Optional Platform Toolbox

Overview

Lists common additions for a small k3s GitOps platform. Install only when a concrete requirement exists; every controller consumes memory and expands the upgrade and security surface.

Need Tool Guidance
GitOps visualization Argo CD UI Primary view of desired versus live state
Cluster terminal UI k9s Run on the operator machine; nothing to install in cluster
Database UI CloudBeaver or pgAdmin Optional; port-forward and disable when unused
Kafka UI Redpanda Console or AKHQ Optional; internal-only access
Redis UI RedisInsight Prefer a local client through port-forward
Backups Velero plus database-native backup Store backups outside the VPS
S3-compatible storage External provider or MinIO External storage is safer; single-node MinIO shares the VPS failure domain
DNS automation external-dns Use only with a supported provider and tightly scoped API token
Image automation Renovate Open pull requests for pinned chart and image updates
Policy Kyverno Add after baseline GitOps is stable
Runtime troubleshooting kubectl debug and ephemeral containers Avoid debug tools inside production images
External uptime checks Uptime Kuma or a hosted monitor A hosted monitor can detect total VPS failure
Progressive delivery Argo Rollouts Add canary or blue-green deployment after basic delivery is stable
Container registry GHCR, Harbor Prefer a hosted registry; Harbor is heavy for a small VPS

Baseline Selection

For an 8 GB VPS, begin with Argo CD, cert-manager, PostgreSQL, Redis, and metrics/Grafana. Add Loki and a broker only after checking sustained memory and disk headroom. Keep database and Kafka UIs off by default.

Operational Rules

  • Pin versions; let Renovate propose upgrades.
  • Define requests, limits, PVC sizes, and retention for every stateful component.
  • Keep admin UIs private and credentials in the chosen secret manager.
  • Send backups to a different provider and failure domain; test restores.
  • Maintain a resource budget so optional tools cannot evict core workloads.