coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Declare a third operator address; record T02 progress and why full converge was held
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
89.244.90.255 appeared in the live allowlist mid-session. Verified legitimate:
SSH pubkey auth as tegwick from that address on 2026-08-02, and UFW BLOCK
entries on 6443 immediately before it was granted. Now declared.

Both stale grants are deleted from the live host, so the security goal of T02 is
met and the live 6443 allowlist matches the declaration exactly.

Full convergence deliberately held: --check reports 11 changes, mostly unrelated
to the firewall, including MemoryMax=1500M on user-1000.slice which could OOM
running agent workloads, plus an sshd restart. That is a separate decision, and
the base role has no tags so convergence cannot be scoped to UFW alone. Records
both follow-ons.

The allowlist drifting again by hand during the session that was fixing
allowlist drift is now recorded as the strongest argument for T04, removing the
API from the public internet.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-08-12 01:46:36 +02:00
parent 35ddfa5f78
commit 3c38b0625a
2 changed files with 33 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ansible/inventory/group_vars/all.yaml
View file

@ -44,6 +44,8 @@ ops_bridge_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKQmXbAVlEa8dzGx8Hk2S7AI
k3s_api_allowed_sources:
- address: "89.244.90.236"
comment: "k3s-api-operator-current"
- address: "89.244.90.255"
comment: "k3s-api-operator-current"
k3s_api_revoked_sources:
- address: "89.244.90.246"

32
workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md
View file

@ -98,7 +98,7 @@ session (`89.244.90.236` granted; `kubectl` verified, node Ready v1.35.1+k3s1).
```task
id: RAIL-HO-WP-0009-T02
status: todo
status: progress
priority: high
state_hub_task_id: "7d91dfc2-481b-4943-90e9-bb1b814a23dc"
```
@ -111,6 +111,36 @@ still carries the two stale grants.
Verify SSH remains available throughout, and re-check `kubectl get nodes` after.
**Progress 2026-08-12.** The security goal is met surgically: both stale grants
(`89.244.90.246`, `85.132.220.102`) are deleted from the live host, and the live
6443 allowlist now matches the declaration exactly.
Full convergence was **deliberately not run**. A `--check` against `Railiance01`
reported **11 changes**, most unrelated to the firewall: an sshd restart,
`MemoryMax=1500M` and `MemorySwapMax=512M` on `user-1000.slice`, PAM `nproc`
caps for `tegwick`, swappiness, timezone, and the ops-bridge key injection. That
is a substantial and never-applied behavioural change to a production host —
notably the user-slice memory cap, which could OOM running agent workloads. It
is a separate decision from pruning two firewall grants, and the base role has
**no tags**, so convergence cannot currently be scoped to UFW alone.
Two follow-ons fall out of this:
- adding `tags:` to the base role, so firewall changes can be converged without
dragging unrelated drift with them
- deciding whether the resource-limit and sshd changes should be applied; they
are the declared baseline and have simply never been run
**A third operator address was found mid-session.** `89.244.90.255` appeared in
the live allowlist between two checks. It is legitimate — SSH pubkey auth as
`tegwick` from that address on 2026-08-02, and `[UFW BLOCK]` entries on 6443 at
23:41 on 2026-08-12 immediately before it was granted. It is now declared in
`group_vars/all.yaml`.
That is worth recording as evidence rather than as a footnote: the allowlist
drifted again, by hand, *during the very session that was fixing allowlist
drift*. It is the strongest available argument for T04.
```task
id: RAIL-HO-WP-0009-T03
status: todo