Operations
Runbooks for day-2 work. The pages here are the procedures that aren't part of any one app or controller — secrets, database lifecycle, recovery from snapshots.
| Page | What it covers |
|---|---|
| SOPS | How encrypted secrets get into Git, and how Flux decrypts them in-cluster. |
| PostgreSQL backup & restore | Ad-hoc pg_dump / psql against a CNPG cluster, and the full restore of a database from a k8up Restic snapshot. |
| Volume restore | Restoring a PVC from a k8up Restic snapshot, the MongoDB and SILO variants, a scratch-volume drill, and Longhorn snapshot revert. |
| Upgrades | Who proposes and who rolls out an upgrade per layer, the pre-flight checks, and the procedures for Talos, Kubernetes, Flux, PostgreSQL and the Proxmox hosts. |
| Node replacement | Draining, rebooting and replacing Talos nodes without losing Longhorn replicas; the control-plane and edge variants. |
| Incident checklist | Locating a fault layer by layer, the first action for every alert, break-glass access, and an index of the per-subsystem failure tables. |
For the what and why of the systems these runbooks operate, see:
- Foundation → Flux — the GitOps reconciler
- Platform → CNPG — the Postgres operator
- Platform → k8up — the Restic-backed snapshot driver
- Platform → External Secrets — pulling external creds in as
Secrets