From d4aa25d36804fea1595cbbbd49770f697d3e2af3 Mon Sep 17 00:00:00 2001 From: Ryan Yin Date: Sat, 24 Oct 2026 12:28:55 +0800 Subject: [PATCH] fix(k3s): deny pod sources the etcd client port 2379 The etcd client API listens on the masters' static LAN address, and the pod-source deny lists omitted it. Add 2379 to both nft drop lines and assert it in the security-k3s-pod-firewall eval test. 2381 (etcd metrics, scraped by in-cluster monitoring) stays reachable by design. Pairs with the matching Cilium egressDeny port in k8s-gitops. Assisted-by: DeepSeek Harness (gpt-6-astra) --- lib/genK3sAgentModule.nix | 4 ++-- lib/genK3sServerModule.nix | 4 ++-- outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix | 1 + 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/lib/genK3sAgentModule.nix b/lib/genK3sAgentModule.nix index acd7703f..42249b5a 100644 --- a/lib/genK3sAgentModule.nix +++ b/lib/genK3sAgentModule.nix @@ -20,8 +20,8 @@ in # Deny pods the credential-bearing host ports before the pod accept below. networking.firewall.extraInputRules = pkgs.lib.mkAfter '' - ip saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop - ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop + ip saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop + ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop ip saddr 10.0.0.0/8 accept ip6 saddr fd00::/104 accept ''; diff --git a/lib/genK3sServerModule.nix b/lib/genK3sServerModule.nix index 821e6dc4..a5fe5ca8 100644 --- a/lib/genK3sServerModule.nix +++ b/lib/genK3sServerModule.nix @@ -47,8 +47,8 @@ in # Deny pods the credential-bearing host ports before the pod accept below. networking.firewall.extraInputRules = lib.mkAfter '' - ip saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop - ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop + ip saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop + ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 2379, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop ip saddr 10.0.0.0/8 accept ip6 saddr fd00::/104 accept ''; diff --git a/outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix b/outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix index df2ab437..77665d2d 100644 --- a/outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix +++ b/outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix @@ -28,6 +28,7 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) ( && acceptAt != null && dropAt < acceptAt && lib.hasInfix "2049" rules + && lib.hasInfix "2379" rules && lib.hasInfix "5432" rules && lib.hasInfix "5902" rules )