starred/nix-config-ryan4yin
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:36 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

fix(k3s): deny pod sources the etcd client port 2379

Browse Source 
The etcd client API listens on the masters' static LAN address, and the
pod-source deny lists omitted it. Add 2379 to both nft drop lines and
assert it in the security-k3s-pod-firewall eval test. 2381 (etcd
metrics, scraped by in-cluster monitoring) stays reachable by design.

Pairs with the matching Cilium egressDeny port in k8s-gitops.

Assisted-by: DeepSeek Harness (gpt-6-astra)
This commit is contained in:
Ryan Yin authored and ryan4yin | 二花 committed 2026-10-24 14:16:14 +08:00
1 parent f564807ac5
commit d4aa25d368
3 files changed
+5 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

lib/genK3sAgentModule.nix
+2 -2
View File
@@ -20,8 +20,8 @@ in
# Deny pods the credential-bearing host ports before the pod accept below. # Deny pods the credential-bearing host ports before the pod accept below.
networking.firewall.extraInputRules = pkgs.lib.mkAfter '' networking.firewall.extraInputRules = pkgs.lib.mkAfter ''
ip saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop ip saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
ip saddr 10.0.0.0/8 accept ip saddr 10.0.0.0/8 accept
ip6 saddr fd00::/104 accept ip6 saddr fd00::/104 accept
''; '';
lib/genK3sServerModule.nix
+2 -2
View File
@@ -47,8 +47,8 @@ in
# Deny pods the credential-bearing host ports before the pod accept below. # Deny pods the credential-bearing host ports before the pod accept below.
networking.firewall.extraInputRules = lib.mkAfter '' networking.firewall.extraInputRules = lib.mkAfter ''
ip saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop ip saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
ip saddr 10.0.0.0/8 accept ip saddr 10.0.0.0/8 accept
ip6 saddr fd00::/104 accept ip6 saddr fd00::/104 accept
''; '';
outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix
+1
View File
@@ -28,6 +28,7 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
&& acceptAt != null && acceptAt != null
&& dropAt < acceptAt && dropAt < acceptAt
&& lib.hasInfix "2049" rules && lib.hasInfix "2049" rules
&& lib.hasInfix "2379" rules
&& lib.hasInfix "5432" rules && lib.hasInfix "5432" rules
&& lib.hasInfix "5902" rules && lib.hasInfix "5902" rules
) )