Edge on Kubernetes

Edge-only mode: the towonel-node chart with hub.enabled: false. With the edge enabled the chart renders a DaemonSet on hostNetwork (every node binds the public ports directly) and adds NET_BIND_SERVICE so the non-root pod can bind them. The edge sits behind an L4 ingress (Envoy Gateway here) that adds PROXY v2. The chart and hub share one OCIRepository.

HelmRelease

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: towonel-edge
  namespace: towonel
spec:
  chartRef:
    kind: OCIRepository
    name: towonel-node
  interval: 30m
  values:
    global:
      fullnameOverride: towonel-edge
    hub:
      enabled: false
    edge:
      bindAddress: 0.0.0.0
      httpsPort: 8444
    defaultPodOptions:
      tolerations:
        - operator: Exists
    controllers:
      main:
        annotations:
          reloader.stakater.com/auto: "true"
        containers:
          main:
            env:
              TOWONEL_EDGE_HUB_LINK_ADDR: towonel-hub.towonel.svc.cluster.local:51444
              TOWONEL_EDGE_IROH_PORT: "51820"
              TOWONEL_EDGE_ADVERTISED_ADDRESSES: edge-eu.example.eu:443
              TOWONEL_EDGE_PROXY_PROTOCOL: "true"
              TOWONEL_EDGE_LISTEN_WORKERS: "4"
            envFrom:
              - secretRef: { name: towonel-edge-secret }

The edge binds bindAddress:httpsPort for TLS (default [::]:443; behind an L4 proxy use 0.0.0.0:8444 as above), edge.httpPort for plain HTTP, and edge.metricsPort for health/metrics. Probes target /health automatically; data lives on a baked-in emptyDir at edge.dataDir. TOWONEL_EDGE_ADVERTISED_ADDRESSES is the public address clients dial — edge-eu.example.eu:443 at the L4 proxy, not the internal :8444. Edges are stateless — the hub-link reconnects on restart and the route table replays from the hub.

Pin edges to specific nodes with defaultPodOptions.nodeSelector / affinity, e.g. one release per region keyed on a towonel.dev/region label (set TOWONEL_EDGE_REGION to match).

Secret

The edge only needs the hub-link PSK:

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: towonel-edge
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword
  target: { name: towonel-edge-secret }
  data:
    - secretKey: TOWONEL_EDGE_HUB_LINK_PSK
      remoteRef: { key: towonel-hub, property: HUB_LINK_PSK }

Why hostNetwork + DaemonSet

• :443/:8444 need a stable public IP per node; hostNetwork gives it without a LoadBalancer.
• The iroh QUIC UDP socket on :51820 needs the host’s UDP namespace.
• One pod per node — LISTEN_WORKERS=4 shares the accept socket via SO_REUSEPORT for throughput.

L4 ingress

The edge requires PROXY v2 on its TLS listener. Front it with Envoy / Traefik / HAProxy on :443 — see Reverse proxy in front.

Monitoring

serviceMonitor.main.enabled: true scrapes the edge metrics port. The hub alert rules and Grafana dashboard ship from the hub release; the dashboard covers edge metrics too.