Erich Blume
3679124ebd
## Summary - Add `tag:k8s-api` to Pulumi ACLs and indri device tags - Configure Tailscale serve with TCP passthrough for k8s API at `k8s.tail8d86e.ts.net` - Update minikube role to include `k8s.tail8d86e.ts.net` in certificate SANs - Add `apiserver_port` config option (internal port 6443, dynamic host port with podman driver) - Document Step 0.14 in k8s-migration plan (added post-Phase 0 completion) The Kubernetes API is now accessible at `https://k8s.tail8d86e.ts.net` using TCP passthrough to preserve mTLS authentication. ## Deployment and Testing - [x] Pulumi ACLs applied - [x] Tailscale service created and approved in admin console - [x] Minikube cluster recreated with new cert SANs - [x] tailscale serve configured with TCP passthrough - [x] 1Password credentials updated with new certs - [x] Kubeconfig updated on gilbert - [x] `mise run indri-services-check` passes - [x] `kubectl --context=minikube-indri get nodes` works via Tailscale 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/27
20 lines
759 B
YAML
20 lines
759 B
YAML
---
|
|
# Minikube cluster configuration
|
|
minikube_cpus: 4
|
|
# Note: Must be less than podman machine memory (8192MB) to account for overhead
|
|
minikube_memory: 7800
|
|
minikube_disk_size: "200g"
|
|
minikube_driver: podman
|
|
minikube_container_runtime: cri-o
|
|
|
|
# Remote access configuration
|
|
# These allow kubectl from other machines (e.g., gilbert) to connect
|
|
# k8s.tail8d86e.ts.net is exposed via Tailscale service (TCP passthrough)
|
|
minikube_apiserver_names:
|
|
- k8s.tail8d86e.ts.net
|
|
- indri
|
|
# Note: apiserver_port is the INTERNAL container port; with podman driver,
|
|
# the host port is dynamically assigned. Check actual port with:
|
|
# kubectl config view --minify -o jsonpath="{.clusters[0].cluster.server}"
|
|
minikube_apiserver_port: 6443
|
|
minikube_listen_address: "0.0.0.0"
|