riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 24 Pull Requests 3 Actions Packages Projects 1 Releases Wiki Activity

feat(cloudflared): publish the kube-apiserver at k8s.riotpiao.com #88

Open
rock wants to merge 1 commits from feat/k8s-api-public-tunnel into main
pull from: feat/k8s-api-public-tunnel
merge into: :main
Conversation 0 Commits 1 Files Changed 1
+21
1 Commits
Author SHA1 Message Date
rock 1714b99b71 feat(cloudflared): publish the kube-apiserver at k8s.riotpiao.com 
Adds a tunnel ingress rule so kubectl works from outside the LAN now that the
apiserver authenticates against ZITADEL.

Two deliberate details:

1. The origin is the in-cluster Service
   (kubernetes.default.svc.cluster.local:443), not a node IP. That survives a
   control-plane address change and lets each connector reach a local-healthy
   apiserver.

2. originRequest.noTLSVerify is required. The apiserver presents a certificate
   for the cluster CA plus its node addresses, so its SANs cannot match this
   public hostname. Cloudflare terminates the public TLS with the *.riotpiao.com
   edge certificate and the connector hop is already inside the cluster, so
   skipping verification on that short hop is the least-bad option. This is
   scoped to this one rule; do not copy it elsewhere.

The hostname is served on 443. Cloudflare Tunnel hostname rules do not proxy
arbitrary ports, so kubeconfig must use https://k8s.riotpiao.com with no :6443.

SECURITY: this exposes the Kubernetes API to the internet. Authentication is
still ZITADEL OIDC plus client certificates, but a Cloudflare Access application
belongs in front of the hostname. That is a separate change and is not included
here.
 2026-10-31 15:10:21 -07:00