Setting --node-ip alone would have been wrong in two ways I only found by
looking. servicelb publishes the node's address, so the traefik service and
every single ingress currently carry the public IP and would have started
carrying 10.0.0.2. And the API certificate's SAN list has no 10.0.0.2 in it, so
regenerating it while the kubeconfig points at the public address is how you
lock yourself out. The line now carries --node-external-ip and --tls-san
alongside.
Two risks I had assumed turned out not to exist: alloy scrapes pods only, never
the kubelet or the node role, and cert-manager solves HTTP01 over the public
name. Neither cares what the node advertises.
The install step runs with SKIP_START on purpose. The whole risk of this
undertaking is what the script writes into that unit, so it gets read before
anything starts rather than trusted.
Thore Cimbal
3e55a42ea6