Single-Node Lab

The single-node-lab target boots a single k3d cluster with the full lab stack:

• Dex + OpenLDAP — OIDC SSO for all services
• Prometheus + Grafana + Alertmanager — cluster observability
• ArgoCD — GitOps with Dex SSO
• Headlamp — Kubernetes web UI with Dex SSO

All services are exposed via Traefik ingress on *.nip.io domains and authenticate through Dex.

Quickstart

# Full stack (5 phases, ~8-10 minutes)
make single-node-lab

Or with a local image registry:

make single-node-lab-registry

What Gets Deployed

Architecture

flowchart LR
    subgraph k3d["Single k3d Cluster"]
        Traefik["Traefik Ingress<br/>*.nip.io"]
        Dex["Dex OIDC +<br/>OpenLDAP"]
        Grafana["Grafana"]
        Prom["Prometheus<br/>+ Alertmanager"]
        ArgoCD["ArgoCD"]
        Headlamp["Headlamp"]
    end

    Traefik -->|auth| Dex
    Grafana -->|OIDC| Dex
    ArgoCD -->|OIDC| Dex
    Headlamp -->|OIDC| Dex

SSO Credentials

All components (Grafana, ArgoCD, Headlamp) support Sign in with Dex. Grafana also has a local admin account: admin / prom-operator.

Teardown

make single-node-lab-destroy

This deletes the k3d cluster and all deployed resources.

Individual Targets

You can also run each step independently:

# 1. Cluster
make cluster                              # or: CLUSTER_NAME=mycluster make cluster

# 2. SSO
make deploy-dex

# 3. Observability
make deploy-promstack
make deploy-monitoring-ingress

# 4. ArgoCD
./ocm/scripts/install-argocd-k3d.sh
make deploy-argocd-ingress
make ocm-configure-argocd-sso

# 5. Headlamp
make deploy-headlamp

IP Detection

The nip.io IP is auto-detected by scripts/get-nipio-ip.sh — it checks Tailscale IPv4 first, then falls back to the Traefik LoadBalancer IP.

make lb-ip

See IP Detection for details.