fix(networkpolicy): allow DNS egress to link-local resolvers (GKE Cloud DNS, NodeLocal DNSCache) - #4001
fix(networkpolicy): allow DNS egress to link-local resolvers (GKE Cloud DNS, NodeLocal DNSCache)#4001aqeelat wants to merge 1 commit into
Conversation
tekton-robot
added
the
release-note
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
tekton-robot
added
the
size/M
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4001 +/- ##
==========================================
+ Coverage 26.44% 26.46% +0.01%
==========================================
Files 465 465
Lines 24992 24997 +5
==========================================
+ Hits 6610 6615 +5
Misses 17661 17661
Partials 721 721
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
DNSEgressRule allowed DNS egress only to the kube-dns/CoreDNS pod peer. On GKE clusters using Cloud DNS, kubelet points every pod's resolv.conf at the link-local metadata server 169.254.169.254, which no pod selector can match, so DNS egress is dropped on Dataplane V2 clusters. NodeLocal DNSCache (169.254.20.10, GKE Autopilot default) has the same host-network property. Add ipBlock peers 169.254.169.254/32 and 169.254.20.10/32 (UDP+TCP 53) to the Kubernetes-platform DNS rule alongside the existing pod peer. Purely additive: on clusters not using these resolvers the peers never match. OpenShift unchanged. Fixes tektoncd#4000 Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)
4e35fa0 to
4a145dc
Compare
| return PlatformParams{ | ||
| DNSResolverNamespace: "kube-system", | ||
| DNSResolverPodLabel: map[string]string{"k8s-app": "kube-dns"}, | ||
| DNSResolverIPBlocks: []string{"169.254.169.254/32", "169.254.20.10/32"}, |
There was a problem hiding this comment.
Add comment here
// 169.254.169.254/32: GKE Cloud DNS forwarder (link-local, host-network).
There was a problem hiding this comment.
Not just GKE. I think aws and azure also have it.
BTW, I saw it in some charts as 169.254.0.0/16
Do we want that?
3 participants
Changes
DNSEgressRuleallowed DNS egress only to the kube-dns/CoreDNS pod peer. On GKE clusters using Cloud DNS, kubelet points every pod's resolv.conf at the link-local metadata server169.254.169.254, which no pod selector can match — so on Dataplane V2 clusters DNS egress is dropped and e.g.tekton-results-retention-policy-agentcrashloops. NodeLocal DNSCache (169.254.20.10) has the same host-network property.Adds
ipBlockpeers169.254.169.254/32and169.254.20.10/32(UDP+TCP 53) to the Kubernetes-platform DNS rule, alongside the existing pod peer. Purely additive — on clusters not using these resolvers the peers never match. OpenShift unchanged. Fixes #4000.Submitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
make test lintbefore submitting a PRSee the contribution guide for more details.
Release Notes
AI assistance: developed with opencode (GLM model) under my direction; every commit carries an
Assisted-by:trailer per the AI contribution policy. I drove scoping and decisions, reviewed every change, and verified each push — unit tests andmake test lintfor the touched packages.