From 93e796381f49d8906c8f3d764f55e24f58d26060 Mon Sep 17 00:00:00 2001 From: Jakob Lingel Date: Sat, 17 Oct 2026 16:19:13 +0200 Subject: [PATCH 1/3] fix: allow inter-node kubelet metrics access --- terraform/firewall.tf | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/terraform/firewall.tf b/terraform/firewall.tf index d9e25a9..dd4ca3c 100644 --- a/terraform/firewall.tf +++ b/terraform/firewall.tf @@ -49,6 +49,19 @@ resource "hcloud_firewall" "k8s_cluster" { ] } + # Allow kubelet metrics access between cluster nodes + rule { + direction = "in" + protocol = "tcp" + port = "10250" + source_ips = [ + "116.203.111.240/32", # k8s-node-1 + "195.201.5.29/32", # k8s-node-2 + "91.98.235.232/32", # k8s-node-3 + "178.104.133.8/32", # k8s-worker-1 + ] + } + # Kubernetes NodePort range (for load balancer health checks) rule { direction = "in" From 552932552e282e9ea4501097a0ac3fe4ea318543 Mon Sep 17 00:00:00 2001 From: Jakob Lingel Date: Sat, 17 Oct 2026 16:28:37 +0200 Subject: [PATCH 2/3] fix: mask Parameter Store values in Terraform workflows --- .github/workflows/terraform.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml index 0e3d06b..685a68d 100644 --- a/.github/workflows/terraform.yml +++ b/.github/workflows/terraform.yml @@ -59,6 +59,12 @@ jobs: echo "$PARAMS" | jq -c '.[]' | while read -r param; do name=$(echo "$param" | jq -r '.[0]') value=$(echo "$param" | jq -r '.[1]') + + # Mask fetched values before exporting them to later step environments + masked_value="${value//'%'/'%25'}" + masked_value="${masked_value//$'\r'/'%0D'}" + masked_value="${masked_value//$'\n'/'%0A'}" + printf '::add-mask::%s\n' "$masked_value" # Convert /infra/terraform/providers/hcloud_token to TF_VAR_hcloud_token # Convert /infra/terraform/dns/schluesselmomente_dkim to TF_VAR_schluesselmomente_dkim @@ -203,6 +209,12 @@ jobs: echo "$PARAMS" | jq -c '.[]' | while read -r param; do name=$(echo "$param" | jq -r '.[0]') value=$(echo "$param" | jq -r '.[1]') + + # Mask fetched values before exporting them to later step environments + masked_value="${value//'%'/'%25'}" + masked_value="${masked_value//$'\r'/'%0D'}" + masked_value="${masked_value//$'\n'/'%0A'}" + printf '::add-mask::%s\n' "$masked_value" # Convert /infra/terraform/providers/hcloud_token to TF_VAR_hcloud_token # Convert /infra/terraform/dns/schluesselmomente_dkim to TF_VAR_schluesselmomente_dkim From ec6fb24b3ea125e329eb350e0a0314180e6e8663 Mon Sep 17 00:00:00 2001 From: Jakob Lingel Date: Sat, 17 Oct 2026 21:40:22 +0200 Subject: [PATCH 3/3] fix: preserve existing Google site verification record --- terraform/global/dns/jakob-lingel.dev.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/terraform/global/dns/jakob-lingel.dev.tf b/terraform/global/dns/jakob-lingel.dev.tf index 1f5a78a..0e33b9b 100644 --- a/terraform/global/dns/jakob-lingel.dev.tf +++ b/terraform/global/dns/jakob-lingel.dev.tf @@ -73,12 +73,12 @@ resource "digitalocean_record" "jakob_lingel_dev_immo_google_verification" { ttl = 1800 } -# google search ownership verification TXT record for portfolio.jakob-lingel.dev -resource "digitalocean_record" "jakob_lingel_dev_portfolio_google_verification" { +# Preserve the existing Google site verification record and Terraform identity +resource "digitalocean_record" "jakob_lingel_dev_google_verification" { domain = digitalocean_domain.jakob-lingel-dev.name type = "TXT" name = "@" - value = "google-site-verification=9mS_je2OJqOW8vlDGA6jXDVgi79c4rpxNg1t5u2VRN8" + value = "google-site-verification=6cc-R32CLdo5pnRguKt10WTFCVnkBcy8lQKiHPXGfUo" ttl = 1800 }