Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01. |
||
|---|---|---|
| .. | ||
| inventory | ||
| playbooks | ||
| roles | ||
| ansible.cfg | ||
| inventory_from_yaml.py | ||
| requirements.yaml | ||