mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
Ryan Yin
d4aa25d368
The etcd client API listens on the masters' static LAN address, and the pod-source deny lists omitted it. Add 2379 to both nft drop lines and assert it in the security-k3s-pod-firewall eval test. 2381 (etcd metrics, scraped by in-cluster monitoring) stays reachable by design. Pairs with the matching Cilium egressDeny port in k8s-gitops. Assisted-by: DeepSeek Harness (gpt-6-astra)
35 lines
989 B
Nix
35 lines
989 B
Nix
{
|
|
lib,
|
|
outputs,
|
|
}:
|
|
let
|
|
# Index of the first occurrence of `needle` in `haystack`, or null.
|
|
firstIndex =
|
|
needle: haystack:
|
|
let
|
|
parts = lib.splitString needle haystack;
|
|
in
|
|
if builtins.length parts < 2 then null else builtins.stringLength (builtins.head parts);
|
|
in
|
|
lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
|
|
name:
|
|
let
|
|
cfg = outputs.nixosConfigurations.${name}.config;
|
|
rules = cfg.networking.firewall.extraInputRules;
|
|
dropAt = firstIndex "saddr 10.0.0.0/8 tcp dport" rules;
|
|
acceptAt = firstIndex "saddr 10.0.0.0/8 accept" rules;
|
|
in
|
|
if !(cfg.services.k3s.enable or false) then
|
|
true
|
|
else
|
|
# The port deny must exist and must precede the broad pod accept, because
|
|
# nftables takes the first matching rule.
|
|
dropAt != null
|
|
&& acceptAt != null
|
|
&& dropAt < acceptAt
|
|
&& lib.hasInfix "2049" rules
|
|
&& lib.hasInfix "2379" rules
|
|
&& lib.hasInfix "5432" rules
|
|
&& lib.hasInfix "5902" rules
|
|
)
|