PVE is now the 2-node cluster homelab (pv1-1 + pv1-2), no shared storage:
- template 101 copied to pv1-2 as 9101; MDs lab1-workers-pv1-1 (max 6) and
lab1-workers-pv1-2 (max 12), PMTs pinned with allowedNodes; pool .31-.50;
lab1-workers renamed for symmetry (decision #18, #7 superseded)
- CA: balancing-label node.cluster.x-k8s.io/pool (+ pool label, capacity labels
with os/arch, maxPods on the MDs), scan-interval 1m, v 2, default QPS (#19).
Scale test: 16 pods -> 4 + 4 across both nodes.
- runbook, image-builder copy procedure, fixes tables, future task to report
three CA clusterapi bugs upstream, lab facts, changelog, execution log
Plan: docs/plans/2026-09-29-2315-pv1-2-workers.md
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Re-check of lab1 after Steps 4-5 (inspector on lab-mgmt, read-only gets
on lab1):
- Cluster/KCP/MD Available for 13h; no controller errors since bootstrap.
- All six autoscaler annotations on lab1-workers (copied to the
MachineSet). spec.replicas has no owner: kubectl-client-side-apply owns
only clusterName/selector/template, so re-applying lab1.yaml won't
fight cluster-autoscaler.
- Nodes Ready on v1.35.9; Node/Machine providerIDs match.
- Cilium, envoy and CoreDNS healthy. No PDBs in the cluster.
Found: cilium-operator (replicas: 1) was scheduled onto the only worker.
It is a non-DaemonSet kube-system pod without a PDB, so with CA's default
skip-nodes-with-system-pods=true the last worker could never scale to
zero (Step 7). The chart already tolerates the control-plane taint, so a
nodeSelector on node-role.kubernetes.io/control-plane pins it there.
- configs/cilium/values.yaml: operator.nodeSelector.
- phase-1 doc: Step 5 ticked, Step 4 explains why replicas: 1 isn't
enough, new troubleshooting row.
- Session note extended with the re-check.
Not applied yet: the owner runs helm upgrade with the new values.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- runbook + inspector agent: ipaddresses.ipam.cluster.x-k8s.io (plain
`ipaddresses` is the built-in networking.k8s.io type on k8s 1.35)
- inspector RBAC: get/list CRDs so clusterctl describe works read-only
- phase-1 Step 3 ticked; session note with the first lab1 review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kacerrandClaude Opus 5.5