jakman85andClaude Opus 4.8
81ef78295a
Controller now reaches the kube-API directly through the pfSense NAT (192.168.2.50:6443 -> kube-vip VIP 192.168.1.49:6443), validating TLS against the VIP via tls-server-name. Removes the dev.sh SSH-tunnel scaffolding and updates the ansible source-of-truth so a rebuild regenerates a direct-access kubeconfig. Co-Authored-By: Claude Opus 4.8 <[email protected]>
29 lines
1.5 KiB
YAML
29 lines
1.5 KiB
YAML
---
|
|
# Shared connection + cluster facts for every k3s node.
|
|
|
|
# cloud-init created this login user (tofu var login_user); it has NOPASSWD sudo.
|
|
ansible_user: k3s
|
|
|
|
# The kube-apiserver endpoint the whole stack agrees on: the primary's REAL node IP.
|
|
# NOTE: ansible_host is now the pfSense NAT SSH target (192.168.2.102:225x), NOT the node
|
|
# IP — so we read the real 192.168.1.x from k3s_node_ip instead. Used for k3s --tls-san /
|
|
# secondary --server AND for Cilium k8sServiceHost so the Ansible bootstrap and the Flux
|
|
# HelmRelease stay in PARITY (docs/02 contract).
|
|
k3s_api_host: "{{ hostvars[groups['k3s_primary'][0]]['k3s_node_ip'] }}"
|
|
k3s_api_port: 6443
|
|
|
|
# Control-plane HA VIP floated by kube-vip (roles/kube_vip). A stable failover
|
|
# endpoint for the kube-apiserver, fronted by an operator pfSense port-forward at
|
|
# 192.168.1.49:6443. Shared here so BOTH kube_vip AND the k3s_server tls-san list
|
|
# agree on the address (the serving cert must carry this IP or TLS via the VIP
|
|
# fails to validate).
|
|
kube_vip_address: "192.168.1.49"
|
|
|
|
# Controller (dev container) reaches the kube-API DIRECTLY via the pfSense NAT
|
|
# (192.168.2.50:6443 -> kube-vip VIP 192.168.1.49:6443) — no SSH tunnel. TLS is
|
|
# validated against the VIP via tls-server-name (the VIP IP is in the serving cert's
|
|
# tls-san list, so TLS through the NAT validates). Only the controller kubeconfig uses
|
|
# these; k8sServiceHost (in-cluster) stays the real node IP.
|
|
cluster_controller_api_server: "https://192.168.2.50:6443"
|
|
cluster_controller_tls_server_name: "{{ kube_vip_address }}"
|