Ryan Yin d4aa25d368 fix(k3s): deny pod sources the etcd client port 2379 ...

The etcd client API listens on the masters' static LAN address, and the
pod-source deny lists omitted it. Add 2379 to both nft drop lines and
assert it in the security-k3s-pod-firewall eval test. 2381 (etcd
metrics, scraped by in-cluster monitoring) stays reachable by design.

Pairs with the matching Cilium egressDeny port in k8s-gitops.

Assisted-by: DeepSeek Harness (gpt-6-astra)

2026-10-24 14:16:14 +08:00

..

nixos-tests

chore(docs): prune stale TODOs (#370)

2026-10-03 17:50:28 +08:00

src

feat(aquamarine): revive aquamarine as a two-GPU inference host

2026-10-14 20:15:01 +08:00

tests

fix(k3s): deny pod sources the etcd client port 2379

2026-10-24 14:16:14 +08:00

default.nix

fix(colmena): deploy the systems nixosConfigurations evaluates

2026-10-21 20:59:07 +08:00