Adds a tunnel ingress rule so kubectl works from outside the LAN now that the
apiserver authenticates against ZITADEL.
Two deliberate details:
1. The origin is the in-cluster Service
(kubernetes.default.svc.cluster.local:443), not a node IP. That survives a
control-plane address change and lets each connector reach a local-healthy
apiserver.
2. originRequest.noTLSVerify is required. The apiserver presents a certificate
for the cluster CA plus its node addresses, so its SANs cannot match this
public hostname. Cloudflare terminates the public TLS with the *.riotpiao.com
edge certificate and the connector hop is already inside the cluster, so
skipping verification on that short hop is the least-bad option. This is
scoped to this one rule; do not copy it elsewhere.
The hostname is served on 443. Cloudflare Tunnel hostname rules do not proxy
arbitrary ports, so kubeconfig must use https://k8s.riotpiao.com with no :6443.
SECURITY: this exposes the Kubernetes API to the internet. Authentication is
still ZITADEL OIDC plus client certificates, but a Cloudflare Access application
belongs in front of the hostname. That is a separate change and is not included
here.
rock
1714b99b71