4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
1.4 KiB
1.4 KiB
k3s API access
The Kubernetes API is not on the public internet. See ADR-005.
Day-to-day (workstation)
bridge up k3s-api-railiance01 # https://127.0.0.1:16444 → Railiance01 :6443
bridge up k3s-api-coulombcore # https://127.0.0.1:16443 → CoulombCore :6443
bridge status
Point the kubeconfig server at the matching local port. The default
~/.kube/config and ~/.kube/config-hosteurope currently both target
https://127.0.0.1:16443 (CoulombCore). For Railiance01 use 16444.
# Railiance01
KUBECONFIG=~/.kube/config-railiance01 kubectl get nodes
# or, once:
# kubectl --kubeconfig ~/.kube/config-railiance01 config set-cluster default --server=https://127.0.0.1:16444
SSH is unaffected. If the tunnel is down, recover over SSH:
ssh tegwick@92.205.62.239 -- sudo k3s kubectl get nodes
What not to do
- Do not
ufw allow 6443/tcpfrom the current public IP. - Do not add addresses to
k3s_api_allowed_sourceswithout amending ADR-005. - When an old grant must die, put it in
k3s_api_revoked_sourcesand runmake converge-firewall HOST=Railiance01.
Converge the firewall only
The base role is tagged. Firewall changes no longer drag sshd restarts or user-slice memory caps with them:
make converge-firewall HOST=Railiance01
CoulombCore sets ufw_manage: false. That host's live filter is iptables, not
UFW; this target will skip UFW tasks there.