Access

Everything private on this platform is reachable only over Tailscale — there is no bastion host and no public IP with an allowlist, on either cloud. The access model is deliberately identical across AWS and GCP: connect to the tailnet, and every private service resolves under the cloud’s private domain. Only the endpoints differ — the private domain, the kubeconfig command, and where the operator credential lives.

Network

tailscale status

You should see the subnet router advertising the VPC CIDR — one router per cloud, both created in Stage 1 of their respective lanes. Every private service (OpenBao, the Kubernetes API, Grafana, Homepage, and so on) resolves under the private domain you set in the Terramate config — priv.aws.ogenki.io on AWS, priv.gcp.ogenki.io on GCP in the reference environment — and is only reachable once you are connected to the tailnet.

Access control is enforced by Tailscale ACLs, evaluated outside Kubernetes entirely; the ACL model and the two Gateways it feeds are covered in Private Access.

OpenBao

Prefer VAULT_CACERT over VAULT_SKIP_VERIFY on both clouds — it validates the server certificate against the real chain instead of skipping verification entirely. The CA file is written locally by openbao-config.sh ca during the deploy, under each management stack’s .tls/ directory.

AWS

export VAULT_ADDR=https://bao.priv.aws.ogenki.io:8200
export VAULT_CACERT=opentofu/aws/openbao/management/.tls/ca.pem
bao status
bao login -method=userpass username=admin

The admin password is generated by the openbao/management stack and published to AWS Secrets Manager:

aws secretsmanager get-secret-value \
  --secret-id openbao/cloud-native-ref/users/admin \
  --query SecretString --output text | jq

GCP

export VAULT_ADDR=https://bao.priv.gcp.ogenki.io:8200
export VAULT_CACERT=opentofu/gcp/openbao/management/.tls/ca.pem
bao status

The GCP management stack defines no userpass login — operator access is the root token written by openbao-config.sh init, published to GCP Secret Manager:

gcloud secrets versions access latest \
  --secret openbao-priv-gcp-root-token --project <your-project> | jq -r .token

Kubernetes

Both control planes have a private endpoint, so the tailnet must be up before either command can reach its cluster.

AWS

aws eks update-kubeconfig --region eu-west-3 --name aws-0
kubectl get nodes
flux get all

GCP

gcloud container clusters get-credentials gcp-0 \
  --zone europe-west4-a --project <your-project>
kubectl get nodes
flux get all

Platform Dashboard

On AWS, once Flux has reconciled Tooling, the Homepage dashboard aggregates every deployed service — Grafana, Harbor, Headlamp — behind one private hostname, alongside cluster health and documentation links. It is reached the same way as every other private service: over Tailscale, through the general Gateway.

GCP runs the tooling layer too, but only Harbor — not Homepage or Headlamp — so there is no dashboard there; see Cloud support for the current split.

Prerequisites First Application