revert(cloudflared): do not publish the kube-apiserver at k8s.riotpiao.com #105

2026-11-03T22:04:08Z

rock commented

2026-11-03 22:04:08 +00:00

#88 added a tunnel rule mapping k8s.riotpiao.com to the in-cluster apiserver. Its own comment warned that without a Cloudflare Access application in front, every scanner on the internet reaches the apiserver — and no Access application exists.

ArgoCD applied the rule before the exposure could be stopped. I patched the live ConfigMap and restarted cloudflared; all paths now return 404. This commit removes the rule from the source so it cannot return.

The hostname keeps its DNS record and returns the tunnel's 404 fallback. Publish it again only together with an Access policy.

#88 added a tunnel rule mapping k8s.riotpiao.com to the in-cluster apiserver. Its own comment warned that without a Cloudflare Access application in front, every scanner on the internet reaches the apiserver — and no Access application exists. ArgoCD applied the rule before the exposure could be stopped. I patched the live ConfigMap and restarted cloudflared; all paths now return 404. This commit removes the rule from the source so it cannot return. The hostname keeps its DNS record and returns the tunnel's 404 fallback. Publish it again only together with an Access policy.

rock added 1 commit 2026-11-03 22:04:09 +00:00

revert(cloudflared): do not publish the kube-apiserver at k8s.riotpiao.com 63a6784ea9

#88 added a tunnel rule mapping k8s.riotpiao.com to the in-cluster apiserver.
Its own comment warned that without a Cloudflare Access application in front,
every scanner on the internet reaches the apiserver, and no Access
application exists.

ArgoCD applied the rule before the exposure could be stopped, so the live
ConfigMap was patched and cloudflared restarted to drop it. All paths now
return 404. This commit removes the rule from the source so it cannot return.

The hostname keeps its DNS record and returns the tunnel's 404 fallback. That
is deliberate: publish it again only together with an Access policy.

rock merged commit 6b609eb4c2 into main

2026-11-03 22:04:35 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#105