From 9be970869ca730c6316288524ea02f4046710255 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 09:40:04 +0000 Subject: [PATCH] fix(contabo): open inbound kubelet 10250 in ufw so metrics-server can scrape the control-plane MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit metrics-server runs on a worker (vmi3396106) and dials each kubelet directly at :10250 — it does NOT use k3s's 6443 tunnel. vps.tf's cloud-init opened 22/6443/8472/51820 but deliberately omitted 10250 on the wrong premise that "no inbound 10250 is needed", so ufw default-denied the scrape and `kubectl top node vmi3383846` returned (issue #318). Node reported Ready with no pressure — this was a firewall drop, not node death. Adds `ufw allow 10250/tcp` as the rebuild bootstrap default (mirrors 8472's Anywhere-then-scope pattern) and corrects the comment. Live prod node already patched out-of-band with node-IP-scoped rules (95.111.238.66 / 185.2.103.122 / 194.163.136.242); `kubectl top node vmi3383846` now returns real metrics. Co-authored-by: Israel Weinberg <99821070+izzywdev@users.noreply.github.com> --- terraform/contabo/vps.tf | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/terraform/contabo/vps.tf b/terraform/contabo/vps.tf index c3838e09..6e780e77 100644 --- a/terraform/contabo/vps.tf +++ b/terraform/contabo/vps.tf @@ -24,11 +24,16 @@ resource "contabo_instance" "prod" { # the Cloudflare Named Tunnel (outbound-only from cloudflared). # 8472/udp = Flannel VXLAN overlay — required for cross-node pod networking # once worker nodes join (the server must accept inbound VXLAN from agents, or - # worker pods can't reach control-plane services). kubelet (10250) is NOT - # opened: k3s tunnels agent kubelets over the outbound 6443 connection, so no - # inbound 10250 is needed and exposing it would be an unnecessary risk. - # 8472 Anywhere here is a rebuild bootstrap default; the live runtime rule is - # scoped to node IPs (durable fix: wireguard-native overlay / private VLAN). + # worker pods can't reach control-plane services). + # 10250/tcp = kubelet read-only/authenticated API. It IS needed inbound: + # metrics-server runs OFF the control-plane (on a worker) and dials each + # kubelet directly at :10250 — it does NOT ride k3s's 6443 tunnel + # (that tunnel only backs apiserver→kubelet proxying for logs/exec, not the + # metrics scrape). Without this rule, `kubectl top node vmi3383846` returns + # and HPA/scheduling signals for this node go dark (issue #318). + # 8472 and 10250 Anywhere here are rebuild bootstrap defaults; the live runtime + # rules are scoped to node IPs (durable fix: wireguard-native overlay / private + # VLAN). See ufw allows below. # 51820/udp = Flannel WireGuard-native overlay (see provisioning.tf for the # --flannel-backend=wireguard-native install flag). Opened ALONGSIDE 8472/udp # during the transition: the flag is inert on the already-running prod @@ -39,6 +44,7 @@ resource "contabo_instance" "prod" { - ufw allow 22/tcp - ufw allow 6443/tcp - ufw allow 8472/udp + - ufw allow 10250/tcp - ufw allow 51820/udp - ufw --force enable EOT