plan: k8s-config/tools/dr/ (scripts) + DR-MIGRATION-PLAN.md. Memory: reference_facility_cluster.md, reference_argocd_access.md.

Prod gates: k8s-config merges are user-gated; ArgoCD prod writes (app create / sync) are user-authorized (reads OK); CA-host changes via ! ssh ca. This skill is orientation — route to the sibling skill for the actual operation.