k3s cluster live: 3 servers + 17 workers, all 20 Ready

docs/PLAN.md

@@ -58,6 +58,22 @@ Fully unattended network reimage, no per-node physical access:
 - UniFi MFA blocks API access; DHCP reservations deferred — mDNS
   (`planck0NN.local`) works across subnets today.
 
+## K3S CLUSTER LIVE (2026-09-19)
+
+- **3 servers** (planck002/003/004, embedded etcd HA) + **17 workers**
+- Kubernetes v1.36.4+k3s1, all 20 nodes Ready, static IPs
+- kubectl on the laptop: `~/.local/bin/kubectl`, kubeconfig at `~/.kube/config`
+  (server URL https://192.168.0.110:6443). k3s node-token lives on planck002
+  at /var/lib/rancher/k3s/server/node-token.
+- Join flow: `scripts/k3s-join.sh` (needs K3S_TOKEN env)
+- Traefik ingress + local-path storage ship with k3s; default
+- NOTE: Pi firmware injects `cgroup_disable=memory` — the node cmdline.txt
+  overrides with `cgroup_enable=cpuset cgroup_memory=1 cgroup_enable=memory`
+  (already applied fleet-wide; required for k3s).
+- Domain for websites: carr.pub (DNS not yet pointed; pending)
+- Next up: monitoring (light Prometheus+Grafana), Synology NFS storageclass,
+  carr.pub DNS + cert-manager, load-test rig, agent harness namespaces
+
 ## REBUILD COMPLETE (2026-09-19)
 
 All 20 nodes re-imaged with Raspberry Pi OS Lite (Debian 13 trixie), via