2.4 KiB
Legacy IPMI browser
Argo Application oldipmi deploys the independent published oldipmi chart into
namespace oldimpi (intentional spelling). Its chart targetRevision is the
single selected version. Chart source: https://code.brunner.ninja/feedc0de/oldipmi
Open https://oldipmi.brunner.ninja. Traefik uses its existing wildcard TLS
certificate and the namespace's Authentik forward-auth middleware for every
browser asset and WebSocket handshake. The Old IPMI application is restricted
to authentik Admins by the blueprint in apps/authentik/values.yaml.
The existing shared /outpost.goauthentik.io/ route handles login callbacks.
As with Kubernetes Dashboard, the proxy provider is attached additively to the
embedded Authentik outpost, preserving all its other providers. Recovery: apply
the blueprint, then add Old IPMI to that outpost through Authentik's admin UI.
Cloudflare DNS: unproxied CNAME oldipmi.brunner.ninja → brunner.ninja, following
the existing admin service domains. DNS is account-managed outside Argo CD.
The chart's namespace-wide NetworkPolicy admits only Traefik pods on the web
port. Cilium allows external destinations, including Internet, 192.168.0.0/16
and Funkfeuer 10.12.0.0/16, but explicitly denies cluster/node/API identities,
ServiceCIDR, link-local metadata, MetalLB's pool, and the cluster's Funkfeuer
service address. Public resolvers and no Kubernetes search domains prevent
ordinary .svc.cluster.local discovery. This is not a domain-name firewall;
IP policy enforces the boundary even if a name resolves to a cluster IP.
Public ingress URLs remain reachable. Keep the explicit service/MetalLB
exclusions aligned with platform range changes; pod/node exclusions follow
Cilium identities automatically. Cilium policy must reconcile before startup.
This is one shared disposable browser session. BMC passwords, downloads and sessions are not persisted or backed up. Log out of the BMC after use. A pod replacement resets the desktop. No existing PVCs or legacy cluster writer are involved. The user's local Podman session is left intact for comparison.
Verification: check Argo Synced/Healthy, non-root/zero-capability runtime, HTTP and WebSocket authentication redirects, admin policy/outpost membership, external connectivity and denied pod/node/Service/LoadBalancer destinations. Actual hardware KVM verification requires identifying the BMC and logging in.