Volta: a Kubernetes platform built from scratch on OpenStack

The problem

Cloud infrastructure hides its physical cost. A pod drawing 40 W looks exactly like a pod drawing 4 W: same dashboard, same green checkmark, same invoice line buried in an aggregate. Capacity ends up sized by intuition, and “we should optimize this” stays an opinion, because the thing being optimized is never measured.

Volta closes that gap on a small scale. It builds a complete platform from nothing, then adds the signal most platforms lack: watts and grams of CO2eq attributed to each workload, shown next to what that workload actually costs.

Two constraints

• Everything is destroyed and rebuilt. A step that cannot survive a full destroy and rebuild cycle is not finished.
• Every measurement states its own margin of error. Energy figures taken inside a virtual machine are estimates, and the repository says so wherever it reports one.

Where the project stands

The platform runs: a private network behind a router, three nodes in three availability zones reached through a bastion, a k3s cluster bootstrapped by OpenTofu, HTTPS ingress through an Octavia load balancer, Traefik and cert-manager, and Argo CD delivering every service in the cluster from the repository.

In progress: observability, with Prometheus and Grafana. Next come Velero backups, proven by a real restore, then the second phase: per-pod power draw, a carbon model, and one optimization measured before and after.

Some decisions

Each significant decision is recorded as an ADR, with the options that were rejected and why. A few of them:

• OpenTofu rather than Terraform: MPL-2.0 licensing, and supported by Infomaniak’s own documentation.
• Self-managed k3s rather than managed Kubernetes: the cluster bootstrap is part of what the repository demonstrates.
• One etcd member per availability zone: a lost zone costs one member, not the quorum, for under a millisecond of latency.
• A bastion as the only way in: no node has a public address, and the exposed machine is not a member of the cluster.
• State in Swift, encrypted, without a lock: the platform’s S3 layer refuses the conditional write a lock needs; saved plans and versioning stand in.
• OpenTofu outside the cluster, Argo CD inside: every resource has one owner, and the four values that cross the line are listed in one place.

What broke

The repository puts this part above the feature list: how a platform fails and recovers says more about it than what it does on a good day. Three examples.

A state lock the platform cannot take. With state locking enabled, planning failed before doing anything. OpenTofu takes that lock with a conditional write, and Swift 2.30.1, which serves the S3 API here, answers every conditional write with 501 NotImplemented. Swift accepts it from version 2.36.0; until the platform runs it, the state has no lock, and an ADR says what stands in.

An application that would never turn healthy. The site answered and its certificate was issued, yet Argo CD kept reporting the demo as progressing. Argo CD calls an Ingress healthy only once its status carries an address, and this one carried none: Traefik copies it from its own Service, a NodePort, while the address lives on the Octavia load balancer, outside the cluster. Traefik now publishes the stable public address itself.

A self-healing cluster that left a manual change in place. Scaled by hand to three replicas, the demo stayed at three, with self-healing on. Its manifest declared no replica count: Kubernetes had filled one in, and Argo CD enforces only what the manifest declares. The manifest now declares one, and the same command is undone.