xk3s Fleet Topology & Cluster Manual
Comprehensive reference architecture, static network coordinates, mutual SSH key authentication matrix, and containerized workload topologies for the personal edge Kubernetes cluster.
1. 🗺️ Master Fleet Coordinates
The personal infrastructure consists of 7 primary devices and cluster nodes connected across local LAN, WireGuard cloud overlay, and Tailscale zero-trust meshes:
| Device | Hostname | User | LAN IP | WireGuard | Tailscale | Ingress / Role |
|---|---|---|---|---|---|---|
| MacBook Air | das-MacBook-Air.local | da | 192.168.4.••• | — | 100.71.•••.•• | Primary Workstation (M1, 16GB) |
| MacBook Pro | Doxs-MacBook-Pro.local | dx | 192.168.4.••• | — | 100.102.•••.•• | Secondary Workstation (i9, 32GB) |
| x1 (Master) | x1 | x1 | 192.168.4.••• | 10.10.0.•• | 100.95.•••.•• | K3s Master, NVMe Storage, API (6443) |
| x2 (Worker) | x2 | x2 | 192.168.4.••• | 10.10.0.•• | 100.71.•••.•• | K3s Edge Worker, HDMI Kiosk, VNC (5900) |
| x (Worker) | x | x | 192.168.4.••• | 10.10.0.•• | 100.111.•••.•• | K3s AMD64 Compute Worker, Offload Node |
| AWS Hub (EC2) | ip-172-31-2-180 | ubuntu | — | 10.10.0.•• | — | Ingress Gateway (54.215.•••.••) |
| dphone | dphone | — | — | — | 100.64.•••.•• | Mobile iOS Zero-Trust Client |
2. 🔑 Remote Access & SSH Matrix
Passwordless ED25519 authentication is configured across all devices. Use these standard connection commands:
ssh mbp # Connect to MacBook Pro (Tailscale)
ssh mbp-lan # Connect to MacBook Pro (LAN: 192.168.4.•••)
open vnc://dx@100.102.•••.•• # Screen Share VNC session
# Edge Cluster Node Access
ssh x1@100.95.•••.•• # Cluster Master x1 (Tailscale)
ssh x2@100.71.•••.•• # Edge Worker x2 (Tailscale)
ssh x@100.111.•••.•• # Compute Worker x (Tailscale)
# AWS Cloud Gateway
ssh ec2-pub # AWS EC2 Ingress Gateway (54.215.•••.••)
3. ⚡ Dedicated K3s Kubernetes Cluster
The cluster runs lightweight Kubernetes (K3s) with dedicated control plane and edge worker nodes:
4. 🌐 Multi-Tier Mesh Overlay
The network utilizes a three-tier overlay model guaranteeing encrypted connectivity across all environments:
- Tier 1: Cloud-to-Edge Tunnel (WireGuard
10.10.0.0/24): Dedicated point-to-point encrypted link connecting AWS EC2 gateway to nodex1and nodex2. - Tier 2: Zero-Trust Remote Mesh (Tailscale
100.64.0.0/10): Direct peer-to-peer WireGuard mesh connecting MacBook Air, MacBook Pro, mobile clients, and edge nodes without open inbound firewall ports. - Tier 3: Local Area Network (LAN
192.168.4.0/24): Ultra low-latency physical link between on-premise hardware workstations and edge micro-servers.
5. 🖥️ Hardware & Operating System Specifications
| Node | Operating System | Arch | Processor | RAM | Storage |
|---|---|---|---|---|---|
| MacBook Air | macOS 26.5.2 (Darwin 25) | arm64 | Apple M1 (8 cores) | 16 GB Unified | 500 GB NVMe APFS |
| MacBook Pro | macOS 26.7 (Darwin 25) | x86_64 | Intel Core i9-9880H (8C/16T) | 32 GB DDR4 | 1.1 TB NVMe APFS |
| x1 (Master) | Debian 13 (Trixie) | aarch64 | Broadcom BCM2712 (4 cores) | 16 GB LPDDR4X | 500 GB NVMe PCIe Gen3 |
| x2 (Worker) | Debian 12 (Bookworm) | aarch64 | Broadcom BCM2712 (4 cores) | 8 GB LPDDR4 | 64 GB MicroSD |
| x (Worker) | Ubuntu 24.04.5 LTS | x86_64 | AMD64 (2 cores) | 8 GB RAM | 64 GB SSD |
| AWS Hub | Ubuntu 24.04 LTS | x86_64 | AWS Nitro vCPU | 1 GB Burst | 30 GB gp3 EBS |
6. 🌐 Active Edge Endpoints Directory
All services are routed securely through the AWS Ingress gateway with SSL termination: