Overdeck · K3s migration

Phase 3 secures the cluster that already exists

No machine is enrolled. The phase binds the three real Node identities, creates an isolated restricted canary namespace, proves one tiny workload on each existing Node, and leaves current routing untouched.

Exact topology · 3 existing nodes

3existing Kubernetes Nodes

0machines to enroll

0routing changes

Authoritative cluster

debian1

100.106.253.50Ready workerexisting builder

debian2

100.79.69.43Ready workerexisting builder

debian3

100.101.104.41Readycontrol plane

Identity convergence

Source	Required proof
Tracked registries	Exact names, machine IDs, Tailscale IPs and fixed orders
Tailscale	Exactly one online device per reviewed name
SSH	`/etc/machine-id` equals the registry
Kubernetes	Node UID, machineID, InternalIP, role and Ready state

Ordered transaction

1–3 · Prove the real topology

Load exact registries, then converge Tailscale, SSH and Kubernetes identity.

4–8 · Establish policy safely

Server-side dry run, label snapshot, restricted namespace, protected labels and negative Pod Security probe.

9–11 · Existing-node canaries

Run one cached digest-pinned pause Pod on debian1, debian2 and debian3.

12–15 · Cleanup and authorization

Delete all canaries, re-prove Ready/UID identity, assert zero enrollment/routing mutation, validate receipt.

Registry truthThree names only

→

Live identityTailscale + SSH + API

→

Policy substrateRestricted and default deny

→

Node canariesCached image, exact Node

→

Draft PROnly after validator passes

`overdeck-canary` contract

restrictedPod Security pinned to API minor

default denyIngress and egress NetworkPolicy

5content-addressed resources

Protected identity

Controller-owned labels bind every Node to its reviewed machine ID, Tailscale IP, role and resource-contract digest.

five-key allowlistprior values snapshotted

Minimal canary

Each Pod uses a cached pause image by digest, imagePullPolicy=Never, no token, no volumes, no privileges and tiny resource limits.

one Node at a timedeleted after proof

Phase may change

One new namespace, four namespace-scoped policy resources, five protected labels per existing Node, and temporary canary Pods.

Phase cannot change

K3s install/config, bootstrap tokens, Node membership, reboots, cordons, taints, fleet registries, dispatch orders or existing workloads.

Publication lock

Git staging is prohibited until the independent validator proves all three existing Nodes, all three canaries, Pod Security rejection, unchanged Node UIDs and every enrollment/routing flag equal to false.

Handled failure sequence

Delete canariesOnly phase-owned Pods

→

Restore labelsExact prior value or absence

→

Delete namespaceOnly if this transaction created it

→

Block GitPreserve failure receipt

The launcher refuses to adopt an existing overdeck-canary namespace. That prevents rollback from deleting or overwriting an unrelated resource.

Owner command

./apply-overdeck-k3s-phase3-existing-cluster.sh \ /home/user/Projects/overdeck

No candidate hostname is accepted. Run as the normal repository owner, not with sudo.

Handoff

Return overdeck-k3s-phase3-existing-cluster-result-<timestamp>.tar.gz. Keep the generated pull request draft and unmerged until its exact live receipt is reviewed.