From c2f0f380126f62edf510207fa374b845c5216dba Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Tue, 18 Aug 2026 23:25:13 -0500 Subject: [PATCH] Fix HA failover etcd: advertise via WAN port-forward, not the Netbird mesh IP UniFi's router has no route to 100.108.0.0/16 (the Netbird mesh CIDR) - it only routes to its own directly-connected LAN. Advertising talos-cp-01's real Netbird-bound IP (100.108.42.109, confirmed live via talosctl to be genuinely bound to its wt0 interface - it's real, just unreachable from outside the mesh) as the etcd client/peer URL would never actually work for inbound WAN traffic from the VPS/witness. Corrected to advertise home.kube.huskypup.net on the WAN ports that will be port-forwarded (12379/12380) to talos-cp-01's real LAN IP (172.28.101.41) + the NodePort Service - UniFi can route to its own LAN natively, no extra static routes needed. --- .../ha-failover/manifests/etcd.yaml | 28 +++++++++++++------ 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/infrastructure/ha-failover/manifests/etcd.yaml b/infrastructure/ha-failover/manifests/etcd.yaml index 759ab89..6e33c6d 100644 --- a/infrastructure/ha-failover/manifests/etcd.yaml +++ b/infrastructure/ha-failover/manifests/etcd.yaml @@ -9,11 +9,23 @@ # # Pinned to a specific node (talos-cp-01) via nodeSelector so its # advertised peer/client URLs (which must be stable, not "whichever node -# it landed on today") stay correct. Reachable from the VPS/witness via -# that node's real IP - confirmed live 2026-08-19 that home nodes are -# directly reachable from Netbird mesh peers on their node IP (the -# netbird-egress DaemonSet's route) - and exposed via a NodePort Service, -# which needs infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml +# it landed on today") stay correct. +# +# Reachable from the VPS/witness via a UniFi WAN port-forward + a +# source-IP-restricted WAN_IN firewall rule (limited to just the VPS and +# witness public IPs) - NOT via the Netbird mesh directly. talos-cp-01 +# does have a real, host-bound Netbird IP (100.108.42.109 on its wt0 +# interface, confirmed live via `talosctl get addresses`), but that's a +# dead end for inbound WAN traffic: UniFi's router only has a route to +# its own directly-connected LAN (172.28.101.0/24), nothing advertises +# 100.108.0.0/16 to it, so a port-forward targeting the Netbird IP would +# never actually route. The port-forward instead targets talos-cp-01's +# real LAN IP (172.28.101.41) - NodePort Services bind on every interface +# on a node, so the same ports are reachable there too, and that's an +# address UniFi can actually route to natively. +# +# The NodePort Service itself needs +# infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml # (disallow-nodeport-services is enforced cluster-wide otherwise). apiVersion: v1 kind: Namespace @@ -56,10 +68,10 @@ spec: - --name=home - --data-dir=/var/lib/etcd/data - --listen-client-urls=http://0.0.0.0:2379 - - --advertise-client-urls=http://100.108.42.109:32379 + - --advertise-client-urls=http://home.kube.huskypup.net:12379 - --listen-peer-urls=http://0.0.0.0:2380 - - --initial-advertise-peer-urls=http://100.108.42.109:32380 - - --initial-cluster=home=http://100.108.42.109:32380,vps=http://100.108.113.41:2380,witness=http://100.108.130.74:2380 + - --initial-advertise-peer-urls=http://home.kube.huskypup.net:12380 + - --initial-cluster=home=http://home.kube.huskypup.net:12380,vps=http://100.108.113.41:2380,witness=http://100.108.130.74:2380 - --initial-cluster-state=new - --initial-cluster-token=ha-failover-quorum ports: