From 39b180aec964075af468a87056aa67db3b507b21 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 21 Jul 2026 22:12:44 +1000 Subject: [PATCH] bind-internal: allow k8s pod network to query the resolvers (#271) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Kubernetes nodes querying the bind-resolvers LoadBalancer VIP (198.18.200.7) get REFUSED (EDE 18 Prohibited). The service is `externalTrafficPolicy: Local`, which preserves the client source IP for traffic entering the cluster from outside — but a node querying the VIP never leaves via OSPF. Its own kube-proxy DNATs the LB IP in the OUTPUT chain and masquerades the source to a cluster-internal address (the node's flannel.1, e.g. 10.42.x.x). That address is not in `acl-main.unkin.net`, so the openforwarder view's match-clients rejects the query. External clients preserve their real source IP and match acl-main, which is why only in-cluster hosts were affected. Add `10.42.0.0/16` to `acl-main.unkin.net` so node-originated (masqueraded) resolver queries are permitted. This mirrors the authoritative cluster, which already allows the pod network (`allow-query { ...; 10.42.0.0/16; }`). Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/271 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/bind-internal/resolvers/acls.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/apps/base/bind-internal/resolvers/acls.yaml b/apps/base/bind-internal/resolvers/acls.yaml index c2f8eaa..05a7f4f 100644 --- a/apps/base/bind-internal/resolvers/acls.yaml +++ b/apps/base/bind-internal/resolvers/acls.yaml @@ -8,6 +8,7 @@ metadata: spec: clusterRef: bind-resolvers entries: + - 10.42.0.0/16 # k8s pod network (kube-proxy masquerades node-originated LB queries) - 198.18.1.10/32 - 198.18.2.160/27 - 198.18.21.160/27