From 242c607ce610516121b9ffe5e0f47e1edad8bc8e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?ryan4yin=20=7C=20=E4=BA=8C=E8=8A=B1?= Date: Mon, 21 Sep 2026 22:28:36 +0800 Subject: [PATCH] feat(k8s): reserve a VIP block and narrow the tailscale routes (#305) Reserve 192.168.5.192/27 as a dedicated kube-vip block, outside the router's DHCP pool (.2-.99): one /29 per cluster, k3s-test-1 gets .192/29 with the API VIP at .193. Advertise only youko itself (.183/32) and that block over Tailscale, instead of the whole /24. The /24 route shadowed hosts that are already reachable directly, e.g. idols-ai at 192.168.5.100. Deploy prerequisites (not in this repo): approve the new Tailscale routes; point kube-vip at the new VIP; move the *.writefor.fun wildcard from .101 to .183 and update scripts/darwin_set_proxy.py, since .101 is no longer advertised. --- hosts/12kingdoms-youko/vpn.nix | 15 ++++++++++++--- vars/networking.nix | 17 +++++++++++++++++ 2 files changed, 29 insertions(+), 3 deletions(-) diff --git a/hosts/12kingdoms-youko/vpn.nix b/hosts/12kingdoms-youko/vpn.nix index 153c19ff..747f5519 100644 --- a/hosts/12kingdoms-youko/vpn.nix +++ b/hosts/12kingdoms-youko/vpn.nix @@ -1,4 +1,11 @@ -{ pkgs, ... }: +{ + pkgs, + myvars, + ... +}: +let + inherit (myvars.networking) hostsAddr k8sVip; +in { environment.systemPackages = [ pkgs.tailscale ]; @@ -11,8 +18,10 @@ useRoutingFeatures = "server"; extraSetFlags = [ - # advertise homelab subnet via tailscale - "--advertise-routes=192.168.5.0/24" + # Advertise only youko itself and the k8s VIP block, not the whole /24: + # a /24 route would shadow hosts that are already reachable directly + # (e.g. idols-ai at 192.168.5.100). + "--advertise-routes=${hostsAddr.youko.ipv4}/32,${k8sVip.cidr}" "--accept-routes=false" ]; }; diff --git a/vars/networking.nix b/vars/networking.nix index 667af484..3ef578ae 100644 --- a/vars/networking.nix +++ b/vars/networking.nix @@ -18,6 +18,23 @@ rec { ]; prefixLength = 24; + # Dedicated VIP block for the k3s clusters, outside the router's DHCP pool + # (.2-.99). One /29 per cluster, handed to kube-vip: the first usable address + # is the control-plane API VIP, the rest are LoadBalancer service VIPs. + k8sVip = { + cidr = "192.168.5.192/27"; + clusters = { + k3s-test-1 = { + cidr = "192.168.5.192/29"; + apiVip = "192.168.5.193"; + }; + # Reserved for future clusters: + # .200/29 apiVip .201 + # .208/29 apiVip .209 + # .216/29 apiVip .217 + }; + }; + hostsAddr = { # ============================================ # Homelab's Physical Machines (VM hosts)