Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

fix(vpn): define PIA_REGION + CLUSTER_POD_CIDR cluster-vars; correct pod CIDR + doc where

Browse Source 
gluetun-gateway.yaml referenced ${PIA_REGION}/${CLUSTER_POD_CIDR} but they were never defined
in cluster-vars, and the README didn't say where to set them. Add both to
clusters/base/cluster-vars.yaml (ConfigMap data:, string values, Flux postBuild substitution).
CLUSTER_POD_CIDR is 10.0.0.0/8 (Cilium cluster-pool — pods get 10.x, confirmed live), NOT the
k3s 10.42.0.0/16 I'd assumed. README now names the file + format + per-env override + PF-region note.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-21 22:56:14 -05:00
1 parent 140cb651d2
commit 6591e11ad1
4 files changed
+63 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

platform/vpn-egress/README.md
+10 -3
View File
@@ -16,9 +16,16 @@ tunnel; `internet`-class services go out the normal WAN. Serves **R-NET-05/06/07
## Operator hand-off (when deploying Phase 3)
1. Provision `pia-credentials` (see `bootstrap/sops/secret-templates/pia-credentials.yaml.example`,
namespace `vpn-egress`, keys `username`/`password`) → `sops -e -i` → uncomment it in `kustomization.yaml`.
2. Set cluster-vars: `PIA_REGION` (a **port-forwarding-capable** PIA region — e.g. `Netherlands`,
`CA Toronto`, `Switzerland`; NOT a US region, which lack PF) and `CLUSTER_POD_CIDR` (k3s default
`10.42.0.0/16`).
2. cluster-vars (already defined in `clusters/base/cluster-vars.yaml`; a ConfigMap — values are plain
strings under `data:`, injected into the `${...}` tokens by Flux `postBuild.substituteFrom`). Confirm
or override:
- `PIA_REGION` — a **port-forwarding-capable** PIA region (default `Netherlands`; e.g. `CA Toronto`,
`Switzerland`; NOT a US region — those lack PF). Gluetun `SERVER_REGIONS`.
- `CLUSTER_POD_CIDR` — the **Cilium cluster-pool** pod CIDR (default `10.0.0.0/8`; pods get `10.x`,
confirmed live — NOT the k3s `10.42.0.0/16`). Gluetun `FIREWALL_OUTBOUND_SUBNETS`.
Per-env overrides go in `clusters/<env>/kustomization.yaml` as a cluster-vars JSON patch
(`- op: replace, path: /data/PIA_REGION, value: "…"`). With the self-managing root, a `git push`
auto-applies (no manual `kubectl apply -k`).
3. Enable `- vpn-egress` in `platform/kustomization.yaml` (Phase 3).
## Egress steering — the DESIGN DECISION (needs live validation)