jv
/
my-homelab-configs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Disable worker Tailscale route acceptance by default

This commit is contained in:
juvdiaz 2026-06-29 23:12:56 -06:00
parent f2fe545471
commit 00cfff3ae7
4 changed files with 24 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
README.md
View File

@ -212,13 +212,17 @@ tofu -chdir=bootstrap/cluster apply \
-var-file="$PWD/.lab/cluster-workers.auto.tfvars.json"
```
Worker Tailscale defaults to `--accept-routes=true` and enables pod egress SNAT
from the Kubernetes pod CIDR to `tailscale0`, so pods on Pimox workers can reach
tailnet-only services. Override with
`LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=false` or
`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when that behavior is not
wanted. `./jeannie doctor-cluster` checks Pimox worker tailnet egress
against `${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and
Worker Tailscale defaults to `--accept-routes=false` because these VMs already
live on the homelab LAN; accepting an advertised `192.168.100.0/24` route can
steal their local LAN route and break SSH or MetalLB traffic. Pod egress SNAT
from the Kubernetes pod CIDR to `tailscale0` stays enabled, so pods on Pimox
workers can reach tailnet-only services. Set
`LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=true` only when the worker must consume
tailnet-advertised routes that do not overlap the local LAN. Set
`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when pod egress through
`tailscale0` is not wanted. `./jeannie doctor-cluster` checks Pimox
worker tailnet egress against
`${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and
`${LAB_PIMOX_WORKER_TAILNET_PROBE_PORT:-LAB_GITEA_HTTP_PORT}`.
OpenWrt firewall VM automation is available as a standalone command because it

18
README.md.tmpl
View File

@ -212,13 +212,17 @@ tofu -chdir=bootstrap/cluster apply \
-var-file="$PWD/.lab/cluster-workers.auto.tfvars.json"
```
Worker Tailscale defaults to `--accept-routes=true` and enables pod egress SNAT
from the Kubernetes pod CIDR to `tailscale0`, so pods on Pimox workers can reach
tailnet-only services. Override with
`LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=false` or
`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when that behavior is not
wanted. `./{{ main_script }} doctor-cluster` checks Pimox worker tailnet egress
against `${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and
Worker Tailscale defaults to `--accept-routes=false` because these VMs already
live on the homelab LAN; accepting an advertised `192.168.100.0/24` route can
steal their local LAN route and break SSH or MetalLB traffic. Pod egress SNAT
from the Kubernetes pod CIDR to `tailscale0` stays enabled, so pods on Pimox
workers can reach tailnet-only services. Set
`LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES=true` only when the worker must consume
tailnet-advertised routes that do not overlap the local LAN. Set
`LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT=false` when pod egress through
`tailscale0` is not wanted. `./{{ main_script }} doctor-cluster` checks Pimox
worker tailnet egress against
`${LAB_PIMOX_WORKER_TAILNET_PROBE_HOST:-LAB_DEBIAN_TAILSCALE_IP}` and
`${LAB_PIMOX_WORKER_TAILNET_PROBE_PORT:-LAB_GITEA_HTTP_PORT}`.
OpenWrt firewall VM automation is available as a standalone command because it

2
bootstrap/cluster/variables.tf
View File

@ -86,7 +86,7 @@ variable "worker_tailscale_enabled" {
variable "worker_tailscale_accept_routes" {
type = bool
default = true
default = false
}
variable "worker_tailscale_pod_egress_snat" {

2
scripts/workers
View File

@ -208,7 +208,7 @@ tailnet_setup() {
local var_file="${LAB_CLUSTER_VAR_FILE:-${REPO_ROOT}/.lab/cluster-workers.auto.tfvars.json}"
local auth_key_file="${LAB_PIMOX_WORKER_TAILSCALE_AUTH_KEY_FILE:-${HOME}/.config/homelab/tailscale-pimox-worker.authkey}"
local worker_key_prefix="${LAB_PIMOX_WORKER_KEY_PREFIX:-pimox}"
local accept_routes="${LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES:-true}"
local accept_routes="${LAB_PIMOX_WORKER_TAILSCALE_ACCEPT_ROUTES:-false}"
local pod_egress_snat="${LAB_PIMOX_WORKER_TAILSCALE_POD_EGRESS_SNAT:-true}"
local keys=()
local key