From c2a936f790311de3150a2572738dc3f74d16972a Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Wed, 15 Apr 2026 02:03:32 -0500 Subject: [PATCH] Fix gluetun routing deadlock: aggressively remove rule 100 from startup --- servers/legion/k8s/media/fornax-workers.yaml | 32 +++++++++++--------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/servers/legion/k8s/media/fornax-workers.yaml b/servers/legion/k8s/media/fornax-workers.yaml index 780d0b6..d253aa8 100644 --- a/servers/legion/k8s/media/fornax-workers.yaml +++ b/servers/legion/k8s/media/fornax-workers.yaml @@ -127,7 +127,7 @@ spec: memory: 512Mi cpu: 200m - # Port forwarding helper — fixes gluetun routing rule then watches for VPN port assignment + # Port forwarding helper — aggressively fixes gluetun routing rule, then watches for VPN port - name: portforward-helper image: alpine:latest securityContext: @@ -137,18 +137,18 @@ spec: - sh - -c - | - # Wait for gluetun to finish setting up its routing rules + # gluetun adds 'ip rule priority 100 from lookup 200' which routes ALL pod + # traffic through eth0. iptables OUTPUT DROP then blocks non-VPN traffic, including + # gluetun's own health check. Remove rule 100 aggressively from startup — BEFORE + # gluetun can complete its first health check — so tun0 routing (rule 101) takes over. + echo "Starting routing fix loop..." + (while true; do ip rule del priority 100 2>/dev/null; sleep 1; done) & + echo "Waiting for gluetun health endpoint..." - while ! wget -q -T 3 -O- http://127.0.0.1:9999 > /dev/null 2>&1; do sleep 3; done - echo "gluetun ready" + until wget -q -T 3 -O- http://127.0.0.1:9999 > /dev/null 2>&1; do sleep 3; done + echo "gluetun ready — VPN is up" - # gluetun adds 'ip rule priority 100 from lookup 200' which routes - # ALL pod traffic through eth0, bypassing tun0. The iptables OUTPUT DROP policy - # then blocks non-VPN, non-cluster traffic. Removing rule 100 allows traffic to - # fall through to 'priority 101 not fwmark 0xca6c lookup 51820' (tun0/VPN). - ip rule del priority 100 2>/dev/null && echo "Fixed VPN routing (removed rule 100)" || echo "Rule 100 not present" - - # Install curl (succeeds now that VPN traffic routes correctly) + # Install curl now that VPN is routing correctly until apk add -q curl 2>/dev/null; do sleep 5; done echo "Watching /tmp/gluetun/forwarded_port for assigned port..." @@ -373,11 +373,15 @@ spec: - sh - -c - | + echo "Starting routing fix loop..." + (while true; do ip rule del priority 100 2>/dev/null; sleep 1; done) & + echo "Waiting for gluetun health endpoint..." - while ! wget -q -T 3 -O- http://127.0.0.1:9999 > /dev/null 2>&1; do sleep 3; done - echo "gluetun ready" - ip rule del priority 100 2>/dev/null && echo "Fixed VPN routing (removed rule 100)" || echo "Rule 100 not present" + until wget -q -T 3 -O- http://127.0.0.1:9999 > /dev/null 2>&1; do sleep 3; done + echo "gluetun ready — VPN is up" + until apk add -q curl 2>/dev/null; do sleep 5; done + echo "Watching /tmp/gluetun/forwarded_port for assigned port..." TTL=300 while true; do