description: How we rebuilt an RKE2 on-prem cluster from Argo CD only — OpenBao, External Secrets, TrueNAS CSI, CloudNativePG, Harbor, MinIO, and GitHub Actions runners.

Rebuilding an On-Prem Kubernetes Platform With GitOps After a Storage Wipe

We wiped the old HDD-era cluster and rebuilt on SSD-backed storage. The rule was simple: Argo CD is the only thing applied by hand . Everything else — operators, storage, secrets plumbing, Postgres, the registry, ingress, CI runners — had to come back from git.

This is the story of that rebuild: what we put in GitOps, what we deliberately left out of git, and the failures that taught us more than the happy path.

I work on an on-prem platform team. The cluster is RKE2 (Canal, a typical RKE2 pod CIDR) on a private LAN. A TrueNAS box provides iSCSI, NFS, and S3. Platform hostnames ( argocd , vault , harbor , s3 ) terminate on a MetalLB VIP.…