From 0d55c793f3d3f7950a7da5e4709198cc53b6047b Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Fri, 21 Aug 2026 23:00:51 -0500 Subject: [PATCH] fix(vpn): default PIA_REGION to Sweden (operator choice, PF-capable) Co-Authored-By: Claude Opus 4.8 (1M context) --- clusters/base/cluster-vars.yaml | 4 ++-- platform/vpn-egress/README.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/clusters/base/cluster-vars.yaml b/clusters/base/cluster-vars.yaml index b593590..a0c6c96 100644 --- a/clusters/base/cluster-vars.yaml +++ b/clusters/base/cluster-vars.yaml @@ -38,8 +38,8 @@ data: KYVERNO_ADMISSION_REPLICAS: "3" # dev: 1 (no HA needed to iterate) # --- egress / VPN (Phase 3, ADR-0013) — consumed by platform/vpn-egress/gluetun-gateway.yaml --- - PIA_REGION: "Netherlands" # a PORT-FORWARDING-capable PIA region (NOT a US region); - # operator: change to your preferred PF-capable region + PIA_REGION: "Sweden" # operator's choice — a PORT-FORWARDING-capable PIA region + # (Sweden is PF-capable; NOT a US region, which lack PF) CLUSTER_POD_CIDR: "10.0.0.0/8" # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel diff --git a/platform/vpn-egress/README.md b/platform/vpn-egress/README.md index 5280930..c873f90 100644 --- a/platform/vpn-egress/README.md +++ b/platform/vpn-egress/README.md @@ -19,8 +19,8 @@ tunnel; `internet`-class services go out the normal WAN. Serves **R-NET-05/06/07 2. cluster-vars (already defined in `clusters/base/cluster-vars.yaml`; a ConfigMap — values are plain strings under `data:`, injected into the `${...}` tokens by Flux `postBuild.substituteFrom`). Confirm or override: - - `PIA_REGION` — a **port-forwarding-capable** PIA region (default `Netherlands`; e.g. `CA Toronto`, - `Switzerland`; NOT a US region — those lack PF). Gluetun `SERVER_REGIONS`. + - `PIA_REGION` — a **port-forwarding-capable** PIA region (default `Sweden`; e.g. `Netherlands`, + `CA Toronto`, `Switzerland`; NOT a US region — those lack PF). Gluetun `SERVER_REGIONS`. - `CLUSTER_POD_CIDR` — the **Cilium cluster-pool** pod CIDR (default `10.0.0.0/8`; pods get `10.x`, confirmed live — NOT the k3s `10.42.0.0/16`). Gluetun `FIREWALL_OUTBOUND_SUBNETS`. Per-env overrides go in `clusters//kustomization.yaml` as a cluster-vars JSON patch