underpost 3.2.80 → 3.3.0

package/deploy/pwa-microservices-template/deploy.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../lib/logging.sh"
+
+# Runs in the workflow's rockylinux:9 container against the checked-out
+# workspace instead of over SSH, so the repository root is this script's
+# grandparent rather than a fixed remote path.
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+main() {
+    echo "Starting github pages deploy"
+
+    cd "$REPO_ROOT"
+
+    run_quiet \
+        "Install required packages" \
+        "Target pod:" \
+        14 \
+        dnf install -y sudo tar gzip bzip2 git
+
+    run_quiet \
+        "Install curl" \
+        "Target pod:" \
+        14 \
+        dnf install -y curl --allowerasing
+
+    run_quiet \
+        "Add Node.js repository" \
+        "Target pod:" \
+        14 \
+        bash -c "curl -fsSL https://rpm.nodesource.com/setup_24.x | bash -"
+
+    run_quiet \
+        "Install Node.js" \
+        "Target pod:" \
+        14 \
+        dnf install nodejs -y
+
+    run_quiet \
+        "Install dependencies" \
+        "Target pod:" \
+        14 \
+        npm install
+
+    run_quiet \
+        "Build dd-github-pages configuration" \
+        "Target pod:" \
+        14 \
+        node bin new --default-conf --conf-workflow-id dd-github-pages
+
+    run_quiet \
+        "Create dd-github-pages deployment" \
+        "Target pod:" \
+        14 \
+        node bin new --deploy-id dd-github-pages
+
+    run_quiet \
+        "Load dd-github-pages production environment" \
+        "Target pod:" \
+        14 \
+        node bin env dd-github-pages production
+
+    run_quiet \
+        "Build dd-github-pages client" \
+        "Target pod:" \
+        14 \
+        env NODE_ENV=production node bin client dd-github-pages '' underpostnet.github.io /pwa-microservices-template-ghpkg
+}
+
+main "$@"

package/deploy/release/deploy.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../lib/logging.sh"
+
+ENGINE_ROOT=/home/dd/engine
+
+main() {
+    echo "Starting remote release deploy"
+
+    run_quiet \
+        "Pull repository" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run pull"
+
+    run_quiet \
+        "Install dependencies" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm install"
+
+    run_quiet \
+        "Sync secrets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run secret"
+
+    run_quiet \
+        "Install underpost CLI" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && npm install -g underpost"
+
+    run_quiet \
+        "Resync secrets" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run secret"
+
+    run_quiet \
+        "Configure git" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run --dev git-conf"
+
+    run_quiet \
+        "Build and publish docker images" \
+        "Target pod:" \
+        14 \
+        sudo -n -- /bin/bash -lc \
+        "cd $ENGINE_ROOT && node bin run docker-image"
+}
+
+main "$@"

package/docker-compose.yml

@@ -81,7 +81,7 @@ services:
   # (dd-default-development-blue). Connection targets use Docker service
   # discovery instead of hardcoded localhost.
   app:
-    image: ${APP_IMAGE:-underpost/underpost-engine}:${APP_TAG:-v3.2.80}
+    image: ${APP_IMAGE:-underpost/underpost-engine}:${APP_TAG:-v3.3.0}
     container_name: dd-app
     # The start command is supplied by the generated override docker/compose.app.yml
     # (see `underpost docker-compose --generate --deploy-id <id>`), keeping this

package/manifests/cronjobs/dd-cron/dd-cron-backup.yaml

@@ -14,6 +14,10 @@ spec:
   failedJobsHistoryLimit: 1
   suspend: false
   jobTemplate:
+    metadata:
+      labels:
+        app: dd-cron-backup
+        managed-by: underpost
     spec:
       template:
         metadata:
@@ -23,7 +27,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-backup
-              image: underpost/underpost-engine:v3.2.80
+              image: underpost/underpost-engine:v3.3.0
               command:
                 - /bin/sh
                 - -c

package/manifests/cronjobs/dd-cron/dd-cron-dns.yaml

@@ -23,7 +23,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-dns
-              image: underpost/underpost-engine:v3.2.80
+              image: underpost/underpost-engine:v3.3.0
               command:
                 - /bin/sh
                 - -c

