Nik Afiq
939a7c6ed1
Some checks failed
validate / lint (push) Failing after 1s
Adds explicit UFW routed-allow rules (10.42.0.0/16 pod-to-pod, pod-to-Technitium DNS) since these nodes default their routed/FORWARD policy to DROP. Also brings nik-debian's NFS (2049) and SMB (445) ports under Ansible-managed UFW rules via the existing nfs-server role, scoped to the Lab/Trusted networks that need them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
14 lines
680 B
YAML
14 lines
680 B
YAML
---
|
|
# Vars for: K3s cluster-wide DNS resolver and pod network
|
|
# Applied by: ansible/roles/k3s-server, ansible/roles/k3s-agent, ansible/roles/common
|
|
# Description: Single source of truth for the resolver IP written into
|
|
# /etc/rancher/k3s/resolv.conf on every K3s node, so CoreDNS's
|
|
# "forward . /etc/resolv.conf" always reaches Technitium regardless of
|
|
# which node CoreDNS is scheduled on, or that node's own (possibly stale)
|
|
# host resolvers. k3s_pod_cidr backs the routed UFW rules in the common
|
|
# role that allow Flannel pod-to-pod and pod-to-Technitium traffic through
|
|
# each node's routed/FORWARD chain.
|
|
|
|
k3s_dns_resolver: 10.10.40.53
|
|
k3s_pod_cidr: 10.42.0.0/16
|