coulomb/kaizen-agentic
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: UFW k3s API admin allowlist procedure for host-operator
Some checks failed
CI Smoke / host-smoke (push) Successful in 1s
Details
ci / test (push) Failing after 9s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Add reusable protocol, wire it in ROLE.yaml, and document the current
railiance01 allowlist plus quick commands in the pilot access-plan.
This commit is contained in:
tegwick 2026-07-16 14:04:44 +02:00
parent 48443a9abb
commit 06037b0486
4 changed files with 182 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

46
engagements/pilots/eng-coulomb-railiance01-ho-001/access-plan.md
View file

@ -34,14 +34,56 @@
- API keys / DB passwords → **OpenBao** via `warden route` (not this agent)
- Do **not** message ops-warden for secret values
## UFW k3s API admin allowlist (6443)
**Policy (since 2026-07-16 remediation):** port **6443/tcp** is **not** open to the
world. Remote k3s API / `kubectl` against the public IP works only from allowlisted
admin public IPs. **SSH (22) remains open Anywhere.**
**Full procedure:**
[`roles/host-operator/protocols/ufw-admin-allowlist.md`](../../../roles/host-operator/protocols/ufw-admin-allowlist.md)
### Current allowlist (update when changing UFW)
| Public IP | Label | Added | Notes |
|-----------|-------|-------|-------|
| 89.244.90.246 | k3s-api-operator-current | 2026-07-16 | Session IP during P4 remediation |
| 85.132.220.102 | k3s-api-operator-hist | 2026-07-16 | Historical login IP |
### Quick commands (railiance01)
```bash
# Discover your public IP (on the admin laptop)
curl -4 -s ifconfig.me; echo
# List rules
ssh railiance01 'sudo ufw status numbered verbose'
# Add admin
ssh railiance01 "sudo ufw allow from <PUBLIC_IP> to any port 6443 proto tcp comment 'k3s-api-admin-<label>'"
# Remove: use rule number from status numbered
ssh railiance01 'sudo ufw delete <N>'
```
After any change: update the table above and append a line to the verification log.
Class: **`firewall_change`** — record approval for production changes.
**Not required for:** local `sudo k3s kubectl` on the host, or API access only via SSH tunnel.
**8472/udp:** world-open rule removed (single-node). Re-add only if multi-node flannel peers need it.
UFW backup from remediation: `/etc/ufw/user.rules.bak.20260716` on host.
## Verification log
| Date | Result | Notes |
|------|--------|-------|
| 2026-07-16 | **OK** | ICMP OK; `ssh railiance01` interactive-non-batch shell OK; host_observe assessment completed (RU-01) |
| 2026-07-16 | **OK** | ICMP OK; `ssh railiance01` shell OK; host_observe assessment (RU-01) |
| 2026-07-16 | **OK** | UFW 6443 restricted to allowlist; 8472 closed externally (P4) |
## Revocation
| Date | Action |
|------|--------|
| _open_ | On ramp-down: stop renewing agent certs/keys used for this engagement; set schedule disabled; mark here |
| _open_ | On ramp-down: stop renewing agent certs/keys used for this engagement; set schedule disabled; remove temporary admin UFW rules if desired; mark here |