K3s in Place: Closing the Loop on a TypeScript-Native Infra Stack

Kreativarc is an independent research and engineering lab of Arnold Lovas, based in Vienna. It explores how AI, software platforms and cloud infrastructure can converge to create autonomous systems that observe, reason and act.

K3s, TypeScript, and a Budget VPS Walk Into a Datacenter...

The setup provisions a classic three-node setup: one control plane, two workers — all Hetzner CX22s, tucked into a private subnet with proper firewalling. K3s is installed on the control plane first (Traefik disabled, obviously), then the node token is fetched securely and used to join the workers. The kubeconfig is exported and made available to other repos via Pulumi stack outputs. It's the bridge between infra and app layer — and it's finally real.

Under the hood, the SshCli helper now does most of the heavy lifting. It generates per-instance ED25519 keypairs, establishes secure SSH connections (with host key checks, because we’re adults), and runs the install scripts remotely. We treat SSH access like a first-class citizen, not a shell hack.

Testing? Yes. Jest-based tests check not just the resource state, but actual cluster health and node readiness. The CI doesn’t consider the infra “done” unless kubectl get nodes shows green across the board. Worker node flaking? You'll find out fast.

A Refactor Worth the Effort

Bringing in K3s triggered a full project refactor. Hetzner resources were moved into scoped subfolders, config handling was centralized, and the Pulumi wrapper was split into a pulumiCli object with better test ergonomics. Output handling got saner, especially around secrets like node tokens and exported kubeconfig.

The stack is now far more modular — a side effect of solving real-world deployment bugs that only surface when you actually try to join a cluster over a freshly provisioned network with restricted firewalls and tight SSH policies.

One Language to Rule Them All (For Now)

The entire project is TypeScript-based, which keeps context switches minimal and CI/CD straightforward. Everything — from infra definitions to helper functions and tests — is in the same language, same tooling, same mental model. It’s fast, typed, and works.

Eventually, specialized tools (e.g., Go for k8s CRD wrangling or Python for AI-heavy workflows) may make their way in. But today, TypeScript is the lingua franca of kreativarc_infra. And that clarity has helped move faster, especially while solo.

It All Runs for Under €10 a Month

The stack runs on budget-friendly Hetzner instances with no managed services. Firewalls are locked down, tunnels handle exposure (when needed), and there’s zero persistent infra outside the VPS box. CI/CD is handled separately via GitHub Actions, pulling kubeconfig from Pulumi outputs when needed.

You don’t need to spend hundreds per month for a real infrastructure backbone — just automate ruthlessly, test everything, and don’t cut corners on security.

Next stop: modular namespaces, observability stack rework, and possibly a Golang sidecar or two. But for now, it clusters, it connects, and it tests itself. That’s a solid milestone.

K3s in Place: Closing the Loop on a TypeScript-Native Infra Stack

Comments

More from this blog

Neuroid Engine I/O

Neuroids – Building a Society of AI and Humans

Secure CI/CD with WireGuard and Kubernetes — the kreativarc.com Flow

Building kreativarc-core for Kubernetes Observability on a Modest VPS

Per-Namespace Control: kreativarc-infra v2

K3s, TypeScript, and a Budget VPS Walk Into a Datacenter...

A Refactor Worth the Effort

One Language to Rule Them All (For Now)

It All Runs for Under €10 a Month

Command Palette

Comments

More from this blog

K3s, TypeScript, and a Budget VPS Walk Into a Datacenter...

A Refactor Worth the Effort

One Language to Rule Them All (For Now)

It All Runs for Under €10 a Month