jakman85andClaude Opus 5
3f980d2a17
R-ENV-02 promises dev and prod differ ONLY by scoped cluster-vars overrides. In fact
dev LAN addresses were hardcoded into base manifests, so clusters/prod would have come
up ANNOUNCING DEV ADDRESSES (192.168.1.x) on the prod LAN (192.168.2.x).
New cluster-vars knobs (base default = dev literal, per the file's existing convention):
K3S_API_HOST platform/cilium/helmrelease.yaml (+ the values.yaml mirror)
CILIUM_LB_POOL_START platform-config/cilium/l2-ip-pool.yaml
CILIUM_LB_POOL_STOP "
UNIFI_L4_VIP apps/vms/unifi/50-service-l4.yaml
CRAFTY_L4_VIP platform/crafty/service-l4.yaml
S3_BACKUP_ENDPOINT platform/keycloak/postgres-cluster.yaml, apps/wave-0/{nextcloud,
semaphore}-db.yaml, and platform/velero/helmrelease.yaml
Also fixes GATEWAY_VIP's base default, which was still the RETIRED libvirt address
10.73.0.240, and adds the GATEWAY_VIP patch that clusters/prod was missing entirely.
clusters/base/apps-vms.yaml gains postBuild.substituteFrom (it was the one consuming
Kustomization without it, so a ${TOKEN} there would have shipped as a literal string).
The envsubst contract is documented there: ${VAR} substitutes and escapes as $${VAR};
$VAR and $(cmd) are left alone; ${ARR[0]} hard-errors. The three UOS_URL expansions in
the unifi cloud-init are escaped accordingly.
PROD ADDRESS PLAN (operator, 2026-08-31):
nodes .10/.11/.12 · control-plane VIP .9 (Ansible-side) · GATEWAY_VIP .20
Cilium LB pool .20-.30
CONTAINMENT INVARIANT, now documented at the pool and in the prod overlay: GATEWAY_VIP
MUST equal CILIUM_LB_POOL_START. The shared Gateway pins no address, so Cilium LB-IPAM
gives it the first free address of a matching pool block. An initial prod proposal put
.20 outside a .21-.30 pool; the Gateway would have come up on .21 while split-horizon
coredns-custom kept answering *.home.keithjackson.dev with .20 — an address nothing
announces — blackholing in-cluster OIDC hairpin traffic while reporting healthy. The
pool was widened to .20-.30. The control-plane VIP (.9) stays outside the pool so
kube-vip and LB-IPAM can never contend.
Values prod still cannot know stay INVALID `TBD-PROD-*` placeholders on purpose: base
defaults are dev values, so an omitted patch means prod silently inherits a dev address
— far worse than a loud failed apply.
DEV IS BYTE-IDENTICAL. Verified by kustomize build over 13 paths before/after, then
flux envsubst with the dev cluster-vars values applied to both sides: zero drift. The
only deltas are the intended additive keys in the overlay ConfigMap itself. No
unresolved ${TOKEN} survives. render-golden green (10 goldens); yamllint clean.
Serves: R-ENV-02. Task: T-7.1 (prerequisite). Gate: MERGE GATE: PASS.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
