- Shipped
- August 19, 2026 at 2:14 AM UTC
- Author
- Kamo
- Commit
- ffe6592
Mounts failed with 'access denied by server'. A packet capture inside the guest showed the connection arriving from 10.42.0.151 — a pod-network address — not the workstation's 192.168.4.33: kube-proxy SNATs NodePort traffic under the default externalTrafficPolicy: Cluster, so the 192.168.4.0/22 export line could never match. externalTrafficPolicy: Local keeps the real client IP. The alternative, widening the export to the pod CIDR, would let any pod in the cluster mount the team folder — a far larger grant than 'machines on our LAN'. Cost: only a node running the VM answers, so clients target k3m1 rather than the control plane. The mount script defaults there and takes KAMOTEAM_SERVER to override if the VM is ever moved.