31 lines
1.3 KiB
YAML
31 lines
1.3 KiB
YAML
|
---
|
||
|
|
# Base role defaults.
|
||
|
|
|
||
|
|
# Source addresses permitted to reach the k3s API (6443/tcp).
|
||
|
|
#
|
||
|
|
# WHY THIS EXISTS
|
||
|
|
# ---------------
|
||
|
|
# The k3s API was originally opened to Anywhere by this role, and the source
|
||
|
|
# restriction was later added by hand on the live host. That left the declared
|
||
|
|
# config WEAKER than reality: re-running this role would have removed the
|
||
|
|
# restriction and exposed the Kubernetes API to the internet. Found 2026-08-11.
|
||
|
|
#
|
||
|
|
# The allowlist is therefore declared here and converged, not hand-edited.
|
||
|
|
#
|
||
|
|
# Deliberately empty by default. A host that sets no sources gets NO public
|
||
|
|
# access to 6443 — which is the safe failure. SSH (22) is unaffected, so a host
|
||
|
|
# converged with an empty list is always recoverable.
|
||
|
|
#
|
||
|
|
# Set the real values in inventory/group_vars/all.yaml. Each entry:
|
||
|
|
# - address: "203.0.113.10"
|
||
|
|
# comment: "k3s-api-operator-workstation"
|
||
|
|
k3s_api_allowed_sources: []
|
||
|
|
|
||
|
|
# Source addresses whose k3s API access must be REMOVED on convergence.
|
||
|
|
#
|
||
|
|
# Operator addresses rotate (dynamic ISP leases). Without this, every rotation
|
||
|
|
# leaves a standing grant to an address the ISP has since reassigned to someone
|
||
|
|
# else. Move an address here when it stops being yours; convergence then prunes
|
||
|
|
# it rather than leaving it to accumulate.
|
||
|
|
k3s_api_revoked_sources: []
|