jv
/
my-homelab-configs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Disable worker Tailscale route acceptance by default

This commit is contained in:
juvdiaz 2026-06-29 23:12:56 -06:00
parent f2fe545471
commit 00cfff3ae7
4 changed files with 24 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
README.md
View File

@ -212,13 +212,17 @@ tofu -chdir=bootstrap/cluster apply \
-var-file="$PWD/.lab/cluster-workers.auto.tfvars.json" -var-file="$PWD/.lab/cluster-workers.auto.tfvars.json"
``` ```
Worker Tailscale defaults to `--accept-routes=true` and enables pod egress SNAT Worker Tailscale defaults to `--accept-routes=false` because these VMs already
from the Kubernetes pod CIDR to `tailscale0`, so pods on Pimox workers can reach live on the homelab LAN; accepting an advertised `192.168.100.0/24` route can
tailnet-only services. Override with steal their local LAN route and break SSH or MetalLB traffic. Pod egress SNAT
`LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=false` or from the Kubernetes pod CIDR to `tailscale0` stays enabled, so pods on Pimox
`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when that behavior is not workers can reach tailnet-only services. Set
wanted. `./jeannie doctor-cluster` checks Pimox worker tailnet egress `LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=true` only when the worker must consume
against `${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and tailnet-advertised routes that do not overlap the local LAN. Set
`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when pod egress through
`tailscale0` is not wanted. `./jeannie doctor-cluster` checks Pimox
worker tailnet egress against
`${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and
`${LAB_PIMOX_WORKER_TAILNET_PROBE_PORT:-LAB_GITEA_HTTP_PORT}`. `${LAB_PIMOX_WORKER_TAILNET_PROBE_PORT:-LAB_GITEA_HTTP_PORT}`.
OpenWrt firewall VM automation is available as a standalone command because it OpenWrt firewall VM automation is available as a standalone command because it

18
README.md.tmpl
View File

@ -212,13 +212,17 @@ tofu -chdir=bootstrap/cluster apply \
-var-file="$PWD/.lab/cluster-workers.auto.tfvars.json" -var-file="$PWD/.lab/cluster-workers.auto.tfvars.json"
``` ```
Worker Tailscale defaults to `--accept-routes=true` and enables pod egress SNAT Worker Tailscale defaults to `--accept-routes=false` because these VMs already
from the Kubernetes pod CIDR to `tailscale0`, so pods on Pimox workers can reach live on the homelab LAN; accepting an advertised `192.168.100.0/24` route can
tailnet-only services. Override with steal their local LAN route and break SSH or MetalLB traffic. Pod egress SNAT
`LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=false` or from the Kubernetes pod CIDR to `tailscale0` stays enabled, so pods on Pimox
`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when that behavior is not workers can reach tailnet-only services. Set
wanted. `./{{ main_script }} doctor-cluster` checks Pimox worker tailnet egress `LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=true` only when the worker must consume
against `${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and tailnet-advertised routes that do not overlap the local LAN. Set
`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when pod egress through
`tailscale0` is not wanted. `./{{ main_script }} doctor-cluster` checks Pimox
worker tailnet egress against
`${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and
`${LAB_PIMOX_WORKER_TAILNET_PROBE_PORT:-LAB_GITEA_HTTP_PORT}`. `${LAB_PIMOX_WORKER_TAILNET_PROBE_PORT:-LAB_GITEA_HTTP_PORT}`.
OpenWrt firewall VM automation is available as a standalone command because it OpenWrt firewall VM automation is available as a standalone command because it

2
bootstrap/cluster/variables.tf
View File

@ -86,7 +86,7 @@ variable "worker_tailscale_enabled" {
variable "worker_tailscale_accept_routes" { variable "worker_tailscale_accept_routes" {
type = bool type = bool
default = true default = false
} }
variable "worker_tailscale_pod_egress_snat" { variable "worker_tailscale_pod_egress_snat" {

2
scripts/workers
View File

@ -208,7 +208,7 @@ tailnet_setup() {
local var_file="${LAB_CLUSTER_VAR_FILE:-${REPO_ROOT}/.lab/cluster-workers.auto.tfvars.json}" local var_file="${LAB_CLUSTER_VAR_FILE:-${REPO_ROOT}/.lab/cluster-workers.auto.tfvars.json}"
local auth_key_file="${LAB_PIMOX_WORKER_TAILSCALE_AUTH_KEY_FILE:-${HOME}/.config/homelab/tailscale-pimox-worker.authkey}" local auth_key_file="${LAB_PIMOX_WORKER_TAILSCALE_AUTH_KEY_FILE:-${HOME}/.config/homelab/tailscale-pimox-worker.authkey}"
local worker_key_prefix="${LAB_PIMOX_WORKER_KEY_PREFIX:-pimox}" local worker_key_prefix="${LAB_PIMOX_WORKER_KEY_PREFIX:-pimox}"
local accept_routes="${LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES:-true}" local accept_routes="${LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES:-false}"
local pod_egress_snat="${LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT:-true}" local pod_egress_snat="${LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT:-true}"
local keys=() local keys=()
local key local key