opentofu: decommission stopped pre-k8s guests (migration rollback net) #75

2026-06-27T10:35:32Z

k.renner commented

2026-06-27 10:35:32 +00:00

Tier 3 — the irreversible one. Retires the 13 stopped Proxmox guests that were the PVE→K8s migration rollback net. Each replacement was verified Running/healthy in the live cluster before removal.

Stopped guest (VMID)	k8s replacement (verified)
homeassistant VM (103)	`home-assistant`
influxdb VM (108)	`influxdb-influxdb2-0` (in-cluster, :8086)
grafana VM (109)	`kube-prometheus-stack-grafana`
ical-proxy (121)	`ical-proxy`
authentik app/db 1&2 (130–133)	`authentik-*` full stack
audiobookshelf (212)	`audiobookshelf`
immich (225)	`immich-*`
loki (226)	`loki-0`
prometheus (227)	`prometheus-*`
music-assistant (229)	`music-assistant`

Also drops those 13 VMIDs from backup_jobs.tf and the stale authentik-db.renner.uno → 10.2.40.135 DNS record (dead keepalived VIP; k8s authentik uses in-cluster ak-pg).

Kept: fortress VM (102 — not a migrated service, separate stopped VM) and paperless VM (111).

⚠️ IRREVERSIBLE. Applying destroys these guests and wipes their disks — no rollback to the pre-k8s VMs after this. Verify the tofu plan shows exactly these destroys before apply. Service hostnames are already owned by k8s ingress (all modules had ingress_cnames = []), so no live DNS is removed.

Follow-up noted (not in this PR): the superseded pre-k8s ansible monitoring stack still references the old postgres-HA VIP 10.2.40.135 (prometheus/blackbox/gatus roles) — dead config to clean separately.

🤖 Generated with Claude Code

Tier 3 — the irreversible one. Retires the 13 stopped Proxmox guests that were the PVE→K8s migration rollback net. **Each replacement was verified Running/healthy in the live cluster before removal.** | Stopped guest (VMID) | k8s replacement (verified) | |---|---| | homeassistant VM (103) | `home-assistant` | | influxdb VM (108) | `influxdb-influxdb2-0` (in-cluster, :8086) | | grafana VM (109) | `kube-prometheus-stack-grafana` | | ical-proxy (121) | `ical-proxy` | | authentik app/db 1&2 (130–133) | `authentik-*` full stack | | audiobookshelf (212) | `audiobookshelf` | | immich (225) | `immich-*` | | loki (226) | `loki-0` | | prometheus (227) | `prometheus-*` | | music-assistant (229) | `music-assistant` | Also drops those 13 VMIDs from `backup_jobs.tf` and the stale `authentik-db.renner.uno → 10.2.40.135` DNS record (dead keepalived VIP; k8s authentik uses in-cluster `ak-pg`). **Kept:** `fortress` VM (102 — not a migrated service, separate stopped VM) and `paperless` VM (111). > ⚠️ **IRREVERSIBLE.** Applying destroys these guests and **wipes their disks** — no rollback to the pre-k8s VMs after this. Verify the `tofu plan` shows exactly these destroys before apply. Service hostnames are already owned by k8s ingress (all modules had `ingress_cnames = []`), so no live DNS is removed. Follow-up noted (not in this PR): the superseded pre-k8s **ansible monitoring** stack still references the old postgres-HA VIP `10.2.40.135` (prometheus/blackbox/gatus roles) — dead config to clean separately. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

k.renner added 1 commit 2026-06-27 10:35:32 +00:00

opentofu: decommission stopped pre-k8s guests (migration rollback net)

ci/woodpecker/push/deploy-infrastructure Pipeline was successful

Details

3360f6ca83

All 13 services run in k8s and were verified healthy/Running before
removal (audiobookshelf, immich, loki, prometheus, ical-proxy,
music-assistant, authentik full stack, home-assistant, influxdb [in
cluster as influxdb-influxdb2], grafana [kube-prometheus-stack]). These
stopped Proxmox guests were the PVE->K8s migration rollback net; with the
replacements serving 1-7 weeks, retire them.

Removed tofu modules (destroys the stopped guests + their stale DNS):
- vm_103_homeassistant, vm_108_influxdb, vm_109_grafana
- lxc_121_ical_proxy, lxc_212_audiobookshelf, lxc_225_immich,
  lxc_226_loki, lxc_227_prometheus, lxc_229_music_assistant
- lxc_authentik_ha (130/131/132/133) + its stale authentik-db.renner.uno
  -> 10.2.40.135 (dead keepalived VIP) DNS record
- backup_jobs.tf: drop VMIDs 103/108/109/121/130/131/132/133/212/225/226/227/229

Kept: fortress VM (102, not a migrated service) and paperless VM (111).

IRREVERSIBLE: applying destroys these guests and wipes their disks.
Review the plan before apply.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit 65233120a2 into master

2026-06-27 10:38:10 +00:00

k.renner referenced this issue from a commit

2026-06-27 10:38:11 +00:00

Merge pull request 'opentofu: decommission stopped pre-k8s guests (migration rollback net)' (#75) from decommission-pre-k8s-guests into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#75