# k3s API access

The Kubernetes API is not on the public internet. See
[ADR-005](adr/ADR-005-k3s-api-tunnel-only.md).

## Day-to-day (workstation)

```bash
bridge up k3s-api-railiance01     # https://127.0.0.1:16444  →  Railiance01 :6443
bridge up k3s-api-coulombcore     # https://127.0.0.1:16443  →  CoulombCore :6443
bridge status
```

Point the kubeconfig `server` at the matching local port. The default
`~/.kube/config` and `~/.kube/config-hosteurope` currently both target
`https://127.0.0.1:16443` (CoulombCore). For Railiance01 use 16444.

```bash
# Railiance01
KUBECONFIG=~/.kube/config-railiance01 kubectl get nodes
# or, once:
#   kubectl --kubeconfig ~/.kube/config-railiance01 config set-cluster default --server=https://127.0.0.1:16444
```

SSH is unaffected. If the tunnel is down, recover over SSH:

```bash
ssh tegwick@92.205.62.239 -- sudo k3s kubectl get nodes
```

## What not to do

- Do not `ufw allow 6443/tcp` from the current public IP.
- Do not add addresses to `k3s_api_allowed_sources` without amending ADR-005.
- When an old grant must die, put it in `k3s_api_revoked_sources` and run
  `make converge-firewall HOST=Railiance01`.

## Converge the firewall only

The base role is tagged. Firewall changes no longer drag sshd restarts or
user-slice memory caps with them:

```bash
make converge-firewall HOST=Railiance01
```

CoulombCore sets `ufw_manage: false`. That host's live filter is iptables, not
UFW; this target will skip UFW tasks there.