package/manifests/cronjobs/dd-cron/dd-cron-vultr.yaml

@@ -0,0 +1,52 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: dd-cron-vultr
+  namespace: default
+  labels:
+    app: dd-cron-vultr
+    managed-by: underpost
+spec:
+  schedule: "*/30 * * * *"
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 200
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
+  suspend: false
+  jobTemplate:
+    metadata:
+      labels:
+        app: dd-cron-vultr
+        managed-by: underpost
+    spec:
+      template:
+        metadata:
+          labels:
+            app: dd-cron-vultr
+            managed-by: underpost
+        spec:
+          containers:
+            - name: dd-cron-vultr
+              image: underpost/underpost-engine:v3.3.0
+              command:
+                - /bin/sh
+                - -c
+                - >
+                  cd /home/dd/engine &&
+                  node bin env dd-cron production &&
+                  node bin cron dd-cron vultr --git --kubeadm 
+              volumeMounts:
+                - mountPath: /home/dd/engine
+                  name: underpost-cron-container-volume
+                - mountPath: /usr/lib/node_modules/underpost
+                  name: underpost-share-env
+          volumes:
+            - hostPath:
+                path: /home/dd/engine
+                type: Directory
+              name: underpost-cron-container-volume
+            - hostPath:
+                path: /root/.nvm/versions/node/v24.15.0/lib/node_modules/underpost
+                type: DirectoryOrCreate
+              name: underpost-share-env
+          restartPolicy: OnFailure

package/manifests/deployment/dd-default-development/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-blue
-          image: underpost/underpost-engine:v3.2.80
+          image: underpost/underpost-engine:v3.3.0
           #          resources:
           #            requests:
           #              memory: "124Ki"
@@ -98,7 +98,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-green
-          image: underpost/underpost-engine:v3.2.80
+          image: underpost/underpost-engine:v3.3.0
           #          resources:
           #            requests:
           #              memory: "124Ki"

package/manifests/deployment/playwright/deployment.yaml

@@ -14,7 +14,7 @@ spec:
     spec:
       containers:
         - name: playwright
-          image: mcr.microsoft.com/playwright:v1.59.0-jammy
+          image: mcr.microsoft.com/playwright:v1.62.1-jammy
           command:
             - /bin/bash
             - -c

package/manifests/mongodb/kustomization.yaml

@@ -3,7 +3,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - pv-pvc.yaml
+  # pv-pvc.yaml is intentionally absent: the PersistentVolume set is one-per-replica, so it is
+  # generated from the effective replica count by MongoBootstrap.applyReplicaVolumes() and applied
+  # just before this kustomization. A static file can only describe a fixed number of members, and
+  # any --replicas above it leaves the surplus claims unbindable.
   - headless-service.yaml
   - statefulset.yaml
   # - backup-pv-pvc.yaml

package/manifests/mongodb/statefulset.yaml

@@ -105,6 +105,10 @@ spec:
   volumeClaimTemplates:
     - metadata:
         name: mongodb-storage
+        # Without this label `kubectl delete pvc -l app=mongodb` matches nothing, leaving stale
+        # claims bound to retained PVs across redeploys.
+        labels:
+          app: mongodb
       spec:
         accessModes: ['ReadWriteOnce']
         storageClassName: mongodb-storage-class

package/manifests/mongodb/storage-class.yaml

@@ -3,7 +3,14 @@ kind: StorageClass
 metadata:
   name: mongodb-storage-class
   annotations:
-    storageclass.kubernetes.io/is-default-class: "false"
-provisioner: rancher.io/local-path
+    storageclass.kubernetes.io/is-default-class: 'false'
+# Static class: the replica volumes are hostPath PVs generated one per member by
+# MongoBootstrap.applyReplicaVolumes(), each pinned to one member via `claimRef`. It must NOT name a dynamic provisioner — with
+# `rancher.io/local-path` the local-path controller also provisions for these PVCs, racing the
+# static binder, so which volume a member ends up on is not deterministic. Two members landing
+# on one directory is fatal: mongod dies on `WiredTiger.lock: fcntl: Resource temporarily
+# unavailable`, since kind bind-mounts /data/mongodb from the host into every node.
+provisioner: kubernetes.io/no-provisioner
 reclaimPolicy: Retain
+# Static hostPath PVs carry no nodeAffinity, so binding can safely wait for the scheduler.
 volumeBindingMode: WaitForFirstConsumer

