kubernetes-deploy — Project Status

kubernetes-deploy

Last updated 2026-07-21

1 Issues 24 Pending

Nodes

○ bridge: jane-bridge:0.1.16 (with jane-opencode:0.1.16 sidecar)
○ pwa: jane-pwa:0.1.16
○ speech: jane-speech:0.1.16
○ nats: nats:2.14.2-alpine
report-server: beingyash/report-server:v0.1.1 + git-sync:v4.2.1

○ Worker node oracle-cp had abysmallab.in in its DNS search domains from Tailscale MagicDNS.
○ *.abysmallab.in wildcard resolves to oracle-cp itself (140.238.165.62).
○ With ndots:5, pod queries like github.com were suffixed to github.com.abysmallab.in, resolving back to the worker node.
✗ This caused both tls: internal error (HTTPS) and knownhosts: key mismatch (SSH) because connections were hitting local Caddy/Traefik instead of GitHub.
○ Control-plane node was already protected by resolvConf: /etc/resolv.clean.conf in kubelet config; worker node was using /run/systemd/resolve/resolv.conf.
Fix applied:
○ Created /etc/resolv.clean.conf on oracle-cp with only nameserver 127.0.0.53 and no search domains.
○ Updated /var/lib/kubelet/config.yaml on oracle-cp to use resolvConf: /etc/resolv.clean.conf.
○ Restarted kubelet; recreated source-controller pod; switched jane-chart back to SSH URL.
○ Updated ansible/add-worker.yml so future workers get the same clean resolv.conf.

○ Only traefik has LoadBalancer service (EXTERNAL-IP <pending>) — no MetalLB (bare-metal)
○ Traffic reaches node via NodePort: HTTP 32580, HTTPS 32305
### Flux GitRepository — resolved ✓
○ Cause: Tailscale MagicDNS search domain abysmallab.in + wildcard DNS caused pod DNS to resolve github.com back to worker node.
○ Fix: kubelet on worker uses /etc/resolv.clean.conf (no search domains).
### Monitoring — resolved ✓
○ metrics-server: working for both nodes
○ kube-prometheus-stack: 7/7 pods running
○ Grafana at grafana.yash.abysmallab.in
### Cross-node networking — resolved ✓
○ Pod-to-pod across nodes working
○ Routing fix: ip rule 5255 persisted via systemd