4ccf2066ca
The read-only cluster_read tool (and the HUX-12 producer) reach the Kubernetes API through the kubernetes Service, which kube-proxy DNATs from the 10.43.0.1 ClusterIP to a control-plane node on 192.168.22.11-13 :6443 - addresses the tenant egress except-block was dropping, so calls failed with connection-refused. Egress now allows the ClusterIP and those three apiserver endpoints on 443/6443. RBAC still bounds what is readable (no Secrets); nothing else about the isolation changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
titan-iac
Flux-managed Kubernetes desired-state config for bstein.dev.
Canonical source URL:
ssh://git@scm.bstein.dev:2242/atlas/titan-iac.git
Scope
This repo contains cluster configuration consumed by Flux:
- platform/infrastructure manifests
- service manifests and kustomizations
- operational scripts for render/reconcile workflows
Apply model
I use Git + Flux as the source of truth and avoid manual in-cluster edits for durable changes.