Why is the src_valid_mark needed and not allowed (in kubernetes)?
nico.schottelius at ungleich.ch
Thu May 5 20:01:24 UTC 2022
while debugging wireguard in Kubernetes, we noticed that adding a
default route for IPv4 is not possible/allowed, wg-quick fails with:
sysctl: error setting key 'net.ipv4.conf.all.src_valid_mark': Read-only file system
Which can be traced back to:
[[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1
function of wg-quick. If one tries to escape this using a pod
specification to set the sysctl using
- name: net.ipv4.conf.all.src_valid_mark
Kubernetes by default disallows it and returns a "SysctlForbidden"
Now, one can easily "fool" wg-quick using
AllowedIPs = 0.0.0.0/1, 184.108.40.206/1
AllowedIPs = 0.0.0.0/0
which makes the container work w/o the sysctl, as the add_default()
function is not called. Running it like this in kubernetes results in:
+ wg show
public key: HV9IgFLPSHJgG4jbDzaJg97Uch3eebrV5we4wUkAcUg=
private key: (hidden)
listening port: 51828
allowed ips: 0.0.0.0/1, 220.127.116.11/1
And allows outside IPv4 communication within an IPv6 only kubernetes
cluster, which was the objective in the first place.
- Why is net.ipv4.conf.all.src_valid_mark needed?
- And why does working around using 0.0.0.0/1, 18.104.22.168/1 works /
what is the drawback of this?
Best regards and a good evening from container land,
Sustainable and modern Infrastructures by ungleich.ch
More information about the WireGuard