Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform.
cute.haus
ansible
terraform
nix
k8s
nixos/k3s: trust cni0
Aly Raffauf
(Jul 4, 2026, 10:47 PM EDT)
ff6e2159
74e85a64
+8
-1
+8
-1
nix/nixos/profiles/k3s.nix
+8
-1
nix/nixos/profiles/k3s.nix
···
51
51
# systemd-oomd fights kubelet's eviction manager
52
52
systemd.oomd.enable = lib.mkForce false;
53
53
54
-
networking.firewall.allowedTCPPorts = lib.mkIf cfg.ingress [80 443 2222];
54
+
networking.firewall = {
55
+
allowedTCPPorts = lib.mkIf cfg.ingress [80 443 2222];
56
+
57
+
# Let a pod reach kubelet:10250 on its own host. Same-node traffic to
58
+
# the node's Tailscale IP is delivered locally and arrives via cni0, so
59
+
# metrics-server can't scrape the node it runs on without this.
60
+
trustedInterfaces = ["cni0"];
61
+
};
55
62
56
63
services = {
57
64
k3s = {