unkinben
39b180aec9
Kubernetes nodes querying the bind-resolvers LoadBalancer VIP (198.18.200.7) get REFUSED (EDE 18 Prohibited).
The service is `externalTrafficPolicy: Local`, which preserves the client source IP for traffic entering the cluster from outside — but a node querying the VIP never leaves via OSPF. Its own kube-proxy DNATs the LB IP in the OUTPUT chain and masquerades the source to a cluster-internal address (the node's flannel.1, e.g. 10.42.x.x). That address is not in `acl-main.unkin.net`, so the openforwarder view's match-clients rejects the query.
External clients preserve their real source IP and match acl-main, which is why only in-cluster hosts were affected.
Add `10.42.0.0/16` to `acl-main.unkin.net` so node-originated (masqueraded) resolver queries are permitted. This mirrors the authoritative cluster, which already allows the pod network (`allow-query { ...; 10.42.0.0/16; }`).
Reviewed-on: #271
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
70 lines
1.5 KiB
YAML
70 lines
1.5 KiB
YAML
# Internal client ACLs, mirrored from puppet /etc/named/acls.conf.
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindACL
|
|
metadata:
|
|
name: acl-main.unkin.net
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
entries:
|
|
- 10.42.0.0/16 # k8s pod network (kube-proxy masquerades node-originated LB queries)
|
|
- 198.18.1.10/32
|
|
- 198.18.2.160/27
|
|
- 198.18.21.160/27
|
|
- 198.18.2.192/27
|
|
- 198.18.21.192/27
|
|
# Admin/management access
|
|
- 10.10.12.200/32 # benvin workstation (wireguard)
|
|
- 198.18.21.160/32 # benvin router (also within 198.18.21.160/27 above)
|
|
- 198.18.13.0/24
|
|
- 198.18.14.0/24
|
|
- 198.18.15.0/24
|
|
- 198.18.16.0/24
|
|
- 198.18.17.0/24
|
|
- 198.18.18.0/24
|
|
- 198.18.19.0/24
|
|
- 198.18.20.0/24
|
|
- 198.18.21.0/24
|
|
- 198.18.22.0/24
|
|
- 198.18.23.0/24
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindACL
|
|
metadata:
|
|
name: acl-dmz
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
entries:
|
|
- 198.18.24.0/24
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindACL
|
|
metadata:
|
|
name: acl-common
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
entries:
|
|
- 198.18.25.0/24
|
|
- 198.18.26.0/24
|
|
- 198.18.27.0/24
|
|
- 198.18.28.0/24
|
|
- 198.18.29.0/24
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindACL
|
|
metadata:
|
|
name: acl-nomad-jobs
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
entries:
|
|
- 198.18.64.0/24
|
|
- 198.18.65.0/24
|
|
- 198.18.66.0/24
|
|
- 198.18.67.0/24
|
|
- 198.18.68.0/24
|
|
- 198.18.69.0/24
|