From ca53177520ebde11e302a1b8a6d62f4befc16676 Mon Sep 17 00:00:00 2001 From: Takwa Date: Mon, 19 Oct 2026 14:01:44 +0200 Subject: [PATCH 1/2] Reserve ports 9810-9811 for the metrics proxy ipni/infra runs a metrics-only Traefik on the host network of every box (kubernetes/platform/metrics-proxy) so Alloy can scrape the bootstrappers' kubo and WSS Envoy, which serve their metrics on loopback only. It binds 9810 (the routes) and 9811 (its ping). Reserve both, like every other host-network port, so an outbound socket cannot take one as its source port and stop the proxy re-binding after a restart. No firewall change: roles/hardening already allows the pod network (10.42.0.0/16 and cni0), which is where Alloy scrapes from, and nothing else reaches these ports. Co-Authored-By: Claude Opus 5.5 --- group_vars/ipfs_nodes/main.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/group_vars/ipfs_nodes/main.yml b/group_vars/ipfs_nodes/main.yml index 95a39b7..c43d826 100644 --- a/group_vars/ipfs_nodes/main.yml +++ b/group_vars/ipfs_nodes/main.yml @@ -137,6 +137,8 @@ sysctl_tuning: # 8000 Healthchecks (healthchecks_host only) # 8443 monitoring Traefik HTTPS, 9800 its ping, 9801 its metrics (argocd_hub only, # host network: ipni/infra kubernetes/manifests/eu/lith1/monitoring/values/traefik.yaml) + # 9810 metrics proxy (Traefik), 9811 its ping (every box, host network: + # ipni/infra kubernetes/platform/metrics-proxy/values.yaml) # 8472/udp flannel VXLAN # 9094 content ipfs-cluster REST API (loopback) # 9095 content ipfs-cluster IPFS proxy (loopback) @@ -146,7 +148,7 @@ sysctl_tuning: # 9901 route-origin Envoy admin 9902 bootstrap-wss Envoy admin # 9903 bootstrap-b's bootstrap-wss Envoy admin # 10010 containerd 10248-10259 kubelet/kube-proxy/k3s - net.ipv4.ip_local_reserved_ports: "443,4001-4002,4004-4007,4011-4012,4101,4443,4453,5011-5012,5021,6443-6444,8000,8190-8193,8443,8472,9094-9097,9443,9800-9801,9901-9904,10010,10248-10259" + net.ipv4.ip_local_reserved_ports: "443,4001-4002,4004-4007,4011-4012,4101,4443,4453,5011-5012,5021,6443-6444,8000,8190-8193,8443,8472,9094-9097,9443,9800-9801,9810-9811,9901-9904,10010,10248-10259" net.ipv4.tcp_fin_timeout: 15 # Must equal what k3s's kube-proxy sets on every start: max(32768 * CPUs, # 131072), i.e. 1048576 on these 32-core boxes. A fixed lower value both From 3ed84d3b02547391bf50b2db17f748a66f1cfaac Mon Sep 17 00:00:00 2001 From: Takwa Date: Mon, 19 Oct 2026 14:25:16 +0200 Subject: [PATCH 2/2] Reserve port 8888 for ipfs-cluster's metrics The content node's ipfs-cluster peer can serve Prometheus metrics (pins, peers) on 8888. They are off today; turning them on needs an environment change in k8s/content and a content pod restart, which belongs with the content metrics step. Reserving the port now, while site.yml runs for the metrics proxy anyway, saves a second run. Nothing listens on 8888 on any box (checked with ss), so the reservation has no effect until then. Co-Authored-By: Claude Opus 5.5 --- group_vars/ipfs_nodes/main.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/group_vars/ipfs_nodes/main.yml b/group_vars/ipfs_nodes/main.yml index c43d826..a334b84 100644 --- a/group_vars/ipfs_nodes/main.yml +++ b/group_vars/ipfs_nodes/main.yml @@ -140,6 +140,8 @@ sysctl_tuning: # 9810 metrics proxy (Traefik), 9811 its ping (every box, host network: # ipni/infra kubernetes/platform/metrics-proxy/values.yaml) # 8472/udp flannel VXLAN + # 8888 content ipfs-cluster Prometheus metrics (loopback; reserved ahead of + # enabling them in k8s/content, scraped through the metrics proxy) # 9094 content ipfs-cluster REST API (loopback) # 9095 content ipfs-cluster IPFS proxy (loopback) # 9096 content ipfs-cluster swarm @@ -148,7 +150,7 @@ sysctl_tuning: # 9901 route-origin Envoy admin 9902 bootstrap-wss Envoy admin # 9903 bootstrap-b's bootstrap-wss Envoy admin # 10010 containerd 10248-10259 kubelet/kube-proxy/k3s - net.ipv4.ip_local_reserved_ports: "443,4001-4002,4004-4007,4011-4012,4101,4443,4453,5011-5012,5021,6443-6444,8000,8190-8193,8443,8472,9094-9097,9443,9800-9801,9810-9811,9901-9904,10010,10248-10259" + net.ipv4.ip_local_reserved_ports: "443,4001-4002,4004-4007,4011-4012,4101,4443,4453,5011-5012,5021,6443-6444,8000,8190-8193,8443,8472,8888,9094-9097,9443,9800-9801,9810-9811,9901-9904,10010,10248-10259" net.ipv4.tcp_fin_timeout: 15 # Must equal what k3s's kube-proxy sets on every start: max(32768 * CPUs, # 131072), i.e. 1048576 on these 32-core boxes. A fixed lower value both