75 lines
3.9 KiB
YAML
75 lines
3.9 KiB
YAML
---
|
|
# ============================================================================================
|
|
# GAME-PORT L4 EXPOSURE — why the shared HTTPS Gateway is NOT enough (same shape as apps/vms/unifi).
|
|
# ============================================================================================
|
|
# The Minecraft servers Crafty creates listen on RAW TCP (Java) and UDP (Bedrock) game ports inside
|
|
# the crafty pod's network namespace. The Gateway API `shared` Gateway is an L7 HTTPS terminator and
|
|
# CANNOT express raw TCP on arbitrary ports or UDP at all. So the game ports are exposed as
|
|
# type=LoadBalancer Services whose VIP is pulled from the CiliumLoadBalancerIPPool `default-pool`
|
|
# (dev 192.168.1.53-.60; see CILIUM_LB_POOL_* in cluster-vars) and ARP-announced on the flat LAN by
|
|
# the existing CiliumL2AnnouncementPolicy
|
|
# `default-l2` (platform-config/cilium/*) — the SAME machinery the Gateway VIP and unifi already use.
|
|
# No new Cilium config is needed; these Services just consume the pool.
|
|
#
|
|
# THIS PATH IS NOT AUTH-GATED — and that is correct: Minecraft's Java (Mojang/Microsoft auth) and
|
|
# Bedrock (Xbox Live) protocols authenticate the PLAYER themselves. Only the Crafty WEB UI (admin
|
|
# control plane) is Keycloak-gated (via the oauth2-proxy sidecar); the game ports carry player traffic
|
|
# and must reach the server subprocesses directly.
|
|
#
|
|
# VIP: CRAFTY_L4_VIP (cluster-vars, R-ENV-02; dev 192.168.1.55) — the next free address in
|
|
# default-pool (dev: .53 = shared Gateway, .54 = unifi; verified free live 2026-08-28). PINNED via
|
|
# lbipam.cilium.io/ips so players have a stable target. The `crafty` Flux Kustomization substitutes it.
|
|
# ONE VIP, TWO SERVICES: a LoadBalancer Service is single-protocol-friendly, so TCP and UDP split into
|
|
# two Services sharing the IP via lbipam.cilium.io/sharing-key (same pattern as unifi).
|
|
#
|
|
# STARTER PORT SET (the operator has not created any servers yet): TCP 25565-25567 (three Java slots)
|
|
# + UDP 19132-19134 (three Bedrock slots). To add capacity: create the server in Crafty bound to a NEW
|
|
# port, then add that port to the matching Service below (and a containerPort in deployment.yaml for
|
|
# documentation) and to the game-port ingress CiliumNetworkPolicy (networkpolicy.yaml). K8s Services
|
|
# enumerate ports individually (no ranges), so add one `{ name, port, targetPort, protocol }` line each.
|
|
#
|
|
# externalTrafficPolicy: Local preserves the LAN client source IP and pins the VIP to the node running
|
|
# the crafty pod (also what L2 announcement does). external-dns (source: service) publishes the A
|
|
# record from the -tcp Service.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: crafty-l4-tcp
|
|
namespace: crafty
|
|
labels:
|
|
app.kubernetes.io/name: crafty
|
|
annotations:
|
|
lbipam.cilium.io/sharing-key: "crafty"
|
|
lbipam.cilium.io/ips: "${CRAFTY_L4_VIP}"
|
|
# external-dns publishes A crafty-mc.home.keithjackson.dev -> the pinned VIP (Java server target).
|
|
external-dns.alpha.kubernetes.io/hostname: "crafty-mc.home.keithjackson.dev"
|
|
spec:
|
|
type: LoadBalancer
|
|
externalTrafficPolicy: Local
|
|
selector:
|
|
app.kubernetes.io/name: crafty
|
|
ports:
|
|
- { name: mc-java-0, port: 25565, targetPort: 25565, protocol: TCP }
|
|
- { name: mc-java-1, port: 25566, targetPort: 25566, protocol: TCP }
|
|
- { name: mc-java-2, port: 25567, targetPort: 25567, protocol: TCP }
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: crafty-l4-udp
|
|
namespace: crafty
|
|
labels:
|
|
app.kubernetes.io/name: crafty
|
|
annotations:
|
|
lbipam.cilium.io/sharing-key: "crafty" # same key + same IP => shares the VIP with -tcp
|
|
lbipam.cilium.io/ips: "${CRAFTY_L4_VIP}"
|
|
spec:
|
|
type: LoadBalancer
|
|
externalTrafficPolicy: Local
|
|
selector:
|
|
app.kubernetes.io/name: crafty
|
|
ports:
|
|
- { name: mc-bedr-0, port: 19132, targetPort: 19132, protocol: UDP }
|
|
- { name: mc-bedr-1, port: 19133, targetPort: 19133, protocol: UDP }
|
|
- { name: mc-bedr-2, port: 19134, targetPort: 19134, protocol: UDP }
|