mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby Husky
5f52f2b36b
Part of the Authentik HA pilot (see plan doc). Home's etcd quorum member (StatefulSet, pinned to talos-cp-01 for a stable advertised address) plus a NodePort exposing pg-authentik's current primary - both reachable from the VPS/witness over the already-authenticated Netbird mesh (confirmed live: home nodes are directly reachable from Netbird peers on their real node IP, via the netbird-egress DaemonSet's route). Deliberately NOT going through UniFi/public-internet exposure - this stays entirely inside the private mesh, a materially safer path than the WAN port- forward originally considered. Needs a scoped Kyverno PolicyException (ha-failover-nodeport-exception.yaml) since disallow-nodeport-services is enforced cluster-wide - narrowly scoped to Services named ha-*, matching the existing netbird-egress- exemption.yaml precedent for exceptions.
32 lines
1.3 KiB
YAML
32 lines
1.3 KiB
YAML
# Scoped exception to the disallow-nodeport-services policy, narrowly for
|
|
# the multi-site active-failover pilot's cross-site services (etcd quorum,
|
|
# Postgres streaming replication) - not a namespace-wide exclusion.
|
|
#
|
|
# Why NodePort is genuinely needed here: home nodes are directly reachable
|
|
# from Netbird mesh peers (VPS, witness) on their real node IP - confirmed
|
|
# live 2026-08-19 (ping succeeded from the VPS to a node's InternalIP,
|
|
# which is itself a Netbird-mesh address via the netbird-egress DaemonSet's
|
|
# route). A NodePort Service binds on that same real interface on every
|
|
# node, giving the VPS/witness a way to reach it directly over the already-
|
|
# authenticated Netbird mesh - no public internet exposure, no UniFi
|
|
# port-forward, no new WAN-facing attack surface. LoadBalancer (MetalLB)
|
|
# only gets a LAN-side VIP, which isn't reachable from Netbird peers at all
|
|
# without the same underlying NodePort-style exposure anyway.
|
|
apiVersion: kyverno.io/v2
|
|
kind: PolicyException
|
|
metadata:
|
|
name: ha-failover-nodeport-exemption
|
|
namespace: kyverno
|
|
spec:
|
|
exceptions:
|
|
- policyName: disallow-nodeport-services
|
|
ruleNames:
|
|
- disallow-nodeport
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Service
|
|
names:
|
|
- ha-*
|