A ClusterIP is only reachable via kubectl port-forward, which needs a
create grant on pods/portforward that the read-only operator context does
not have; laptops reach the cache over wireguard.
- Publish the Service as a LoadBalancer on 198.18.200.11 in the common pool
- Set externalTrafficPolicy Local so the client IP survives to the nginx
allow rules, matching the bind LoadBalancers
go-cache-plugin serve binds 127.0.0.1 only, so a Service cannot reach it
directly and CI/developer builds have no way to use the S3-backed cache.
- Run go-cache-plugin serve against the gocache RGW bucket, path-style, with
an explicit region to skip the GetBucketLocation probe
- Add an nginx sidecar stream-proxying 9090 to the loopback plugin port
- Restrict the listener to the workstation and pod CIDRs: GOCACHEPROG is
unauthenticated and a poisoned entry runs in every consuming build
- Stage the cache on an emptyDir; loss costs a repopulate from S3
unkin-agent