package/package.json

@@ -2,7 +2,7 @@
     "type": "module",
     "main": "src/index.js",
     "name": "underpost",
-    "version": "3.2.80",
+    "version": "3.3.0",
     "description": "Underpost Platform — end-to-end CI/CD and application-delivery toolchain CLI. Covers bare metal, Kubernetes, K3s, kubeadm, LXD, container/image orchestration, secrets, databases, cron jobs, monitoring, SSH, runners, PWA + Workbox delivery, and release orchestration. Extensible via downstream CLIs.",
     "scripts": {
         "start": "node --max-old-space-size=8192 src/server",
@@ -72,16 +72,16 @@
     "homepage": "https://github.com/underpostnet/pwa-microservices-template#readme",
     "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.1",
-        "@fullcalendar/rrule": "^7.0.1",
+        "@fullcalendar/rrule": "^7.0.2",
         "@grpc/grpc-js": "^1.14.4",
         "@grpc/proto-loader": "^0.8.1",
         "@neodrag/vanilla": "^2.3.1",
         "adm-zip": "^0.6.0",
-        "ag-grid-community": "^36.0.1",
-        "axios": "^1.18.1",
-        "bumpp": "^11.1.0",
+        "ag-grid-community": "^36.1.0",
+        "bumpp": "^12.2.1",
+        "axios": "^1.19.0",
         "chai": "^6.2.2",
-        "clipboardy": "^5.3.1",
+        "clipboardy": "^5.3.2",
         "cloudinary": "^2.10.0",
         "colors": "^1.4.0",
         "commander": "^15.0.0",
@@ -89,32 +89,32 @@
         "cookie-parser": "^1.4.7",
         "cors": "^2.8.6",
         "d3": "^7.9.0",
-        "dexie": "^4.4.4",
+        "dexie": "^4.4.5",
         "dotenv": "^17.4.2",
         "easymde": "^2.21.0",
-        "esbuild": "^0.28.1",
+        "esbuild": "^0.28.2",
         "escape-string-regexp": "^5.0.0",
         "express": "^5.2.1",
         "express-fileupload": "^1.4.3",
-        "express-rate-limit": "^8.6.0",
+        "express-rate-limit": "^8.6.2",
         "express-slow-down": "^3.1.0",
         "fast-json-stable-stringify": "^2.1.0",
-        "favicons": "^7.3.0",
-        "fs-extra": "^11.3.6",
-        "fullcalendar": "^7.0.1",
+        "favicons": "^7.3.1",
+        "fs-extra": "^11.4.0",
+        "fullcalendar": "^7.0.2",
         "helmet": "^8.3.0",
         "html-minifier-terser": "^7.2.0",
         "http-proxy-middleware": "^4.2.0",
         "ignore-walk": "^9.0.0",
-        "iovalkey": "^0.3.3",
+        "iovalkey": "^0.4.0",
         "json-colorizer": "^3.0.1",
         "jsonwebtoken": "^9.0.3",
         "mariadb": "^3.5.3",
-        "marked": "^18.0.6",
-        "mocha": "^11.7.6",
-        "mongoose": "^9.7.4",
+        "marked": "^18.0.9",
+        "mongoose": "^9.9.2",
+        "mocha": "^11.8.0",
         "morgan": "^1.11.0",
-        "nodemailer": "^9.0.3",
+        "nodemailer": "^9.0.5",
         "nodemon": "^3.0.1",
         "peer": "^1.0.2",
         "peerjs": "^1.5.5",
@@ -129,9 +129,9 @@
         "swagger-autogen": "^2.23.7",
         "swagger-ui-express": "^5.0.0",
         "typedoc": "^0.28.20",
-        "typescript": "^6.0.3",
+        "typescript": "6.0.3",
         "validator": "^13.15.35",
-        "vanilla-jsoneditor": "^3.12.0",
+        "vanilla-jsoneditor": "^3.13.0",
         "winston": "^3.19.0",
         "workbox-background-sync": "^7.4.1",
         "workbox-cacheable-response": "^7.4.1",

