4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
60 lines
2.4 KiB
YAML
60 lines
2.4 KiB
YAML
---
|
|
# Base role defaults.
|
|
|
|
# When false, this role will not enable or rewrite UFW. Use that for hosts
|
|
# whose live packet filter is not UFW (CoulombCore: iptables INPUT DROP with
|
|
# a Plesk-era accept list). Enabling UFW there is an availability decision,
|
|
# not a side effect of an unrelated converge.
|
|
ufw_manage: true
|
|
|
|
# Source addresses permitted to reach the k3s API (6443/tcp).
|
|
#
|
|
# WHY THIS EXISTS
|
|
# ---------------
|
|
# The k3s API was originally opened to Anywhere by this role, and the source
|
|
# restriction was later added by hand on the live host. That left the declared
|
|
# config WEAKER than reality: re-running this role would have removed the
|
|
# restriction and exposed the Kubernetes API to the internet. Found 2026-08-11.
|
|
#
|
|
# Operator addresses rotate (dynamic ISP leases). An allowlist is a treadmill:
|
|
# each rotation is either an outage or a stale grant to whoever the ISP
|
|
# reassigns the address to. RAIL-HO-WP-0009-T04 therefore keeps this list
|
|
# empty. Reach the API over the ops-bridge SSH tunnel
|
|
# (`k3s-api-railiance01`, local port 16444; `k3s-api-coulombcore`, 16443).
|
|
# See docs/adr/ADR-005-k3s-api-tunnel-only.md.
|
|
#
|
|
# Deliberately empty by default. A host that sets no sources gets NO public
|
|
# access to 6443 — which is the safe failure. SSH (22) is unaffected, so a host
|
|
# converged with an empty list is always recoverable.
|
|
#
|
|
# Each entry, if any:
|
|
# - address: "203.0.113.10"
|
|
# comment: "k3s-api-operator-workstation"
|
|
k3s_api_allowed_sources: []
|
|
|
|
# Source addresses whose k3s API access must be REMOVED on convergence.
|
|
# Move an address here when it stops being yours (or when the public
|
|
# allowlist is retired); convergence then prunes it.
|
|
k3s_api_revoked_sources: []
|
|
|
|
# Source addresses permitted to send Flannel VXLAN (8472/udp).
|
|
#
|
|
# Empty by default. A single-node cluster does not need a public VXLAN
|
|
# grant; adding an unrestricted 8472/udp allow would expose the pod network
|
|
# to injection. Set this to the other nodes' addresses only when the cluster
|
|
# becomes multi-node (RAIL-BS-WP-0007 / ThreePhoenix HA).
|
|
#
|
|
# Each entry:
|
|
# - address: "203.0.113.20"
|
|
# comment: "flannel-vxlan-peer"
|
|
flannel_vxlan_allowed_sources: []
|
|
|
|
# Extra UFW allows that are not k3s. Used for provider agents that must stay
|
|
# reachable (HostEurope Nydus on 2224/tcp). Empty by default so a Hetzner
|
|
# host does not inherit a HostEurope-only hole.
|
|
#
|
|
# Each entry:
|
|
# - port: "2224"
|
|
# proto: tcp
|
|
# comment: "nydus-ex-api dashboard agent"
|
|
ufw_extra_allowed: []
|