Follow the flow from declared configuration to a public-safe view of the homelab. Select a layer to see what crosses its boundary.
Git → Argo CD → K3s → aggregate snapshot → static site
01 · Desired state and reconciliation
Argo CD compares declared application configuration with what is running and reports sync and health separately.
02 · K3s compute and storage
Kubernetes schedules workloads on the homelab’s nodes. Persistent storage supports applications that keep state.
03 · Private collection
Every five minutes, the private collector reads Kubernetes and Argo CD status and writes approved aggregate counts to a persistent volume.
04 · Snapshot and public frontend
A separate publisher reads the volume and sends the timestamped aggregate outbound to the portfolio. The public site reads the hosted copy.
Golden Path
The road to Golden Kubestronaut
Follow the skills behind my Golden Kubestronaut credential through the systems I built and operate. Open a tile to see the homelab evidence and the CNCF project it connects to. A gap marks an area where I have yet to publish a verified example.
LinuxSnapshot retained on node-local storageVerified operationView evidence
Linux Foundation Certified System Administrator.
Verified operation. A K3s local-path volume bound to a Linux node and retained a validated snapshot after the test workload was shut down. The collector ran as a non-root user and successfully wrote the file.
KubernetesService discovered through cluster DNSVerified operationView evidence
Kubernetes and Cloud Native Associate.
Verified operation. A test client resolved the snapshot Service through cluster DNS and reached its backing pod. This shows service discovery and workload networking in a real cluster. Kubernetes project.
Kubernetes DeploymentsUpdated replica became availableVerified operationView evidence
Certified Kubernetes Application Developer.
Verified operation. In the rollout walkthrough, the Deployment controller observed its current generation and reported the updated replica available. Rollout evidence.
Kubernetes securityRead-only volume and token-free serverVerified operationView evidence
Certified Kubernetes Security Specialist.
Verified operation. The snapshot server mounted the volume read-only and ran without an API token. Tests verified that it served the exact snapshot path and rejected access to unrelated files.
Kubernetes RBACCollector restricted to approved readsVerified operationView evidence
Kubernetes and Cloud Native Security Associate.
Verified operation. The collector could list approved resources. Kubernetes denied Secret reads, pod logs, exec, and writes. The outbound publisher runs without a Kubernetes API token.
CiliumApproved client reached the Service. The other timed out.Verified operationView evidence
Cilium Certified Associate.
Verified operation. Under Cilium policy, an approved client could read the internal snapshot Service while a second client could not connect. Cilium project.
GitOpsGit revision matched the recorded syncVerified operationView evidence
Certified GitOps Associate.
Verified operation. Argo CD recorded a successful sync against the same revision it was comparing with Git. The walkthrough follows that revision to a ready Deployment. Reconciliation evidence.
Argo CDSynced app with a degraded resourceLive evidenceView evidence
Certified Argo Project Associate.
Live evidence. The dashboard reports Argo CD sync and health separately. The walkthrough shows why, using a synced app with a degraded resource. GitOps dashboard · Argo project.
Project observed. Backstage is deployed in the homelab and tracked by Argo CD. Catalog registration and ownership evidence have yet to be published. Backstage project.
Verified operation. The public portfolio consumes a sanitized snapshot through a documented interface, with collection and delivery handled privately. Delivery boundary.
Project observed. Prometheus workloads were verified in the monitoring scope. The readiness dashboard reads the Kubernetes API. A PromQL result or alerting example has yet to be published. Prometheus project.
Live evidence. A read-only collector writes a validated snapshot to persistent storage. A separate publisher sends it outbound to the portfolio on a five-minute collection cycle. Delivery boundary · Production result.
The credential recognizes the exams I completed. The evidence on this board shows how I apply selected skills in my own infrastructure.
Field note / November 2026
From Git to a ready rollout
For one platform application, Argo CD’s latest recorded successful sync matched the revision it was comparing against Git. The sync record included a Deployment. In K3s, that Deployment’s controller had observed the current generation and reported one updated replica and one available replica, matching the desired count.
Git holds the declared configuration and identifies the revision.
Argo CD compares the live resources with that revision and records the sync result.
K3s reports whether the updated workload is actually available.
Diagnosing delivery
When an app is synced but degraded
A different application was synced while Argo CD marked an ExternalSecret degraded. The declared resource had been applied. Its controller still reported a health problem.
Start with the unhealthy resource’s condition and recent events. For an ExternalSecret, check the referenced store’s readiness and the latest reconciliation result. For a Deployment, compare desired, updated, and available replicas, then check pod conditions and events if availability falls short.
