0a861d9144
Before this, ANY pod in the k3s cluster could read tidalDB's :9091 metrics - corpus size, seqnos, leader identity, all unauthenticated - and reach the peer gRPC plane. Measured, not assumed: scraping tidaldb-0:9091 from gitea-0 in namespace threesix returned metrics, and returns "connection refused" after this. NetworkPolicy enforcement on this k3s is therefore confirmed, not presumed. Ingress only. Egress is left unrestricted deliberately - the WAL-archival/S3 and peer dial-out surfaces are not fully enumerated, and a wrong egress rule partitions the cluster instead of merely blocking a scrape. :9500 stays open, and the file records why. All three probes (startup, readiness, liveness) target it, probes come from the NODE rather than a pod, and node-to-pod handling is CNI-specific - a wrong rule there fails liveness at 6x10s and restarts every pod. The exposure that would have closed is /cluster/status, which is unauthenticated by design. That is an engine defect and gets fixed in tidal-server, not worked around at the network layer. Verified after apply: scraper still collects 353 tidaldb_ series, a quorum-acked write through the public ingress returns 201, and all three regions report applied=13322229 lag=0 reachable partitioned=false with zero new restarts.
41 lines
1.4 KiB
YAML
41 lines
1.4 KiB
YAML
# tidalDB CLUSTER deployment (m11p5 §4). Apply with:
|
|
# kubectl apply -k k8s/cluster/
|
|
#
|
|
# MUTUALLY EXCLUSIVE with the standalone set (k8s/, namespace `tidaldb`). This
|
|
# set lives in namespace `tidaldb-cluster`. Deploy ONE or the OTHER per
|
|
# namespace — never both (they share the StatefulSet name `tidaldb` and the
|
|
# standalone set's replicas:1 is load-bearing).
|
|
#
|
|
# Create the credentials secret FIRST (deliberately excluded so no key is
|
|
# committed — see secret.example.yaml). m11p7 shape carries BOTH the bearer and
|
|
# the cluster key:
|
|
# kubectl -n tidaldb-cluster create secret generic tidaldb-credentials \
|
|
# --from-literal=TIDAL_API_KEY="$(openssl rand -hex 32)" \
|
|
# --from-literal=TIDAL_CLUSTER_KEY="$(openssl rand -hex 32)"
|
|
#
|
|
# certs.yaml (m11p7 inter-node TLS) requires cert-manager. If you do NOT run
|
|
# cert-manager, comment certs.yaml out and provision the `tidaldb-cluster-tls`
|
|
# Secret with scripts/gen-cluster-certs.sh instead.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: tidaldb-cluster
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- schema-configmap.yaml
|
|
- topology-configmap.yaml
|
|
- certs.yaml
|
|
- service-peers.yaml
|
|
- service-client.yaml
|
|
- statefulset.yaml
|
|
- poddisruptionbudget.yaml
|
|
- networkpolicy.yaml
|
|
# Public exposure (Traefik + Let's Encrypt). Remove for internal-only.
|
|
- ingress.yaml
|
|
|
|
labels:
|
|
- pairs:
|
|
app.kubernetes.io/part-of: tidaldb
|
|
includeSelectors: false
|