10.53 - Next Steps
After week 1 you can run stateless + stateful apps, wire config, and debug. Here is the map from “I can use kubectl” to “I run my homelab on k8s”.
Week 2+ skill ladder (in order)
- Helm - package manifests with values/templates. Every real app ships a
Helm chart; reading one teaches you more k8s than another tutorial.
nix shell nixpkgs#kubernetes-helm -c helm repo add bitnami https://charts.bitnami.com/bitnami helm install mydb bitnami/postgresql helm list; helm uninstall mydb - Kustomize - patch overlays per environment (dev/staging/prod) without
templating. Built into kubectl:
kubectl apply -k overlays/prod. - Operators / CRDs - custom controllers (e.g. cert-manager, prometheus operator, sealed-secrets). Understand that an Operator is “a controller watching a CRD”, which you already understand in miniature from week 1.
- GitOps - ArgoCD (or Flux): cluster desired state lives in git, a controller applies it and reverts drift. This is the endpoint of the declarative philosophy from day 1.
- RBAC - ServiceAccounts, Roles, RoleBindings; why workloads should not run as the default SA. The next security milestone.
- Multi-node - add agent nodes (10.52), or k3d multi-node for practice, then retry storage + DaemonSets + taints/tolerations with real nodes.
Homelab port (your existing services -> k8s)
You already run Docker services the k8s way (compose = declarative desired state). Natural migrations when you want to practice for real:
| Existing | k8s equivalent | Notes |
|---|---|---|
| PaperMC container | Deployment + PVC + Service(NodePort 25565) | stateful-ish; give it a PVC, spec.ports[0].nodePort: 25565 so players’ addresses don’t change (challenge: why is nodePort fixed useful here?) |
| Grafana | Deployment + PVC + Ingress | probes, config via ConfigMap, version pinning |
| Caddy | Ingress (Traefik) | or keep Caddy as the edge and proxy *.lab.150825.xyz -> traefik |
| qBittorrent / Seanime | Deployment + PVC | host-network caveats vanish; they just bind 0.0.0.0 in-pod |
| Prometheus | kube-prometheus-stack (Helm) | metrics-server is a warmup; this is the real thing |
Caddy edge sketch once Traefik is on alternate ports:
lab.example {
reverse_proxy 127.0.0.1:8081 # Traefik
}
Then Traefik does host/path routing inside the cluster, Caddy does TLS for your domain. That is a very common production shape (external LB + internal ingress).
Real-world k8s you will now recognize
- EKS/GKE/AKS: same API server, same objects. Differences: managed control plane, cloud load balancers/volumes, IAM for RBAC, node groups.
- Everything you learned about Deployments/Services/PVCs/Ingress/HPA is byte-for-byte the same on a cloud cluster.
- The mental model (desired state, controllers, labels) is the same even in non-k8s systems: Terraform, Kubernetes operators, ArgoCD, even your NixOS+home-manager flake are all declarative reconciliation loops. You have been doing this already; k8s just industrializes it.
Further reading (stop when bored)
- Kubernetes in Action, 2nd ed (Lukša) - the book this plan follows.
- kubernetes.io/docs/concepts - the reference you will actually keep using.
- k3s docs (docs.k3s.io) - HA, agents, upgrades, service load balancer.
- “Kubernetes the Hard Way” (Kelsey Hightower) - for later: builds a cluster by hand, which is the best way to truly understand the control plane. Revisit after week 2, not now.
- CNCF landscape (landscape.cncf.io) - the zoo, for browsing.
A honest note on effort vs value
Week 1 gets you to “productive single-node cluster”. The step that makes it career-grade is week 2: Helm + GitOps + RBAC + operators. The step that makes it homelab-grade is the port of your PaperMC/Grafana stack, because you will then have a real, boring, valuable workload to keep alive, which is the only thing that forces you to learn upgrades, backups, and self-healing. Do that port when you feel like week 1 is easy, not before.
Good luck. The cluster is yours; break it early and often.