Allow trusted LAN to scrape unauthenticated etcd metrics

cluster-config/kubeadm-monitoring/README.md

@@ -13,9 +13,12 @@ static-pod manifest.
 
 The controller-manager and scheduler metrics endpoints use authenticated HTTPS.
 Etcd's separate port 2381 is unauthenticated, so the systemd-managed firewall
-restricts access to localhost and the six Odroid node addresses. Prometheus is
+restricts access to localhost and the trusted LAN (`192.168.0.0/24`). Prometheus is
 currently scheduled on an Odroid node, and Cilium masquerades pod-to-node
 connections to that node's address.
 
+DHCP address changes within that LAN do not require firewall updates. Other
+networks remain blocked from the unauthenticated endpoint.
+
 When adding control-plane nodes, apply the same kubeadm component arguments and
-update the firewall allowlist for the worker node addresses.
+firewall policy.

cluster-config/kubeadm-monitoring/kubernetes-metrics-firewall

@@ -16,12 +16,7 @@ case "${1:-start}" in
         iptables -F "$chain"
 
         iptables -A "$chain" -s 127.0.0.0/8 -j ACCEPT
-        iptables -A "$chain" -s 192.168.0.157/32 -j ACCEPT
-        iptables -A "$chain" -s 192.168.0.141/32 -j ACCEPT
-        iptables -A "$chain" -s 192.168.0.74/32 -j ACCEPT
-        iptables -A "$chain" -s 192.168.0.58/32 -j ACCEPT
-        iptables -A "$chain" -s 192.168.0.147/32 -j ACCEPT
-        iptables -A "$chain" -s 192.168.0.144/32 -j ACCEPT
+        iptables -A "$chain" -s 192.168.0.0/24 -j ACCEPT
         iptables -A "$chain" -p tcp -j REJECT --reject-with tcp-reset
 
         remove_jump