From d83735b3e3fb54525835de76a2c18e9d8a65c9cc Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 27 Sep 2026 00:29:25 +1000 Subject: [PATCH] Expose gocache over PureLB instead of ClusterIP A ClusterIP is only reachable via kubectl port-forward, which needs a create grant on pods/portforward that the read-only operator context does not have; laptops reach the cache over wireguard. - Publish the Service as a LoadBalancer on 198.18.200.11 in the common pool - Set externalTrafficPolicy Local so the client IP survives to the nginx allow rules, matching the bind LoadBalancers --- apps/base/woodpecker/configmap_gocache-nginx.yaml | 2 ++ apps/base/woodpecker/service_gocache.yaml | 8 +++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/apps/base/woodpecker/configmap_gocache-nginx.yaml b/apps/base/woodpecker/configmap_gocache-nginx.yaml index 2c7fe91..ca1eaeb 100644 --- a/apps/base/woodpecker/configmap_gocache-nginx.yaml +++ b/apps/base/woodpecker/configmap_gocache-nginx.yaml @@ -24,6 +24,8 @@ data: # The protocol has no authentication: anyone who can reach this port can # write cache entries, which become code in every build that reads them. + # Loopback is the kubectl port-forward fallback; in a pod netns it is + # only these two containers. allow 127.0.0.1/32; allow 10.10.12.200/32; allow 10.42.0.0/16; diff --git a/apps/base/woodpecker/service_gocache.yaml b/apps/base/woodpecker/service_gocache.yaml index cd51221..7cf0d7e 100644 --- a/apps/base/woodpecker/service_gocache.yaml +++ b/apps/base/woodpecker/service_gocache.yaml @@ -4,10 +4,16 @@ kind: Service metadata: name: gocache namespace: woodpecker + annotations: + purelb.io/addresses: 198.18.200.11 + purelb.io/service-group: common labels: app.kubernetes.io/name: gocache spec: - type: ClusterIP + type: LoadBalancer + # Cluster SNATs off-node traffic to a node address, which would defeat the + # nginx allow rules; Local preserves the wireguard client IP. + externalTrafficPolicy: Local selector: app.kubernetes.io/name: gocache ports: