aula-06 e aula-08: Hetzner CSI Driver e segurança de rede

aula-06:
- Adicionar instalação do Hetzner CSI Driver no setup.sh
- Input interativo seguro para token da Hetzner Cloud
- Atualizar custom-values.yaml para n8n.kube.quest

aula-08:
- Adicionar regras de firewall para VXLAN e rede privada
- Configurar Flannel para usar interface privada (--iface-can-reach)
- Configurar kubelet.nodeIP.validSubnets para rede privada
- Corrigir segurança: VXLAN restrito a 10.0.0.0/8

aula-08/talos-patches/control-plane.yaml

@@ -29,6 +29,10 @@ machine:
       max-pods: "110"
       kube-reserved: "cpu=200m,memory=300Mi"
       system-reserved: "cpu=200m,memory=200Mi"
+    # Force kubelet to use private network IP
+    nodeIP:
+      validSubnets:
+        - 10.0.0.0/8
 
   # Time sync
   time:
@@ -51,6 +55,9 @@ cluster:
   network:
     cni:
       name: flannel
+      flannel:
+        extraArgs:
+          - --iface-can-reach=10.0.1.1
     dnsDomain: cluster.local
     serviceSubnets:
       - 10.96.0.0/12

aula-08/talos-patches/worker.yaml

@@ -19,6 +19,10 @@ machine:
       max-pods: "110"
       kube-reserved: "cpu=100m,memory=200Mi"
       system-reserved: "cpu=100m,memory=100Mi"
+    # Force kubelet to use private network IP
+    nodeIP:
+      validSubnets:
+        - 10.0.0.0/8
 
   # Time sync
   time:
@@ -37,6 +41,9 @@ cluster:
   network:
     cni:
       name: flannel
+      flannel:
+        extraArgs:
+          - --iface-can-reach=10.0.1.1
     dnsDomain: cluster.local
     serviceSubnets:
       - 10.96.0.0/12