package/scripts/audit-selinux.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SINCE="recent"
+FAIL_ON_AVC="1"
+
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --since)
+            [ "$#" -ge 2 ] || { echo "--since requires an ausearch time value" >&2; exit 2; }
+            SINCE="$2"
+            shift 2
+            ;;
+        --no-fail)
+            FAIL_ON_AVC="0"
+            shift
+            ;;
+        -h|--help)
+            echo "Usage: $0 [--since recent|today|boot|TIME] [--no-fail]"
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            exit 2
+            ;;
+    esac
+done
+
+command -v getenforce >/dev/null 2>&1 || {
+    echo "SELinux userspace is unavailable. Install policycoreutils." >&2
+    exit 2
+}
+command -v ausearch >/dev/null 2>&1 || {
+    echo "ausearch is unavailable. Install audit and start auditd." >&2
+    exit 2
+}
+
+MODE="$(getenforce)"
+echo "SELinux mode: $MODE"
+[ "$MODE" = "Enforcing" ] || echo "WARNING: expected Enforcing mode" >&2
+command -v sestatus >/dev/null 2>&1 && sestatus
+
+AUDIT=(ausearch)
+[ "$(id -u)" -eq 0 ] || AUDIT=(sudo ausearch)
+RAW_FILE="$(mktemp /tmp/underpost-selinux-avc.XXXXXX)"
+trap 'rm -f "$RAW_FILE"' EXIT
+
+"${AUDIT[@]}" -m AVC,USER_AVC,SELINUX_ERR -ts "$SINCE" --raw > "$RAW_FILE" 2>/dev/null || true
+if ! grep -q '^type=' "$RAW_FILE"; then
+    echo "No SELinux AVC denials found since: $SINCE"
+    [ "$MODE" = "Enforcing" ]
+    exit
+fi
+
+echo "SELinux AVC denials found since: $SINCE" >&2
+"${AUDIT[@]}" -m AVC,USER_AVC,SELINUX_ERR -ts "$SINCE" -i || true
+if command -v sealert >/dev/null 2>&1; then
+    echo "sealert analysis:"
+    sealert -a "$RAW_FILE" || true
+else
+    echo "Install setroubleshoot-server for sealert analysis." >&2
+fi
+
+[ "$FAIL_ON_AVC" = "0" ] || exit 1

package/scripts/coverall-test.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -u -o pipefail
+
+EXCLUDES=(
+    --exclude="test/cyberia-instance-conf-defaults.test.js"
+    --exclude="test/cyberia-load.test.js"
+    --exclude="test/object-layer-item-id.test.js"
+    --exclude="test/api.test.js"
+    --exclude="test/crypto.test.js"
+    --exclude="test/shape-generator.test.js"
+)
+
+TESTS=(
+    test/cluster-instances.test.js
+    test/deploy-monitor.test.js
+    test/deploy-node-placement.test.js
+    test/instance-traffic-plan.test.js
+    test/sops-secret-store.test.js
+    test/underpost-gateway.test.js
+    test/underpost-ingress.test.js
+    test/wireguard-edge.test.js
+)
+
+c8 "${EXCLUDES[@]}" mocha "${TESTS[@]}"

package/scripts/k3s-node-setup.sh

@@ -49,22 +49,25 @@ if [ -z "$(ls -A "$ENGINE_ROOT")" ]; then
 fi
 
 # ---------------------------------------------------------------------------
-# NVM and Node.js — required for `node bin ...` entrypoints
+# System-wide Node.js is required by service units under SELinux.
 # ---------------------------------------------------------------------------
-echo "Installing NVM and Node.js v24.15.0..."
-
-curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
-
-export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
-# shellcheck disable=SC1090
-[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+if command -v dnf >/dev/null 2>&1; then
+    sudo dnf install -y policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
+fi
 
-nvm install 24.15.0
-nvm use 24.15.0
-nvm alias default 24.15.0
-ln -sf "$(command -v node)" /usr/local/bin/node
-ln -sf "$(command -v npm)" /usr/local/bin/npm
-ln -sf "$(command -v npx)" /usr/local/bin/npx
+if ! command -v node >/dev/null 2>&1 || ! node --version 2>/dev/null | grep -q '^v24'; then
+    echo "Installing system-wide Node.js 24..."
+    if command -v dnf >/dev/null 2>&1; then
+        curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
+        sudo dnf install -y nodejs
+    elif command -v apt-get >/dev/null 2>&1; then
+        curl -fsSL https://deb.nodesource.com/setup_24.x | sudo bash -
+        sudo apt-get install -y nodejs
+    else
+        echo "ERROR: a supported system package manager is required for Node.js 24" >&2
+        exit 1
+    fi
+fi
 
 echo "
 ██╗░░░██╗███╗░░██╗██████╗░███████╗██████╗░██████╗░░█████╗░░██████╗████████╗
@@ -116,7 +119,7 @@ if [ "$ROLE" = "control" ]; then
     curl -sfL https://get.k3s.io | \
     K3S_URL="https://${CONTROL_IP}:6443" \
     K3S_TOKEN="${K3S_TOKEN}" \
-    sh -s - agent
+    sh -s - agent $(if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then printf '%s' '--selinux'; fi)
     
     echo ""
     echo "K3s worker joined https://${CONTROL_IP}:6443 successfully."

