ExecStart says 'k3s server server --disable=traefik --disable=servicelb
--node-ip=10.0.0.2'. The word server appears twice, so everything after the
second one is a positional argument and none of the flags is read. The node
annotation records all three; the node's internal IP is the public address
anyway; traefik.yaml sits deployed in the manifests directory. Four months of
a configuration that describes a cluster we do not have.
It matters here because the install script rewrites that unit. Whatever it
writes will not be the same broken line, and if the flags become live the next
start removes traefik and servicelb — the entire ingress — and moves the node's
advertised address onto the vSwitch.
Everything else in this gate came out smaller than gate 1 assumed. The traefik
chart major renders identically down to the container arguments, the only
difference being a docker.io prefix on the image. The restart costs about
seventy seconds, read off the container start times of the last one rather than
guessed.
And the yield is 29 high findings smaller than I claimed, because I had scanned
the newest tags instead of the ones this release ships. The acceptance criterion
is corrected down to −189 before the work, not after it.
Thore Cimbal
1d0d5f1cf9