Fix .deploy kubectl context: target LAN API endpoint, not the flaky tailnet route #25

New issue

Closed

opened 2026-06-06 04:42:17 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-06 04:42:17 +00:00

Owner

Problem

The makefile .deploy runs kubectl apply / rollout status against the kubeconfig's kai-server context, whose server https://kai-server:6443 resolves (MagicDNS) to the tailnet IP 100.69.164.66. From kais-macbook-pro that route is flaky/slow and i/o-timed-out mid-apply during the #23 cutover:

error: ... failed to download openapi: Get "https://kai-server:6443/openapi/v2": dial tcp 100.69.164.66:6443: i/o timeout

The LAN endpoint https://192.168.0.194:6443 is rock-solid from on-LAN hosts and is in the cert SANs (it's what the CI DEPLOY_KUBECONFIG already targets).

Fix

.deploy now targets a configurable k8s-api, defaulting to the LAN endpoint, via kubectl --server=$(k8s-api) (CA + auth still come from the context, and --server was verified to TLS-validate against it):

k8s-api ?= https://192.168.0.194:6443

Override for off-LAN deploys where only the tailnet is reachable:

make deploy k8s-api=https://kai-server:6443

The broader deploy-path items that also surfaced (broken CI pipeline, host prereqs) moved to #26.

## Problem The makefile `.deploy` runs `kubectl apply` / `rollout status` against the kubeconfig's `kai-server` context, whose server `https://kai-server:6443` resolves (MagicDNS) to the **tailnet** IP `100.69.164.66`. From kais-macbook-pro that route is flaky/slow and **i/o-timed-out mid-apply** during the #23 cutover: ``` error: ... failed to download openapi: Get "https://kai-server:6443/openapi/v2": dial tcp 100.69.164.66:6443: i/o timeout ``` The **LAN** endpoint `https://192.168.0.194:6443` is rock-solid from on-LAN hosts and is in the cert SANs (it's what the CI `DEPLOY_KUBECONFIG` already targets). ## Fix `.deploy` now targets a configurable `k8s-api`, defaulting to the LAN endpoint, via `kubectl --server=$(k8s-api)` (CA + auth still come from the context, and `--server` was verified to TLS-validate against it): ``` k8s-api ?= https://192.168.0.194:6443 ``` Override for off-LAN deploys where only the tailnet is reachable: ``` make deploy k8s-api=https://kai-server:6443 ``` The broader deploy-path items that also surfaced (broken CI pipeline, host prereqs) moved to #26.

coilysiren referenced this issue

2026-06-06 05:02:36 +00:00

Deploy-path infra: get CI green + document local-deploy host prereqs #26

coilysiren changed title from ~~Harden the galaxy-gen deploy path (kubectl context timeout, broken CI pipeline, host prereqs)~~ to Fix .deploy kubectl context: target LAN API endpoint, not the flaky tailnet route

2026-06-06 05:02:51 +00:00

coilysiren referenced this issue from a commit

2026-06-06 05:03:15 +00:00

fix(deploy): target the LAN k3s API in .deploy, not the flaky tailnet route

coilysiren closed this issue

2026-06-06 05:03:15 +00:00