From a5f19aefd4727c6d55b9dd15063f0661420299a0 Mon Sep 17 00:00:00 2001 From: 0xFEEDC0DE64 Date: Sun, 1 Nov 2026 11:07:55 +0100 Subject: [PATCH] Allow trusted LAN to scrape unauthenticated etcd metrics --- cluster-config/kubeadm-monitoring/README.md | 7 +++++-- .../kubeadm-monitoring/kubernetes-metrics-firewall | 7 +------ 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/cluster-config/kubeadm-monitoring/README.md b/cluster-config/kubeadm-monitoring/README.md index a49e45c..6d688ef 100644 --- a/cluster-config/kubeadm-monitoring/README.md +++ b/cluster-config/kubeadm-monitoring/README.md @@ -13,9 +13,12 @@ static-pod manifest. The controller-manager and scheduler metrics endpoints use authenticated HTTPS. Etcd's separate port 2381 is unauthenticated, so the systemd-managed firewall -restricts access to localhost and the six Odroid node addresses. Prometheus is +restricts access to localhost and the trusted LAN (`192.168.0.0/24`). Prometheus is currently scheduled on an Odroid node, and Cilium masquerades pod-to-node connections to that node's address. +DHCP address changes within that LAN do not require firewall updates. Other +networks remain blocked from the unauthenticated endpoint. + When adding control-plane nodes, apply the same kubeadm component arguments and -update the firewall allowlist for the worker node addresses. +firewall policy. diff --git a/cluster-config/kubeadm-monitoring/kubernetes-metrics-firewall b/cluster-config/kubeadm-monitoring/kubernetes-metrics-firewall index 7913295..55a83ad 100755 --- a/cluster-config/kubeadm-monitoring/kubernetes-metrics-firewall +++ b/cluster-config/kubeadm-monitoring/kubernetes-metrics-firewall @@ -16,12 +16,7 @@ case "${1:-start}" in iptables -F "$chain" iptables -A "$chain" -s 127.0.0.0/8 -j ACCEPT - iptables -A "$chain" -s 192.168.0.157/32 -j ACCEPT - iptables -A "$chain" -s 192.168.0.141/32 -j ACCEPT - iptables -A "$chain" -s 192.168.0.74/32 -j ACCEPT - iptables -A "$chain" -s 192.168.0.58/32 -j ACCEPT - iptables -A "$chain" -s 192.168.0.147/32 -j ACCEPT - iptables -A "$chain" -s 192.168.0.144/32 -j ACCEPT + iptables -A "$chain" -s 192.168.0.0/24 -j ACCEPT iptables -A "$chain" -p tcp -j REJECT --reject-with tcp-reset remove_jump