rock
1714b99b71
Adds a tunnel ingress rule so kubectl works from outside the LAN now that the apiserver authenticates against ZITADEL. Two deliberate details: 1. The origin is the in-cluster Service (kubernetes.default.svc.cluster.local:443), not a node IP. That survives a control-plane address change and lets each connector reach a local-healthy apiserver. 2. originRequest.noTLSVerify is required. The apiserver presents a certificate for the cluster CA plus its node addresses, so its SANs cannot match this public hostname. Cloudflare terminates the public TLS with the *.riotpiao.com edge certificate and the connector hop is already inside the cluster, so skipping verification on that short hop is the least-bad option. This is scoped to this one rule; do not copy it elsewhere. The hostname is served on 443. Cloudflare Tunnel hostname rules do not proxy arbitrary ports, so kubeconfig must use https://k8s.riotpiao.com with no :6443. SECURITY: this exposes the Kubernetes API to the internet. Authentication is still ZITADEL OIDC plus client certificates, but a Cloudflare Access application belongs in front of the hostname. That is a separate change and is not included here.
78 lines
3.5 KiB
YAML
78 lines
3.5 KiB
YAML
# cloudflared ingress configuration.
|
|
#
|
|
# This list is the tunnel's routing table: for each incoming hostname the
|
|
# connector dials the matching origin. The final rule is a catch-all, so a
|
|
# hostname absent from this list gets 404 from the connector — DNS alone does
|
|
# not route a request into a service.
|
|
#
|
|
# Management model: this file makes the tunnel LOCALLY managed. cloudflared is
|
|
# given a credentials file instead of a token, so Cloudflare stops pushing the
|
|
# remotely-managed ingess list and this ConfigMap wins. Revert the Deployment to
|
|
# `run --token` to return to the dashboard-managed list.
|
|
#
|
|
# Origin services self-reference the public hostname. That resolves because
|
|
# CoreDNS rewrites each of these names to ingress-nginx
|
|
# (terraform/files/coredns/Corefile), so the connector reaches the in-cluster
|
|
# ingress instead of looping back out through Cloudflare.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cloudflared-config
|
|
namespace: cloudflared
|
|
data:
|
|
config.yml: |
|
|
tunnel: 32d0bf93-e1bd-45b8-93a9-71ff9f83de80
|
|
credentials-file: /etc/cloudflared/creds/credentials.json
|
|
|
|
# WARP-to-Tunnel routing. The remotely-managed config had this enabled;
|
|
# dropping the key would break WARP access to private addresses. cloudflared
|
|
# 2026.x has no `enabled` field — the key's presence is what enables it, and
|
|
# `enabled: true` here makes the binary warn about an unused key.
|
|
warp-routing: {}
|
|
|
|
ingress:
|
|
- hostname: paperless.riotpiao.com
|
|
service: https://paperless.riotpiao.com
|
|
- hostname: img.riotpiao.com
|
|
service: https://img.riotpiao.com
|
|
- hostname: riotpiao.com
|
|
service: https://riotpiao.com
|
|
- hostname: grafana.riotpiao.com
|
|
service: https://grafana.riotpiao.com
|
|
- hostname: gotify.riotpiao.com
|
|
service: https://gotify.riotpiao.com
|
|
- hostname: igotify.riotpiao.com
|
|
service: https://igotify.riotpiao.com
|
|
- hostname: poimen.riotpiao.com
|
|
service: https://poimen.riotpiao.com
|
|
- hostname: comfyui.riotpiao.com
|
|
service: https://comfyui.riotpiao.com
|
|
- hostname: forgejo.riotpiao.com
|
|
service: https://forgejo.riotpiao.com
|
|
# ZITADEL. Without this rule the connector answers 404 for the hostname
|
|
# even though the DNS CNAME points at the tunnel.
|
|
- hostname: zitadel.riotpiao.com
|
|
service: https://zitadel.riotpiao.com
|
|
# KUBERNETES API, for kubectl from outside the LAN.
|
|
#
|
|
# Origin is the in-cluster Service, not the node IP: that survives a
|
|
# control-plane address change and lets the connectors reach whichever
|
|
# apiserver is local-healthy.
|
|
#
|
|
# noTLSVerify is required. The apiserver serves a certificate for the
|
|
# cluster CA plus its node/LB addresses, so its SANs cannot match this
|
|
# public hostname. Cloudflare terminates the public TLS with the
|
|
# *.riotpiao.com edge certificate, and the connector hop is already
|
|
# inside the cluster, so skipping verification on that short hop is the
|
|
# least-bad option. Do not widen this to other rules.
|
|
#
|
|
# SECURITY: this exposes the API to the internet. Authentication is still
|
|
# ZITADEL OIDC plus client certificates, but put a Cloudflare Access
|
|
# application in front of this hostname as well -- see the note in the
|
|
# PR. Without Access, every scanner on the internet reaches the apiserver.
|
|
- hostname: k8s.riotpiao.com
|
|
service: https://kubernetes.default.svc.cluster.local:443
|
|
originRequest:
|
|
noTLSVerify: true
|
|
- service: http_status:404
|