hotrod
An HP ProDesk 600 G6 mini PC that is the offsite cluster's sandbox node, the worker that runs the untrusted work, on Talos Linux.
| vendor | HP |
|---|---|
| model | ProDesk 600 G6 Desktop Mini PC |
| serial | MXL3122Y9Y |
| sku | 692B2UT#ABA |
| cpu | Intel Core i5-10500T @ 2.30GHz (6c/12t) |
| ram | 16 GB DDR4-3200 SODIMM, one module in DIMM1 |
| gpu | Intel UHD Graphics 630 |
| storage | 256 GB Samsung PM9A1 NVMe (/dev/nvme0n1) |
| network | Intel I219-LM 1 GbE as eno1; the Wi-Fi has no driver |
| os | Talos Linux 1.14 |
| firmware | S22 Ver. 02.27.00, UEFI, Secure Boot off |
| tpm | TPM 2.0 |
hotrod is the sandbox node of the offsite Kubernetes cluster: the worker that runs the untrusted work. It runs Talos Linux, and clusters/offsite/talos/ configures it.
What it runs#
Its lolwtf.ca/sandbox taint, declared with its label of the same name in clusters/offsite/talos/talos.tf, admits only the pods that tolerate it:
- Rowbutt sandboxes, the Kata microVMs.
MATE_SANDBOX_NODE_LABELinclusters/offsite/apps/mate/deployment.yamlnames the label. - The
infra-offsiteGitHub Actions runners, pinned inclusters/offsite/apps/arc/kustomization.yaml. - The kthx engine's in-cluster build Jobs, once the route in the engine's Settings names the label in
nodeSelectorand the taint intolerations. See Built apps. - The DaemonSets that tolerate the taint: Cilium, node-exporter, Vector, Velero's node agent and iperf3.
/var/mnt/data, its data volume, holds the local-path volumes that land on hotrod. The i915 extension loads the GPU's driver, and no device plugin on offsite exposes it to pods.
Reach#
Reach it at hotrod.lolwtf.ca with talosctl --context offsite --nodes hotrod.lolwtf.ca. It runs no SSH server.
Quirks#
- The NVMe holds the EPHEMERAL partition and the
datavolume; there is no second disk. - Memory runs single-channel: the second SODIMM slot is empty.
- A pod that holds a
local-pathvolume on hotrod and does not tolerate the taint cannot be rescheduled: the volume pins it here and the taint refuses it. No such pod remains, and the taint keeps a new one away.
Linked from 5
- Built appsA kthx built app is a repository or archive that kthx builds into a signed artifact and deploys to Targets on the clusters, GCP, Vercel or Cloudflare.
- RowbuttA chat bot, code name mate, that answers the owner in Discord and Slack threads with a coding agent whose tools run in a sandbox on the offsite cluster.
- How Rowbutt worksHow mate runs Rowbutt's agent loop, leases a sandbox on the offsite cluster for its tools and keeps its sessions, and the credentials and network policy of each part.
- HostsEvery host in the homelab, with its role, site, hardware, OS and status, and how to reach it.
- KubernetesThe folly and offsite Kubernetes clusters, how Flux applies clusters/ from git, and the sandbox runtimes and storage the clusters offer.