From 53d02b7522b3f2150033c037614c8511045836db Mon Sep 17 00:00:00 2001 From: Nik Afiq Date: Sun, 23 Aug 2026 14:07:49 +0900 Subject: [PATCH] feat: configure K3s DNS resolver and update firewall rules for new subnet --- ansible/group_vars/all/k3s.yaml | 10 +++++++++ ansible/host_vars/gpu-node.yaml | 4 ++-- ansible/roles/common/defaults/main.yaml | 4 ++-- ansible/roles/common/tasks/main.yaml | 1 + ansible/roles/k3s-agent/defaults/main.yaml | 3 +++ ansible/roles/k3s-agent/handlers/main.yaml | 9 ++++++++ ansible/roles/k3s-agent/tasks/main.yaml | 24 ++++++++++++++++++++- ansible/roles/k3s-server/defaults/main.yaml | 1 + ansible/roles/k3s-server/handlers/main.yaml | 9 ++++++++ ansible/roles/k3s-server/tasks/main.yaml | 12 ++++++++++- manifests/media/gluetun-proxy.yaml | 2 +- manifests/media/jdownloader.yaml | 2 +- manifests/media/qbittorrent.yaml | 2 +- 13 files changed, 74 insertions(+), 9 deletions(-) create mode 100644 ansible/group_vars/all/k3s.yaml create mode 100644 ansible/roles/k3s-agent/handlers/main.yaml create mode 100644 ansible/roles/k3s-server/handlers/main.yaml diff --git a/ansible/group_vars/all/k3s.yaml b/ansible/group_vars/all/k3s.yaml new file mode 100644 index 0000000..ee9e5c4 --- /dev/null +++ b/ansible/group_vars/all/k3s.yaml @@ -0,0 +1,10 @@ +--- +# Vars for: K3s cluster-wide DNS resolver +# Applied by: ansible/roles/k3s-server, ansible/roles/k3s-agent +# Description: Single source of truth for the resolver IP written into +# /etc/rancher/k3s/resolv.conf on every K3s node, so CoreDNS's +# "forward . /etc/resolv.conf" always reaches Technitium regardless of +# which node CoreDNS is scheduled on, or that node's own (possibly stale) +# host resolvers. + +k3s_dns_resolver: 10.10.40.53 diff --git a/ansible/host_vars/gpu-node.yaml b/ansible/host_vars/gpu-node.yaml index 92cec75..7d3c31d 100644 --- a/ansible/host_vars/gpu-node.yaml +++ b/ansible/host_vars/gpu-node.yaml @@ -27,8 +27,8 @@ ufw_allowed_ports: # agent's outbound connection to the k3s server on 6443, not a direct # inbound connection). - { port: "6443", proto: tcp, comment: "K3s API server" } - - { port: "10250", proto: tcp, comment: "Kubelet" } - - { port: "8472", proto: udp, comment: "Flannel VXLAN" } + - { port: "10250", proto: tcp, comment: "Kubelet", src: "10.10.40.0/24" } + - { port: "8472", proto: udp, comment: "Flannel VXLAN", src: "10.10.40.0/24" } data_dirs: - /data/tts-gateway diff --git a/ansible/roles/common/defaults/main.yaml b/ansible/roles/common/defaults/main.yaml index 2383cca..87b4ff9 100644 --- a/ansible/roles/common/defaults/main.yaml +++ b/ansible/roles/common/defaults/main.yaml @@ -23,8 +23,8 @@ ufw_allowed_ports: - { port: 80, proto: tcp, comment: HTTP } - { port: 443, proto: tcp, comment: HTTPS } - { port: 6443, proto: tcp, comment: K3s API server } - - { port: 10250, proto: tcp, comment: Kubelet } - - { port: 8472, proto: udp, comment: Flannel VXLAN } + - { port: 10250, proto: tcp, comment: Kubelet, src: 10.10.40.0/24 } + - { port: 8472, proto: udp, comment: Flannel VXLAN, src: 10.10.40.0/24 } data_dirs: - /data/gitea diff --git a/ansible/roles/common/tasks/main.yaml b/ansible/roles/common/tasks/main.yaml index e3eff0f..fb30b5a 100644 --- a/ansible/roles/common/tasks/main.yaml +++ b/ansible/roles/common/tasks/main.yaml @@ -60,6 +60,7 @@ rule: allow port: "{{ item.port }}" proto: "{{ item.proto }}" + src: "{{ item.src | default('any') }}" comment: "{{ item.comment }}" loop: "{{ ufw_allowed_ports }}" diff --git a/ansible/roles/k3s-agent/defaults/main.yaml b/ansible/roles/k3s-agent/defaults/main.yaml index edf9d2c..b42c66e 100644 --- a/ansible/roles/k3s-agent/defaults/main.yaml +++ b/ansible/roles/k3s-agent/defaults/main.yaml @@ -6,3 +6,6 @@ k3s_version: v1.32.4+k3s1 k3s_server_url: https://10.10.40.53:6443 k3s_node_token: "" + +k3s_agent_config: + resolv-conf: /etc/rancher/k3s/resolv.conf diff --git a/ansible/roles/k3s-agent/handlers/main.yaml b/ansible/roles/k3s-agent/handlers/main.yaml new file mode 100644 index 0000000..525a949 --- /dev/null +++ b/ansible/roles/k3s-agent/handlers/main.yaml @@ -0,0 +1,9 @@ +--- +# Part of role: k3s-agent +# Called by: ansible/roles/k3s-agent/tasks/main.yaml +# Description: Restarts the K3s agent when its config.yaml or resolv.conf changes. + +- name: Restart k3s-agent + ansible.builtin.service: + name: k3s-agent + state: restarted diff --git a/ansible/roles/k3s-agent/tasks/main.yaml b/ansible/roles/k3s-agent/tasks/main.yaml index 47bbd4d..65302d2 100644 --- a/ansible/roles/k3s-agent/tasks/main.yaml +++ b/ansible/roles/k3s-agent/tasks/main.yaml @@ -2,7 +2,29 @@ # Part of role: k3s-agent # Called by: ansible/playbooks/join-debian-agent.yaml # ansible/playbooks/setup-gpu-node.yaml -# Description: Installs K3s in agent mode, joins the cluster, labels and taints the node. +# Description: Configures the K3s agent's DNS resolver, installs K3s in agent mode, joins the cluster, labels and taints the node. + +- name: Create K3s config directory + ansible.builtin.file: + path: /etc/rancher/k3s + state: directory + mode: "0755" + +- name: Write K3s agent config + ansible.builtin.copy: + dest: /etc/rancher/k3s/config.yaml + content: "{{ k3s_agent_config | to_nice_yaml }}" + mode: "0644" + notify: Restart k3s-agent + +- name: Write K3s DNS resolver file + ansible.builtin.copy: + dest: /etc/rancher/k3s/resolv.conf + content: "nameserver {{ k3s_dns_resolver }}\n" + owner: root + group: root + mode: "0644" + notify: Restart k3s-agent - name: Download and install K3s agent ansible.builtin.shell: diff --git a/ansible/roles/k3s-server/defaults/main.yaml b/ansible/roles/k3s-server/defaults/main.yaml index 02d3399..215411c 100644 --- a/ansible/roles/k3s-server/defaults/main.yaml +++ b/ansible/roles/k3s-server/defaults/main.yaml @@ -11,6 +11,7 @@ k3s_server_config: - traefik flannel-backend: vxlan node-ip: "{{ k3s_server_ip }}" + resolv-conf: /etc/rancher/k3s/resolv.conf tls-san: - "{{ k3s_server_ip }}" - minisforum diff --git a/ansible/roles/k3s-server/handlers/main.yaml b/ansible/roles/k3s-server/handlers/main.yaml new file mode 100644 index 0000000..84cb591 --- /dev/null +++ b/ansible/roles/k3s-server/handlers/main.yaml @@ -0,0 +1,9 @@ +--- +# Part of role: k3s-server +# Called by: ansible/roles/k3s-server/tasks/main.yaml +# Description: Restarts K3s when its config.yaml or resolv.conf changes. + +- name: Restart k3s + ansible.builtin.service: + name: k3s + state: restarted diff --git a/ansible/roles/k3s-server/tasks/main.yaml b/ansible/roles/k3s-server/tasks/main.yaml index ce7417e..8c64463 100644 --- a/ansible/roles/k3s-server/tasks/main.yaml +++ b/ansible/roles/k3s-server/tasks/main.yaml @@ -1,7 +1,7 @@ --- # Part of role: k3s-server # Called by: ansible/playbooks/setup-k3s.yaml -# Description: Installs K3s server, fetches kubeconfig, installs Helm, and labels the node as primary. +# Description: Installs K3s server, configures its DNS resolver, fetches kubeconfig, installs Helm, and labels the node as primary. - name: Create K3s config directory ansible.builtin.file: @@ -14,6 +14,16 @@ dest: /etc/rancher/k3s/config.yaml content: "{{ k3s_server_config | to_nice_yaml }}" mode: "0644" + notify: Restart k3s + +- name: Write K3s DNS resolver file + ansible.builtin.copy: + dest: /etc/rancher/k3s/resolv.conf + content: "nameserver {{ k3s_dns_resolver }}\n" + owner: root + group: root + mode: "0644" + notify: Restart k3s - name: Download and install K3s ansible.builtin.shell: diff --git a/manifests/media/gluetun-proxy.yaml b/manifests/media/gluetun-proxy.yaml index 7b2940c..7e85cd4 100644 --- a/manifests/media/gluetun-proxy.yaml +++ b/manifests/media/gluetun-proxy.yaml @@ -49,7 +49,7 @@ spec: - name: HTTPPROXY_LOG value: "off" - name: FIREWALL_OUTBOUND_SUBNETS - value: "10.42.0.0/16,10.43.0.0/16,192.168.7.0/24" + value: "10.42.0.0/16,10.43.0.0/16,10.10.40.0/24" - name: BLOCK_IPV6 value: "on" ports: diff --git a/manifests/media/jdownloader.yaml b/manifests/media/jdownloader.yaml index ea08179..6528208 100644 --- a/manifests/media/jdownloader.yaml +++ b/manifests/media/jdownloader.yaml @@ -46,7 +46,7 @@ spec: name: pia-credentials key: OPENVPN_PASSWORD - name: FIREWALL_OUTBOUND_SUBNETS - value: "10.42.0.0/16,10.43.0.0/16,192.168.7.0/24" + value: "10.42.0.0/16,10.43.0.0/16,10.10.40.0/24" - name: BLOCK_IPV6 value: "on" startupProbe: diff --git a/manifests/media/qbittorrent.yaml b/manifests/media/qbittorrent.yaml index 6af8d63..531e4ea 100644 --- a/manifests/media/qbittorrent.yaml +++ b/manifests/media/qbittorrent.yaml @@ -65,7 +65,7 @@ spec: name: pia-credentials key: OPENVPN_PASSWORD - name: FIREWALL_OUTBOUND_SUBNETS - value: "10.42.0.0/16,10.43.0.0/16,192.168.7.0/24" + value: "10.42.0.0/16,10.43.0.0/16,10.10.40.0/24" - name: BLOCK_IPV6 value: "on" startupProbe: