4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
48 lines
1.4 KiB
Markdown
48 lines
1.4 KiB
Markdown
# k3s API access
|
|
|
|
The Kubernetes API is not on the public internet. See
|
|
[ADR-005](adr/ADR-005-k3s-api-tunnel-only.md).
|
|
|
|
## Day-to-day (workstation)
|
|
|
|
```bash
|
|
bridge up k3s-api-railiance01 # https://127.0.0.1:16444 → Railiance01 :6443
|
|
bridge up k3s-api-coulombcore # https://127.0.0.1:16443 → CoulombCore :6443
|
|
bridge status
|
|
```
|
|
|
|
Point the kubeconfig `server` at the matching local port. The default
|
|
`~/.kube/config` and `~/.kube/config-hosteurope` currently both target
|
|
`https://127.0.0.1:16443` (CoulombCore). For Railiance01 use 16444.
|
|
|
|
```bash
|
|
# Railiance01
|
|
KUBECONFIG=~/.kube/config-railiance01 kubectl get nodes
|
|
# or, once:
|
|
# kubectl --kubeconfig ~/.kube/config-railiance01 config set-cluster default --server=https://127.0.0.1:16444
|
|
```
|
|
|
|
SSH is unaffected. If the tunnel is down, recover over SSH:
|
|
|
|
```bash
|
|
ssh tegwick@92.205.62.239 -- sudo k3s kubectl get nodes
|
|
```
|
|
|
|
## What not to do
|
|
|
|
- Do not `ufw allow 6443/tcp` from the current public IP.
|
|
- Do not add addresses to `k3s_api_allowed_sources` without amending ADR-005.
|
|
- When an old grant must die, put it in `k3s_api_revoked_sources` and run
|
|
`make converge-firewall HOST=Railiance01`.
|
|
|
|
## Converge the firewall only
|
|
|
|
The base role is tagged. Firewall changes no longer drag sshd restarts or
|
|
user-slice memory caps with them:
|
|
|
|
```bash
|
|
make converge-firewall HOST=Railiance01
|
|
```
|
|
|
|
CoulombCore sets `ufw_manage: false`. That host's live filter is iptables, not
|
|
UFW; this target will skip UFW tasks there.
|