ab/homelab
1
1
Fork 1
Code Issues Pull Requests 168 Actions Packages Wiki Activity

Fixed AWG scripts
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 5s
Details
Check with kubeconform / lint (push) Successful in 6s
Details
Auto-update README / Generate README and Create MR (push) Successful in 5s
Details

Browse Source
This commit is contained in:
ab
2026-09-17 17:48:53 +03:00
parent 5783547bd3
commit 0c333375a5
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/apps/amnezia/configmap-scripts.yaml
+7 -3
View File
@@ -276,9 +276,13 @@ data:
exit 1
fi
FIRST_FORWARD_RULE="$("${IPTABLES[@]}" -S FORWARD | grep '^-A FORWARD ' | sed -n '1p')"
[[ "${FIRST_FORWARD_RULE}" == *"--comment amneziawg-forward-jump"* ]]
[[ "${FIRST_FORWARD_RULE}" == *"-j ${FORWARD_CHAIN}"* ]]
# The amneziawg FORWARD jump must be present. firewall-up inserts it at
# position 1, but CNI controllers (e.g. kube-router) legitimately re-assert
# their own jump ahead of it. Requiring the strict first position makes the
# readiness probe flap as the two fight over rule order. Isolation still holds
# as long as the jump is traversed and no earlier rule accepts awg0-to-awg0
# traffic (kube-router's chain returns non-pod traffic without a decision).
"${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
ACTIVE_POLICY="$("${IPTABLES[@]}" -S "${FORWARD_CHAIN}" 2>/dev/null \
| awk '$1 == "-A" && $3 == "-j" && $4 ~ /^AMNEZIAWG-POLICY-[AB]$/ { print $4; exit }')"
[ -n "${ACTIVE_POLICY}" ]