63 lines
3.7 KiB
Markdown
63 lines
3.7 KiB
Markdown
# Legacy IPMI browser
|
|
|
|
Argo Application `oldipmi` deploys the independent published `oldipmi` chart into
|
|
namespace **oldimpi** (intentional spelling). Its chart targetRevision is the
|
|
single selected version. Chart source: https://code.brunner.ninja/feedc0de/oldipmi
|
|
|
|
Open https://oldipmi.brunner.ninja. Traefik uses its existing wildcard TLS
|
|
certificate and the namespace's Authentik forward-auth middleware for every
|
|
browser asset and WebSocket handshake. The `Old IPMI` application is restricted
|
|
to `authentik Admins` by the blueprint in `apps/authentik/values.yaml`.
|
|
The existing shared `/outpost.goauthentik.io/` route handles login callbacks.
|
|
As with Kubernetes Dashboard, the proxy provider is attached additively to the
|
|
embedded Authentik outpost, preserving all its other providers. Recovery: apply
|
|
the blueprint, then add `Old IPMI` to that outpost through Authentik's admin UI.
|
|
|
|
Cloudflare DNS: unproxied CNAME `oldipmi.brunner.ninja` → `brunner.ninja`, following
|
|
the existing admin service domains. DNS is account-managed outside Argo CD.
|
|
|
|
The chart's namespace-wide NetworkPolicy admits only Traefik pods on the web
|
|
port. Cilium allows external destinations, including Internet, 192.168.0.0/16
|
|
and Funkfeuer 10.12.0.0/16, but explicitly denies cluster/node/API identities,
|
|
ServiceCIDR, link-local metadata, MetalLB's pool, and the cluster's Funkfeuer
|
|
service address. Public resolvers and no Kubernetes search domains prevent
|
|
ordinary `.svc.cluster.local` discovery. This is not a domain-name firewall;
|
|
IP policy enforces the boundary even if a name resolves to a cluster IP.
|
|
Public ingress URLs remain reachable. Keep the explicit service/MetalLB
|
|
exclusions aligned with platform range changes; pod/node exclusions follow
|
|
Cilium identities automatically. Cilium policy must reconcile before startup.
|
|
|
|
This is one shared disposable browser session. BMC passwords, downloads and
|
|
sessions are not persisted or backed up. Log out of the BMC after use. A pod
|
|
replacement resets the desktop. No existing PVCs or legacy cluster writer are
|
|
involved. The user's local Podman session is left intact for comparison.
|
|
|
|
Verification: check Argo Synced/Healthy, non-root/zero-capability runtime,
|
|
HTTP and WebSocket authentication redirects, admin policy/outpost membership,
|
|
external connectivity and denied pod/node/Service/LoadBalancer destinations.
|
|
Actual hardware KVM verification requires identifying the BMC and logging in.
|
|
|
|
## Verified deployment
|
|
|
|
On 2026-10-31, CI passed the rendered security checks and the Podman
|
|
HTTP/WebSocket/RFB runtime test, published the chart anonymously, and promoted
|
|
its version through GitOps. Argo reached Synced/Healthy with zero pod restarts.
|
|
The browser ran as UID 1000 with CapEff=0, NoNewPrivs=1 and seccomp mode 2;
|
|
no service-account token or persistent volume was present.
|
|
|
|
Unauthenticated page, asset and WebSocket requests redirected to Authentik,
|
|
including a request with forged Authentik identity headers. The provider's only
|
|
group binding was `authentik Admins`. Traefik could fetch the backend; an
|
|
unrelated Authentik pod could not connect directly to its web port.
|
|
|
|
The browser reached public DNS, Internet HTTPS, LAN Victron (192.168.0.169)
|
|
and Funkfeuer (10.12.4.172 HTTP/SSH). Connections to the Kubernetes API Service,
|
|
API node, its own node SSH, an Authentik pod, the Traefik MetalLB address, and
|
|
the cluster's Funkfeuer service address timed out. Kubernetes local names did
|
|
not resolve. A real WebSocket upgrade returned the VNC RFB protocol handshake.
|
|
No BMC login or physical server KVM session was tested: its address is unknown.
|
|
|
|
Archival: NOT APPLICABLE. The source was a standalone local Podman command,
|
|
with no legacy deployment repository. The new chart repository is retained
|
|
because it owns the deployment contract and publication pipeline.
|