Network planes

Each node has a management LAN address for K3s API, etcd, and Calico.

Greenfield clusters also run wg-umkim — a /32 on the fleet overlay (wireguard_overlay_cidr in inventory) so the hub reaches spoke NodePorts without public routing. DCM service providers listen on NodePorts on that overlay IP.

Hub WireGuard

Hub wg0 comes up during wireguard.yml. Overlay CIDR and hub /32 are fixed for the life of the fleet.

Traffic examples

Path	Flow
Console / DCM API	Operator laptop → WireGuard → hub NodePorts
Hub-routed app	Client → hub WAN Traefik → WireGuard → spoke Traefik NodePort → Service
Site / port-forward	Client → site WAN endpoint → cluster NodePorts

Do not publish management NodePorts on the hub WAN. See Security and ports.