gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-20 23:16:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix HA failover etcd: advertise via WAN port-forward, not the Netbird mesh IP

Browse Source 
UniFi's router has no route to 100.108.0.0/16 (the Netbird mesh CIDR) -
it only routes to its own directly-connected LAN. Advertising
talos-cp-01's real Netbird-bound IP (100.108.42.109, confirmed live via
talosctl to be genuinely bound to its wt0 interface - it's real, just
unreachable from outside the mesh) as the etcd client/peer URL would
never actually work for inbound WAN traffic from the VPS/witness.

Corrected to advertise home.kube.huskypup.net on the WAN ports that will
be port-forwarded (12379/12380) to talos-cp-01's real LAN IP
(172.28.101.41) + the NodePort Service - UniFi can route to its own LAN
natively, no extra static routes needed.
This commit is contained in:
Scooby Husky
2026-08-18 23:25:13 -05:00
parent 5f52f2b36b
commit c2f0f38012
1 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/ha-failover/manifests/etcd.yaml
+20 -8
View File
@@ -9,11 +9,23 @@
#
# Pinned to a specific node (talos-cp-01) via nodeSelector so its
# advertised peer/client URLs (which must be stable, not "whichever node
# it landed on today") stay correct. Reachable from the VPS/witness via
# that node's real IP - confirmed live 2026-08-19 that home nodes are
# directly reachable from Netbird mesh peers on their node IP (the
# netbird-egress DaemonSet's route) - and exposed via a NodePort Service,
# which needs infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
# it landed on today") stay correct.
#
# Reachable from the VPS/witness via a UniFi WAN port-forward + a
# source-IP-restricted WAN_IN firewall rule (limited to just the VPS and
# witness public IPs) - NOT via the Netbird mesh directly. talos-cp-01
# does have a real, host-bound Netbird IP (100.108.42.109 on its wt0
# interface, confirmed live via `talosctl get addresses`), but that's a
# dead end for inbound WAN traffic: UniFi's router only has a route to
# its own directly-connected LAN (172.28.101.0/24), nothing advertises
# 100.108.0.0/16 to it, so a port-forward targeting the Netbird IP would
# never actually route. The port-forward instead targets talos-cp-01's
# real LAN IP (172.28.101.41) - NodePort Services bind on every interface
# on a node, so the same ports are reachable there too, and that's an
# address UniFi can actually route to natively.
#
# The NodePort Service itself needs
# infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
# (disallow-nodeport-services is enforced cluster-wide otherwise).
apiVersion: v1
kind: Namespace
@@ -56,10 +68,10 @@ spec:
- --name=home
- --data-dir=/var/lib/etcd/data
- --listen-client-urls=http://0.0.0.0:2379
- --advertise-client-urls=http://100.108.42.109:32379
- --advertise-client-urls=http://home.kube.huskypup.net:12379
- --listen-peer-urls=http://0.0.0.0:2380
- --initial-advertise-peer-urls=http://100.108.42.109:32380
- --initial-cluster=home=http://100.108.42.109:32380,vps=http://100.108.113.41:2380,witness=http://100.108.130.74:2380
- --initial-advertise-peer-urls=http://home.kube.huskypup.net:12380
- --initial-cluster=home=http://home.kube.huskypup.net:12380,vps=http://100.108.113.41:2380,witness=http://100.108.130.74:2380
- --initial-cluster-state=new
- --initial-cluster-token=ha-failover-quorum
ports: