From 69d880186a03405cfab7c66a29a059a966520f27 Mon Sep 17 00:00:00 2001 From: Nik Afiq Date: Sat, 25 Jul 2026 00:05:54 +0900 Subject: [PATCH] fix: open Flannel/K3s ports in gpu-node's UFW rules host_vars/gpu-node.yaml's ufw_allowed_ports has overridden (not extended) the common role's default list since the node was added, silently dropping the Flannel VXLAN (8472/udp), K3s API (6443/tcp), and Kubelet (10250/tcp) rules every other node gets. Went unnoticed because kubectl logs/exec/stats tunnel through the agent's outbound connection to the k3s server rather than needing a direct inbound path - but real pod dataplane traffic (e.g. tts-gateway on nik-gpu resolving DNS against CoreDNS on nik-debian) needs actual VXLAN connectivity and was blackholing. Co-Authored-By: Claude Sonnet 5 --- ansible/host_vars/gpu-node.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ansible/host_vars/gpu-node.yaml b/ansible/host_vars/gpu-node.yaml index 2c8b52f..25e72bd 100644 --- a/ansible/host_vars/gpu-node.yaml +++ b/ansible/host_vars/gpu-node.yaml @@ -20,6 +20,15 @@ ufw_allowed_ports: - { port: "430", proto: tcp, comment: "SSH" } - { port: "11434", proto: tcp, comment: "Ollama API" } - { port: "61208", proto: tcp, comment: "Glances web UI" } + # host_vars replaces (not merges) the common role's ufw_allowed_ports + # default, so the K3s/flannel ports below must be repeated here - without + # them, cross-node pod traffic (e.g. DNS to CoreDNS on nik-debian) blackholes + # even though kubectl logs/exec/stats still work (those tunnel through the + # agent's outbound connection to the k3s server on 6443, not a direct + # inbound connection). + - { port: "6443", proto: tcp, comment: "K3s API server" } + - { port: "10250", proto: tcp, comment: "Kubelet" } + - { port: "8472", proto: udp, comment: "Flannel VXLAN" } data_dirs: - /data/tts-gateway