Security and ports

Experimental and unsupported: UMKIM v0.2 is not security-certified or production-supported. Review every image, playbook, network rule, and secret before deployment.

Treat the public network as untrusted and every WireGuard management peer as privileged. Keep management APIs, Kubernetes, registry, and console NodePorts on a private management path. Expose public application traffic only after reviewing firewall, TLS, DNS, and authentication behavior.

The intended public ingress is SSH, WireGuard, and optionally HTTP/HTTPS for public applications. Management APIs, Kubernetes, registry, and console NodePorts should be reachable only through the management network. Verify the rendered firewall configuration on every release.

Hub WAN filter

The hub WAN filter is nft table inet fleet_hub (/etc/nftables/fleet-hub.nft). The fleet_hub_firewall role does not disable firewalld. It opens the same public TCP and UDP ports in firewalld only when firewall-cmd --state succeeds. TCP 30080 and 30443 stay blocked on the hub WAN address (CHANGE_ME on umkim-hub).

Hub ACME is HTTP-01. When hub ACME is enabled, hub Traefik binds TCP 80 and 443. When hub ACME is off, the gateway listens on TCP 9080 and does not bind 443.

Spoke firewalld

configure_firewalld stays false, so YAIDAP prepare does not start firewalld or lock SSH.

The fleet_spoke_firewall role stays off unless fleet_spoke_firewall_enabled is true. That flag defaults to configure_firewalld (false). The role does not disable firewalld. When it is enabled it starts firewalld, trusts the WireGuard interface, and allows the overlay to TCP 6443, 10250, and hostNetwork LLM TCP 8080. Spoke Traefik NodePorts 30080, 30443, and 30081 are opened when spoke ingress is enabled.

When an operator turns YAIDAP firewalld on, firewalld_cluster_profile (default true) trusts 10.10.0.0/16 (UMKIM WireGuard), 192.168.0.0/16 (Calico; flannel is disabled), and 10.43.0.0/16, and trusts wg-umkim and wg0 when those interfaces exist. Inventory zones also get TCP 80, 443, 30080, 30443, and 30081. Zone targets are DROP. TCP 6443 and 10250 are not opened on those DROP zones; trusted overlay and pod sources can reach them. TCP 179 (Calico BGP) is not in that zone list. host_prepare opens TCP 179, 6443, and 10250 only on its opt-in firewalld path (configure_firewalld true), because Calico peers are management-LAN addresses.

When firewalld is already running (firewall-cmd --state succeeds), K3s overlay tasks open spoke Traefik NodePorts if spoke ingress is enabled and trust discovered pod CIDRs on every cluster node, not only the bootstrap node. Those tasks do not start firewalld.

Use an encrypted vault, unique credentials, restricted SSH access, and independently tested backup and recovery procedures. The hub is a control-plane trust boundary; a compromise can affect the fleet.

Report a vulnerability

Use the private GitHub Security Advisory process. Do not put exploit details in a public issue. Before release, confirm that this canonical repository link is publicly reachable by the intended audience.

See SECURITY.md in the source repository.