From 734093cf925e9bc4d2eb42b64cdae75e4c37adae Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 22 Aug 2026 16:33:38 -0500 Subject: [PATCH] fix(vpn): hardcode OPENVPN_ENDPOINT_PORT "53" as string (Flux var int-coercion) Wiring the port via "${PIA_OPENVPN_PORT}" made Flux/kustomize emit an unquoted 53 (int) after substitution, which k8s rejects for an env value ("expected string, got 53"). Same gotcha as the Longhorn numberOfReplicas fix. Hardcode the quoted string; cluster-var removed with a NOTE explaining why. Co-Authored-By: Claude Opus 4.8 --- clusters/base/cluster-vars.yaml | 8 +++----- platform/kustomization.yaml | 2 +- platform/vpn-egress/gluetun-gateway.yaml | 7 +++++-- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/clusters/base/cluster-vars.yaml b/clusters/base/cluster-vars.yaml index 18a37d0..c7ae857 100644 --- a/clusters/base/cluster-vars.yaml +++ b/clusters/base/cluster-vars.yaml @@ -43,11 +43,9 @@ data: # which lacks PF; NOT a US region, which also lack PF) CLUSTER_POD_CIDR: "10.0.0.0/8" # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel - PIA_OPENVPN_PORT: "53" # PIA OpenVPN endpoint UDP port. PIA's default is 1197, but - # this home network NATs its OWN OpenVPN server on WAN:1197, so - # outbound PIA-on-1197 replies never return (tcpdump-confirmed). - # 53 is proven to traverse this network. Valid PIA ports: - # 53, 1194, 1197, 1198, 8080, 9201. Other envs may override to 1197. + # NOTE: PIA OpenVPN port is HARDCODED "53" in gluetun-gateway.yaml, not a cluster-var — Flux/kustomize + # strips quotes around a bare "${VAR}" so a numeric value coerces to int, which k8s rejects for an env + # value (same gotcha as the Longhorn numberOfReplicas fix). See DECISIONS-LOG. # --- identity / auth (ADR-0014) --- KEYCLOAK_REPLICAS: "1" # dev 1 | prod 2 (HA) diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml index e7a0ed8..c6a4d25 100644 --- a/platform/kustomization.yaml +++ b/platform/kustomization.yaml @@ -17,7 +17,7 @@ resources: - cert-manager # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token` - externaldns # auto DNS records — needs SOPS `cloudflare-api-token` - gateway # Gateway API listeners (ingress; replaces Traefik) - # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port ${PIA_OPENVPN_PORT}=53, ADR-0013 amendment). + # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port 53, ADR-0013 amendment). # NOT PIA's default 1197 — this home network NATs its own OpenVPN server on WAN:1197, which # collided with the outbound PIA-on-1197 flow (tcpdump-confirmed; DECISIONS-LOG). ---- - vpn-egress # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013) diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml index 545326d..b5202ae 100644 --- a/platform/vpn-egress/gluetun-gateway.yaml +++ b/platform/vpn-egress/gluetun-gateway.yaml @@ -41,8 +41,11 @@ spec: - name: VPN_TYPE value: "openvpn" # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended - name: OPENVPN_ENDPOINT_PORT - value: "${PIA_OPENVPN_PORT}" # NOT 1197 — the home network NATs its own OpenVPN server there, - # so PIA-on-1197 replies never return (see cluster-vars + DECISIONS-LOG) + value: "53" # NOT 1197 — the home network NATs its own OpenVPN server there, + # so PIA-on-1197 replies never return (tcpdump-confirmed; DECISIONS-LOG). + # Hardcoded (not a ${var}): Flux/kustomize strips quotes on "${VAR}" + # → int coercion, which k8s rejects for env value (Longhorn-fix gotcha). + # Valid PIA ports: 53, 1194, 1197, 1198, 8080, 9201. # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env): - name: OPENVPN_USER valueFrom: