konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

talos: loose rp_filter for dummy0 / AnyIP asymmetric paths

Browse Source 
Talos defaults net.ipv4.conf.*.rp_filter to 1 (strict). Strict RPF
drops packets whose return path doesn't match the ingress interface,
which kills the dummy0 AnyIP trick: ICMP to an LB VIP arrives on eth0
but the dst is claimed by dummy0, so strict RPF treats it as spoofed
and drops silently. Loose (2) accepts the packet as long as the source
is routable via any interface — standard for Kubernetes BGP setups.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
k.renner
2026-05-20 22:30:02 +02:00
co-authored by Claude Opus 4.7
parent bf38990cd3
commit a637483800
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kubernetes/talos/patches/cluster.yaml
+10
View File
@@ -26,6 +26,16 @@ machine:
nodeIP:
validSubnets:
- 10.2.40.0/24
sysctls:
# Loose reverse-path filtering (mode 2). Talos defaults to strict
# (mode 1), which drops packets whose return route doesn't match the
# ingress interface — including LB-VIP ICMP that arrives on eth0 but
# whose destination is claimed by dummy0 (see patches/k8s-*.yaml for
# the AnyIP dummy interface). Loose mode accepts the packet as long
# as the source is reachable via *some* interface, which is the
# standard requirement for Kubernetes BGP / AnyIP setups.
net.ipv4.conf.all.rp_filter: "2"
net.ipv4.conf.default.rp_filter: "2"
cluster:
controlPlane:
endpoint: https://k8s.renner.uno:6443