fix(networkpolicy): allow DNS egress to link-local resolvers (GKE Cloud DNS, NodeLocal DNSCache) - #4001
fix(networkpolicy): allow DNS egress to link-local resolvers (GKE Cloud DNS, NodeLocal DNSCache)#4001aqeelat wants to merge 1 commit into
Conversation
tekton-robot
added
the
release-note
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
tekton-robot
added
the
size/M
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4001 +/- ##
==========================================
+ Coverage 26.44% 26.98% +0.53%
==========================================
Files 465 467 +2
Lines 24992 25179 +187
==========================================
+ Hits 6610 6794 +184
+ Misses 17661 17648 -13
- Partials 721 737 +16
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
4e35fa0 to
4a145dc
Compare
| return PlatformParams{ | ||
| DNSResolverNamespace: "kube-system", | ||
| DNSResolverPodLabel: map[string]string{"k8s-app": "kube-dns"}, | ||
| DNSResolverIPBlocks: []string{"169.254.169.254/32", "169.254.20.10/32"}, |
There was a problem hiding this comment.
Add comment here
// 169.254.169.254/32: GKE Cloud DNS forwarder (link-local, host-network).
There was a problem hiding this comment.
Not just GKE. I think aws and azure also have it.
BTW, I saw it in some charts as 169.254.0.0/16
Do we want that?
There was a problem hiding this comment.
the GCE/AWS IMDS IP is already in the list as a /32, so /16 doesnt add any functional value
There was a problem hiding this comment.
Added in bfe8b88, along with per-entry comments. On the /16 question: it turns out /16 would add one thing the two /32s lack — 169.254.169.253, the AWS VPC resolver (Route 53 Resolver is link-local too). I've added that as a /32 rather than widening to /16: with the three documented resolvers covered, the /16 would only add non-default NodeLocal localips, at the cost of exposing port 53 to the entire link-local range. On whether AWS/Azure "also have" 169.254.169.254 — as a DNS endpoint only GCP does; on AWS that address is IMDS (no DNS listener), and Azure's IMDS is 169.254.169.50 with Azure DNS at 168.63.129.16 (not link-local at all, so out of scope here). The rule stays port-scoped to 53, so IMDS on 80 remains blocked either way.
tekton-robot
added
size/L
|
@aqeelat PLease squash your commit; and will be happy to approve |
DNSEgressRule allowed DNS egress only to the kube-dns/CoreDNS pod peer. On GKE clusters using Cloud DNS, kubelet points every pod's resolv.conf at the link-local metadata server 169.254.169.254, which no pod selector can match, so DNS egress is dropped on Dataplane V2 clusters. NodeLocal DNSCache (169.254.20.10, GKE Autopilot default) has the same host-network property. Add ipBlock peers 169.254.169.254/32 and 169.254.20.10/32 (UDP+TCP 53) to the Kubernetes-platform DNS rule alongside the existing pod peer, plus 169.254.169.253/32 — the AWS VPC resolver (Route 53 Resolver). Default ClusterFirst pods never query the AWS resolver directly (they use the CoreDNS Service IP), but pods with custom DNS configuration do, so it is allowed for parity with the GKE entries. Azure is deliberately not covered: Azure DNS (168.63.129.16) is not a link-local endpoint. Each peer is documented inline. Purely additive: on clusters not using these resolvers the peers never match; the rule stays port-scoped to 53, so IMDS on 80 remains blocked. OpenShift unchanged. Fixes tektoncd#4000 Signed-off-by: Abdullah Alaqeel <abdullah.t.aqeel@gmail.com> Assisted-by: GLM (via opencode)
09cfcb1 to
bfe8b88
Compare
3 participants
Changes
DNSEgressRuleallowed DNS egress only to the kube-dns/CoreDNS pod peer. On GKE clusters using Cloud DNS, kubelet points every pod's resolv.conf at the link-local metadata server169.254.169.254, which no pod selector can match — so on Dataplane V2 clusters DNS egress is dropped and e.g.tekton-results-retention-policy-agentcrashloops. NodeLocal DNSCache (169.254.20.10) has the same host-network property.Adds
ipBlockpeers169.254.169.254/32and169.254.20.10/32(UDP+TCP 53) to the Kubernetes-platform DNS rule, alongside the existing pod peer. Purely additive — on clusters not using these resolvers the peers never match. OpenShift unchanged. Fixes #4000.Submitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
make test lintbefore submitting a PRSee the contribution guide for more details.
Release Notes
AI assistance: developed with opencode (GLM model) under my direction; every commit carries an
Assisted-by:trailer per the AI contribution policy. I drove scoping and decisions, reviewed every change, and verified each push — unit tests andmake test lintfor the touched packages.