package/scripts/kubeadm-node-setup.sh

@@ -5,8 +5,8 @@ set -euo pipefail
 # Underpost Kubeadm Node Setup (bare-metal physical node)
 #
 # Mirrors scripts/k3s-node-setup.sh but for kubeadm on real hardware: it runs on
-# the freshly deployed OS (disk-installed Rocky) after first boot, installs NVM +
-# Node.js, ensures the engine source is present, and drives the cluster bring-up
+# the freshly deployed OS (disk-installed Rocky) after first boot, installs
+# system-wide Node.js, ensures the engine source is present, and drives the cluster bring-up
 # through the local engine entrypoint `node bin cluster` (src/cli/cluster.js) —
 # reusing its kubeadm + Contour + host-init logic instead of reimplementing it.
 #
@@ -146,33 +146,22 @@ if [ "$JOIN_ONLY" = "1" ]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 0. Base prerequisites — a minimal @core Rocky install lacks tar/xz/git, which
-#    NVM needs to extract Node.js and the engine clone needs. Install them first.
+# 0. Base prerequisites.
 # ---------------------------------------------------------------------------
-log "Installing base prerequisites (tar, xz, gzip, git, curl)..."
-sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils 2>/dev/null \
-|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils
+log "Installing base prerequisites..."
+sudo dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit 2>/dev/null \
+|| dnf install -y tar xz gzip bzip2 git curl ca-certificates which findutils policycoreutils policycoreutils-python-utils selinux-policy-targeted audit
 
 # ---------------------------------------------------------------------------
-# 1. NVM and Node.js — required for the `node bin ...` entrypoints. Idempotent so
-#    a retried run does not reinstall Node from scratch.
+# 1. System-wide Node.js. Home-directory runtimes cannot be used by hardened
+#    systemd services under SELinux.
 # ---------------------------------------------------------------------------
 if command -v node >/dev/null 2>&1 && node --version 2>/dev/null | grep -q '^v24'; then
-    log "Node.js $(node --version) already installed; skipping NVM setup"
+    log "Node.js $(node --version) already installed"
 else
-    log "Installing NVM and Node.js v24.15.0..."
-    curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
-    
-    export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
-    # shellcheck disable=SC1090
-    [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
-    
-    nvm install 24.15.0
-    nvm use 24.15.0
-    nvm alias default 24.15.0
-    ln -sf "$(command -v node)" /usr/local/bin/node
-    ln -sf "$(command -v npm)" /usr/local/bin/npm
-    ln -sf "$(command -v npx)" /usr/local/bin/npx
+    log "Installing system-wide Node.js 24..."
+    curl -fsSL https://rpm.nodesource.com/setup_24.x | sudo bash -
+    sudo dnf install -y nodejs
 fi
 
 echo "

package/scripts/nat-iptables.sh

@@ -32,16 +32,24 @@ sudo firewall-cmd --permanent --zone=public --add-service=ssh
 sudo firewall-cmd --permanent --zone=public --add-service=http
 sudo firewall-cmd --permanent --zone=public --add-service=https
 
+# QUIC / HTTP3. The `https` service above covers TCP 443 only, so without this
+# an HTTP/3 gateway advertises `Alt-Svc: h3=":443"` and every client that acts
+# on it silently fails over UDP while HTTP/2 keeps working.
+sudo firewall-cmd --permanent --zone=public --add-port=443/udp
+sudo firewall-cmd --permanent --zone=public --add-port=80/udp
+
 echo "[INFO] Opening Kubernetes control plane ports..."
 
 # Kubernetes API Server
 sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=6443/udp
 
 # etcd
 sudo firewall-cmd --permanent --zone=public --add-port=2379-2380/tcp
 
 # kubelet API
 sudo firewall-cmd --permanent --zone=public --add-port=10250/tcp
+sudo firewall-cmd --permanent --zone=public --add-port=10250/udp
 
 # kube-scheduler
 sudo firewall-cmd --permanent --zone=public --add-port=10259/tcp
@@ -98,10 +106,10 @@ sudo firewall-cmd --reload
 echo
 echo "[INFO] Sysctl status:"
 sudo sysctl \
-  net.ipv4.ip_forward \
-  net.ipv6.conf.all.forwarding \
-  net.bridge.bridge-nf-call-iptables \
-  net.bridge.bridge-nf-call-ip6tables
+net.ipv4.ip_forward \
+net.ipv6.conf.all.forwarding \
+net.bridge.bridge-nf-call-iptables \
+net.bridge.bridge-nf-call-ip6tables
 
 echo
 echo "[INFO] Firewall status:"