Skip to content

docs(kubectl): document direct API access #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xnoto merged 1 commit into from
Aug 14, 2026
Merged

docs(kubectl): document direct API access #17

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions KUBECTL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,15 @@
# k3s access and recovery

Normal kubectl access uses the Cloudflare Access TCP tunnel and Dex OIDC flow
documented in the
Normal kubectl access connects directly to `https://api.makeitwork.cloud` and
uses the Dex OIDC flow documented in the
[`kustomize-cluster` README](https://github.com/makeitworkcloud/kustomize-cluster#kubectl-access).
The k3s API server's matching OIDC issuer, client ID, and claim configuration is
provisioned from `cloud-init/k3s/cloud_init.cfg`.

The previous Cloudflare Access TCP route at `k3s.makeitwork.cloud` remains a
migration fallback until direct API discovery, watches, logs, exec, copy, and
port-forward are validated through the HTTPS endpoint.

Cloud-init is the source of truth for new or replaced VMs, not a convergence
mechanism for an existing node. Changing the OIDC template does not update the
live file or restart k3s. A live migration must separately update
Expand Down
Loading