Production-grade MLOps infrastructure running on a 20-node Raspberry Pi cluster with custom thermal management and distributed storage.
This project originated from a requirement to simulate edge computing constraints (network partitions, hardware failures, and strict resource limits) within a physical environment. While cloud infrastructure abstracts these complexities, building resilient distributed systems requires confronting them directly.
The solution is a high-density compute cluster comprising 20 Raspberry Pi Compute Module 4 nodes, orchestrated by Talos Linux. Each node is equipped with NVMe storage and powered via PoE+, eliminating common bottlenecks associated with single-board computers. The entire infrastructure, including networking and management, occupies just 4.33U of rack space while operating silently in an office environment.
The cluster serves as the production backbone for my personal infrastructure, hosting RAG pipelines, vector databases, and distributed caching layers. It demonstrates that enterprise-grade architecture principles (immutable infrastructure, GitOps, and observability) can be effectively scaled down to edge hardware.
At a high level, the system bridges public cloud services with private home infrastructure. Cloudflare Zero Trust secures the entry point, while Vercel handles the frontend edge caching. The Kubernetes cluster itself sits safely behind the home firewall, connected only via secure outbound tunnels and GitOps synchronization loops.
C4 Level 1 Diagram
Internally, the cluster is strictly segmented by namespaces. Traffic enters via Cloudflared tunnels into the ingress namespace, where Traefik routes requests to application services.ArgoCD acts as the control plane, continuously reconciling the cluster state with the GitHub repository, while Actions Runner Controller (ARC) spins up ephemeral build agents on-demand for CI/CD workflows.
C4 Level 2/3 Container View
The physical layer is designed for density and efficiency. Twenty Raspberry Pi CM4 nodes are mounted on blade carrier boards, each with dedicated NVMe storage and PoE+ delivery. This 4.33U rack setup provides a completely self-contained compute environment with its own networking and power management context.
Office environment • ~400W compute power • Silent operation
GitOps-managed infrastructure via ArgoCD
The entire infrastructure is declaratively defined in Git. ArgoCD continuously reconciles cluster state, while Sealed Secrets manages sensitive data encryption. Every change flows through version control. No manual kubectl apply commands in production.
Rather than exposing services via port forwarding, Cloudflare Tunnels establish outbound-only connections. Combined with Traefik for internal routing and MetalLB for L2 load balancing, the cluster remains completely shielded from direct internet exposure.
Talos Linux provides an API-driven, immutable OS with no SSH access. All configuration happens through declarative machine configs. This eliminates configuration drift and ensures consistent, reproducible node states across the entire cluster.
Actions Runner Controller spins up ephemeral GitHub Actions runners directly on the cluster. This enables ARM64-native builds, secrets access via Sealed Secrets, and the ability to test deployments in the actual target environment.
Storing secrets in Git required Sealed Secrets with asymmetric encryption. The cluster holds the private key, while CI/CD pipelines encrypt using the public cert. Database credentials, API tokens, and tunnel configs are version-controlled safely without exposing plaintext values.
Many upstream projects lack ARM64 images. GitHub Actions builds multi-arch containers using buildx, pushing to GHCR. The cluster authenticates via sealed ImagePullSecrets. For custom apps, cross-compilation from x86 build agents targets ARM64 natively.
Talos eliminates SSH entirely. Debugging requires talosctl and kubectl exclusively. Logs flow through aggregators, metrics to Prometheus, and configuration via machine configs. This forced adoption of cloud-native observability patterns from day one.
PostgreSQL and Redis require persistent storage across pod restarts. Each node provides local NVMe via PersistentVolumes. Database migrations run as Kubernetes Jobs before deployment, ensuring schema consistency while maintaining zero-downtime rolling updates.