From d6d4475da321e48a9a80002b1080d702cd48f7c6 Mon Sep 17 00:00:00 2001 From: Scott Karp Date: Sun, 4 Oct 2026 15:13:26 +0000 Subject: [PATCH] =?UTF-8?q?deploy:=20an=20Exoscale=20LoadBalancer=20Servic?= =?UTF-8?q?e=20is=20two=20artifacts=20=E2=80=94=20the=20gate=20was=20never?= =?UTF-8?q?=20opened=20(tablet=2029)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The NLB forwards to the Service's NodePort and healthchecks it on the node; the cloud controller does not open that port in the security group. shorashim-external had no rule for 30923 for 26 days, so 185.19.29.180 refused connections while the pod was Ready. Rule added by the kohen 2026-10-04; the command now sits beside the manifest. Co-Authored-By: Claude Fable 5.1 --- deploy/k8s/service.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/deploy/k8s/service.yaml b/deploy/k8s/service.yaml index c118abfc..e6f9ec7e 100644 --- a/deploy/k8s/service.yaml +++ b/deploy/k8s/service.yaml @@ -25,7 +25,14 @@ spec: name: http --- # External access via LoadBalancer -# For Exoscale SKS, this provisions an Exoscale NLB +# For Exoscale SKS, this provisions an Exoscale NLB. +# +# The NLB forwards to this Service's NodePort and TCP-healthchecks it on +# the node. The cloud controller does NOT open that port in the node's +# security group — the operator must, or the NLB IP refuses connections +# while the pod is Ready (2026-10-04, tablet 29): +# PORT=$(kubectl -n shorashim get svc shorashim-external -o jsonpath='{.spec.ports[0].nodePort}') +# exo compute security-group rule add default --flow ingress --protocol tcp --port $PORT --network 0.0.0.0/0 apiVersion: v1 kind: Service metadata: