* Why is the src_valid_mark needed and not allowed (in kubernetes)?
@ 2022-05-05 20:01 Nico Schottelius
0 siblings, 0 replies; only message in thread
From: Nico Schottelius @ 2022-05-05 20:01 UTC (permalink / raw)
while debugging wireguard in Kubernetes, we noticed that adding a
default route for IPv4 is not possible/allowed, wg-quick fails with:
sysctl: error setting key 'net.ipv4.conf.all.src_valid_mark': Read-only file system
Which can be traced back to:
[[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1
function of wg-quick. If one tries to escape this using a pod
specification to set the sysctl using
- name: net.ipv4.conf.all.src_valid_mark
Kubernetes by default disallows it and returns a "SysctlForbidden"
Now, one can easily "fool" wg-quick using
AllowedIPs = 0.0.0.0/1, 220.127.116.11/1
AllowedIPs = 0.0.0.0/0
which makes the container work w/o the sysctl, as the add_default()
function is not called. Running it like this in kubernetes results in:
+ wg show
public key: HV9IgFLPSHJgG4jbDzaJg97Uch3eebrV5we4wUkAcUg=
private key: (hidden)
listening port: 51828
allowed ips: 0.0.0.0/1, 18.104.22.168/1
And allows outside IPv4 communication within an IPv6 only kubernetes
cluster, which was the objective in the first place.
- Why is net.ipv4.conf.all.src_valid_mark needed?
- And why does working around using 0.0.0.0/1, 22.214.171.124/1 works /
what is the drawback of this?
Best regards and a good evening from container land,
Sustainable and modern Infrastructures by ungleich.ch
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2022-05-05 20:20 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-05 20:01 Why is the src_valid_mark needed and not allowed (in kubernetes)? Nico Schottelius
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).