From dbb4cb75dbcfc864f9231299f5d0cfdd60987562 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 21 Jul 2026 22:08:39 +1000 Subject: [PATCH] bind-internal: allow k8s pod network to query the resolvers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Kubernetes nodes querying the bind-resolvers LoadBalancer VIP (198.18.200.7) get REFUSED (EDE 18 Prohibited). The service is externalTrafficPolicy: Local, which preserves the client source IP for traffic entering the cluster from outside — but a node querying the VIP never leaves via OSPF. Its own kube-proxy DNATs the LB IP in the OUTPUT chain and masquerades the source to a cluster-internal address (the node's flannel.1, e.g. 10.42.x.x). That address is not in acl-main.unkin.net, so the openforwarder view's match-clients rejects the query. External clients preserve their real source IP and match acl-main, which is why only in-cluster hosts were affected. Add 10.42.0.0/16 to acl-main.unkin.net so node-originated (masqueraded) resolver queries are permitted. This mirrors the authoritative cluster, which already allows the pod network (allow-query { ...; 10.42.0.0/16; }). --- apps/base/bind-internal/resolvers/acls.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/apps/base/bind-internal/resolvers/acls.yaml b/apps/base/bind-internal/resolvers/acls.yaml index c2f8eaa..05a7f4f 100644 --- a/apps/base/bind-internal/resolvers/acls.yaml +++ b/apps/base/bind-internal/resolvers/acls.yaml @@ -8,6 +8,7 @@ metadata: spec: clusterRef: bind-resolvers entries: + - 10.42.0.0/16 # k8s pod network (kube-proxy masquerades node-originated LB queries) - 198.18.1.10/32 - 198.18.2.160/27 - 198.18.21.160/27 -- 2.47.3