silly-thailand-99259
06/15/2022, 6:19 PMhostNetwork
). But after few minutes of deploying this pod, the DNS stops working. I have already set the dnsPolicy
to ClusterFirstWithHostNet
.
You can find some more details here https://www.reddit.com/r/kubernetes/comments/vd0g09/dns_stops_working_when_using_hostnetwork/rough-application-24965
06/16/2022, 4:17 AMwhite-napkin-85004
06/16/2022, 7:01 AMdry-monkey-93718
06/16/2022, 9:21 AMsilly-thailand-99259
06/16/2022, 9:22 AMv1.23.5
and yes, the kube dns pod is healthy.
DNS breaks only on this pod where WireGuard is running. DNS is working fine on other pods.rough-application-24965
06/16/2022, 9:26 AMdry-monkey-93718
06/16/2022, 9:28 AMsilly-thailand-99259
06/16/2022, 9:28 AMhostNetwork
privilege as it allows adding adding ip route
on the node network.rough-application-24965
06/16/2022, 9:33 AMsilly-thailand-99259
06/16/2022, 9:37 AMhostNetwork: true
), the DNS works just fine, the WireGuard tunnels come up and I can send traffic through these tunnels from outside.
When I re-deploy after enabling host networking, the pods works fine for some time (say 5 minutes), after which I get logged out from the pod (if I have attached a terminal to it using kubectl exec
). After this logout, this DNS stops working, The service running on this WireGuard pod cannot resolve any other service FQDN.are these devices outside the kubernetes cluster?
if they are you need to use ingresscurrently I am using NodePort for exposing the WireGuard port. I am aware that I would require an ingress for this, but I want the routing to working before spending time on setting up ingress.
dry-monkey-93718
06/16/2022, 9:41 AMkubectl get po
rough-application-24965
06/16/2022, 9:41 AMsilly-thailand-99259
06/16/2022, 9:42 AMrough-application-24965
06/16/2022, 9:45 AMsilly-thailand-99259
06/16/2022, 9:46 AMrough-application-24965
06/16/2022, 9:46 AMsilly-thailand-99259
06/16/2022, 9:47 AMip route
ip route add <subnet> via <private-vpc-ip-of-wireguard-node>
rough-application-24965
06/16/2022, 9:50 AMdry-monkey-93718
06/16/2022, 9:50 AMsilly-thailand-99259
06/16/2022, 9:51 AMI have a feeling that you're trying to solve problems on k8s like a VM and struggling because it doesn't work like thatI agree to this. This is my first time working with K8s. š
if they are in the same kubernetes won't they share the same network as the wiregaurd one?the WireGuard tunnels have completely different subnet from the VPC of the cluster. the application is only aware of the WireGuard peers IP address. the application sends network packets with WireGuard peer IP address.
app
pings the the device with WireGuard address 172.16.0.2
.
the ICMP request packet has to be routed from app
pod to the `wireguard`` pod and reverse with the response packetdry-monkey-93718
06/16/2022, 9:56 AMrough-application-24965
06/16/2022, 9:57 AMdry-monkey-93718
06/16/2022, 9:57 AMcan these two subnets talk to each other?That's what he's trying to do with
ip route
on the other pod + wireguard tunnel from this onerough-application-24965
06/16/2022, 9:57 AMsilly-thailand-99259
06/16/2022, 9:59 AMrough-application-24965
06/16/2022, 10:00 AMsilly-thailand-99259
06/16/2022, 10:01 AMapp
pod to the wiregaurd
pod for a specific subnet (say 172.16.0.0/24
)rough-application-24965
06/16/2022, 10:05 AMsilly-thailand-99259
06/16/2022, 10:10 AMwireguard
pod from the app
pod yesterday. I don't remember whether I was able to ping the device's IP address from the app
pod.dry-monkey-93718
06/16/2022, 10:25 AMsilly-thailand-99259
06/16/2022, 10:37 AMdry-monkey-93718
06/16/2022, 10:52 AMsilly-thailand-99259
06/16/2022, 10:52 AM