# Kubernetes cluster

The cluster is three nodes with a control plane on `k8s-master-1` and two
workers. It runs the shelf services that want scheduling rather than a
static container.

- The ingress controller listens on 8443 and forwards to cluster services.
- etcd snapshots run nightly to the backup host and are kept for a month.
- Worker nodes join with a short-lived token minted for one hour.
- Storage is a local-path provisioner pinned to the nvme mount.
- Pod security labels are set per namespace, not cluster wide.

Upgrades are one control plane replica at a time, then the workers with a
cordon and drain. The ingress is the last thing to move because the
services behind it are checked by the shelf watchdog.