Access & consoles

Run kubectl on the node over SSH, or from your laptop once local access is set up (below). Browsers use the public hosts further down this page.

kubectl

On the node

After install, KUBECONFIG is /etc/rancher/k3s/k3s.yaml (or ~/.kube/config if you copied it as in Provision).

kubectl get nodes
kubectl get applications -n argocd

Success: the node is Ready; Applications list.

From your local machine (via Tailscale)

k3s only trusts the SANs it knew about at install time, so add the Tailscale address before pulling the kubeconfig.

On the node — add the Tailscale IP/hostname as a TLS SAN, then restart:

sudo tee -a /etc/rancher/k3s/config.yaml <<EOF
tls-san:
  - "<tailscale-ip>"
  - "<node-hostname>"
EOF
sudo systemctl restart k3s

Locally — pull the kubeconfig and point it at the node over Tailscale:

scp <user>@<node-hostname>:/etc/rancher/k3s/k3s.yaml ~/.kube/config-<node-hostname>
sed -i '' "s/127.0.0.1/<node-hostname>/" ~/.kube/config-<node-hostname>   # macOS sed

k3s.yaml names everything default, which collides with another cluster’s default entry if you merge configs later — rename it now:

kubectl --kubeconfig ~/.kube/config-<node-hostname> config rename-context default <node-hostname>
kubectl --kubeconfig ~/.kube/config-<node-hostname> config set-context <node-hostname> \
  --cluster=<node-hostname> --user=<node-hostname>
sed -i '' 's/name: default/name: <node-hostname>/g' ~/.kube/config-<node-hostname>

Merge it into your main kubeconfig and switch to it:

KUBECONFIG=~/.kube/config:~/.kube/config-<node-hostname> kubectl config view --flatten > ~/.kube/config.new
mv ~/.kube/config.new ~/.kube/config
kubectl config use-context <node-hostname>
kubectl get nodes

Success: kubectl get nodes shows the node Ready without KUBECONFIG set.

After a node reinstall

The SSH host key and the k3s CA both regenerate. Clear the old SSH key and the old kubeconfig entries before repeating the steps above — otherwise the stale entries win the merge and you get x509: certificate signed by unknown authority:

ssh-keygen -R <node-hostname>
ssh-keygen -R <tailscale-ip>
kubectl config delete-context <node-hostname> 2>/dev/null
kubectl config delete-cluster <node-hostname> 2>/dev/null
kubectl config delete-user <node-hostname> 2>/dev/null

Argo CD (apps portal)

https://control.webbies.dev

On the node or locally.

kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath='{.data.password}' | base64 -d

Change that password on first login.

Keycloak admin

https://uat.auth.webbies.dev/admin
https://auth.webbies.dev/admin

First-time temp-admin: Provision §8. Lockout later: Restore. The Git overlay is still staging; the public host is uat.auth.

Infisical

https://vault.webbies.dev

First account is org admin. Edit values in the GUI — Secrets.