Field notes from
the sovereign stack
Page 11

Replacing the Tailscale coordination plane with self-hosted Headscale or NetBird: Kubernetes subnet routers, owned exit nodes, failure modes and the exit ramp.

Choosing a self-hosted block storage layer for Kubernetes CSI: Rook/Ceph RBD vs Longhorn vs OpenEBS Mayastor, with hardware numbers and the exit ramp.

Operate K3s edge clusters over intermittent WAN with pull-based Rancher Fleet GitOps, air-gapped image delivery, per-site overlays, and offline reconciliation.

Choosing and operating a self-hosted vector database for on-premises RAG: Qdrant vs pgvector vs Weaviate, HNSW tuning, quantization, and the exit ramp.

Structure LitmusChaos and Chaos Mesh fault injection as signed, ID-tagged artifacts that satisfy scenario-based operational resilience testing mandates.

KEDA event-driven autoscaling on Kubernetes scales pods to zero on queue depth; the descheduler bin-packs survivors to reclaim bare-metal nodes — no Karpenter.

Run a Kubernetes bare-metal load balancer without a cloud provider — MetalLB BGP, kube-vip control-plane VIP, and Envoy Gateway API, exiting Cloudflare's proxy.

Namespace-level Kubernetes cost allocation with OpenCost: run showback and graduate to chargeback on bare-metal clusters where no cloud billing API exists.

Run a self-hosted certificate authority for internal Kubernetes names: step-ca as a private ACME server, cert-manager as the client, no CT-log leakage.