# Simplified k3s Failover & Performance Setup

To fix your **CPU Spikes** and achieve **Resilient Failover** without building a massive cluster, follow this simple 2-node or 3-node plan.

## 1. The Strategy
Instead of making one massive node do everything, we split the work:
- **App Node:** Only runs your public APIs (`jupiter`, `fiesta`, `atlantis`, etc.).
- **Worker Node:** Only runs the heavy background tasks (`worker-orders`, `worker-deliveries`, etc.).

This ensures that if a background worker spikes to 100% CPU, your **main website remains fast and healthy**.

---

## 2. Setting Up Your Planes (Placing Nodes Into Groups)

You need to "tell" Kubernetes which of your servers is which. Run these commands:

### Identify your Node names
```bash
kubectl get nodes
```

### Label your nodes by their role
Replace `<node-name>` with your actual server names (e.g., `server-1`, `server-2`).

#### A. Assign Node 1 as the "App Host"
```bash
kubectl label node <node-1> node-role.workolik/app=true
kubectl taint node <node-1> dedicated=apps:NoSchedule
```

#### B. Assign Node 2 as the "Worker Host" 
*(This node will take all the CPU spikes)*
```bash
kubectl label node <node-2> node-role.workolik/worker=true
kubectl taint node <node-2> dedicated=workers:NoSchedule
```

---

## 3. Simplified Ingress (Replaces Docker Compose)

You no longer need the complex Nginx proxies in your `docker-compose.yml`. I have created a single "Unified Ingress" that replaces all of them.

### Why this is better:
- **Failover:** If an "App Node" fails, Kubernetes automatically moves your APIs to another node, and k3s's built-in Traefik handles the routing instantly.
- **Simplicity:** One file manages all your domains (`queue.workolik.com`, `jupiter.nearle.app`, etc.).

### How to apply it:
1. Apply the Middleware (CORS settings):
   ```bash
   kubectl apply -f manifests/core/traefik-middlewares.yaml
   ```
2. Apply the Unified Ingress:
   ```bash
   kubectl apply -f manifests/core/ingress-unified.yaml
   ```

---

## 4. Summary of Improvements
1. **CPU Isolation:** Workers in `manifests/core/workers.yaml` now have strict limits and are "pushed" to the Worker Plane.
2. **Professional Routing:** Moved from Host-side Nginx (manual failover) to K8s-side Traefik (automatic failover).
3. **No NATS Changes:** We are still using your external NATS, but with the new Ingress, your services are much safer.

## 5. Next Practical Steps (When you are ready)
- **High Availability (HA):** When you have 3 control-plane servers, k3s will survive even if a "Master" node reboots.
- **Persistence:** Ensure any databases or disks aren't tied to a single machine's filesystem (`hostPath`).

**You can now stop using the `docker-compose.yml` for traffic routing once you point your DNS/Load Balancer to your k3s cluster IP.**