Skip to content

Restrict K8s API firewall to VPC + Tailscale only #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cmyui merged 1 commit into from
Jan 13, 2026
Merged

Restrict K8s API firewall to VPC + Tailscale only #37

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions tf/digitalocean.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,13 +134,13 @@ resource "digitalocean_firewall" "k8s-master-firewall" {
source_addresses = [var.tailscale_ipv4_range]
}

# Kubernetes API - open for now (GitHub Actions has 4000+ dynamic IPs)
# TODO: Consider self-hosted runners in VPC to restrict this
# Security: K8s API requires valid client certs, so exposure is low risk
# Kubernetes API - VPC + Tailscale only
# GitHub Actions uses self-hosted runners in VPC
# Admin access via Tailscale
inbound_rule {
protocol = "tcp"
port_range = "6443"
source_addresses = ["0.0.0.0/0", "::/0"]
source_addresses = [digitalocean_vpc.akatsuki-production-vpc.ip_range, var.tailscale_ipv4_range]
}

# etcd - VPC only (cluster-internal)
Expand Down