Architecture

Mon, 01 Jan 0001 00:00:00 +0000

Overview

KubeClaw creates a secure, IPv6-only Kubernetes cluster on Hetzner Cloud. The design prioritizes security through network isolation: no public IPv4 addresses, SSH access exclusively via Cloudflare Tunnel, and per-namespace egress control with Cilium network policies.

┌─────────────────────────────────────────────────────────────────┐
│ Internet │
└─────────────────────────────────────────────────────────────────┘
 │ │
 ▼ ▼
 ┌──────────────┐ ┌───────────────┐
 │ Cloudflare │ │ Admin Node │
 │ Tunnel │ │ 10.0.0.254 │
 │ (permanent) │ │ (temporary, │
 └──────┬───────┘ │ public IPv6) │
 │ └───────┬───────┘
 ▼ ▼
┌─────────────────────────────────────────────────────────────────┐
│ Hetzner Cloud │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ Private Network (10.0.0.0/24) │ │
│ │ │ │
│ │ ┌─────────────────┐ ┌─────────────────┐ │ │
│ │ │ control-01 │ │ control-02+ │ │ │
│ │ │ 10.0.0.2 │ │ 10.0.0.3+ │ │ │
│ │ │ (master, │◄►│ (replicas, │ │ │
│ │ │ cloudflared) │ │ 0-n instances) │ │ │
│ │ └────────┬────────┘ └─────────────────┘ │ │
│ │ │ │ │
│ │ ▼ │ │
│ │ ┌─────────────────┐ │ │
│ │ │ worker-nodes │ │ │
│ │ │ (0-n instances) │ │ │
│ │ └─────────────────┘ │ │
│ │ │ │
│ └─────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘

Node Roles

Master Control Node (control-01, 10.0.0.2)

The master control node always exists and serves as:

Security Model

Mon, 01 Jan 0001 00:00:00 +0000

KubeClaw’s security is layered across three levels: Hetzner Cloud firewalls, host-level hardening, and Kubernetes network policies. See Architecture for the overall network design.

Firewall Rules (Hetzner)

Hetzner Cloud firewalls are the first line of defense. Each node role has its own firewall:

Control nodes: SSH from private network + localhost (for tunnel), ICMP from private network
Worker nodes: SSH from private network, ICMP from private network
Admin node: SSH from anywhere (temporary), ICMP from private network

Kubernetes ports (6443, 10250, 2379-2380, 30000-32767) are intentionally excluded from the Hetzner firewall and added only when deploying Kubernetes.

DNS and NAT64

Mon, 01 Jan 0001 00:00:00 +0000

The cluster is IPv6-only – but many services (GitHub CDN, container registries, package repos) are IPv4-only. NAT64/DNS64 provides transparent IPv4 reachability at the network layer, no application changes needed. This page covers how DNS64/NAT64 works, how it integrates with Kubernetes CoreDNS, and how to configure it.

The Problem: IPv4 Internet from IPv6-Only Nodes

The nodes have no public IPv4 addresses. Most internet services (GitHub, Docker Hub, package repos) have IPv4 addresses. How does an IPv6-only node reach them?

Introduction on KubeClaw

Architecture

Overview

Node Roles

Master Control Node (control-01, 10.0.0.2)

Security Model

Firewall Rules (Hetzner)

DNS and NAT64

The Problem: IPv4 Internet from IPv6-Only Nodes