will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix gluetun routing deadlock: aggressively remove rule 100 from startup

Browse Source
This commit is contained in:
Will Anderson
2026-04-15 02:03:32 -05:00
parent 7e5ba1a288
commit c2a936f790
1 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/k8s/media/fornax-workers.yaml
+18 -14
View File
@@ -127,7 +127,7 @@ spec:
memory: 512Mi memory: 512Mi
cpu: 200m cpu: 200m
# Port forwarding helper — fixes gluetun routing rule then watches for VPN port assignment # Port forwarding helper — aggressively fixes gluetun routing rule, then watches for VPN port
- name: portforward-helper - name: portforward-helper
image: alpine:latest image: alpine:latest
securityContext: securityContext:
@@ -137,18 +137,18 @@ spec:
- sh - sh
- -c - -c
- | - |
# Wait for gluetun to finish setting up its routing rules # gluetun adds 'ip rule priority 100 from <pod-IP> lookup 200' which routes ALL pod
# traffic through eth0. iptables OUTPUT DROP then blocks non-VPN traffic, including
# gluetun's own health check. Remove rule 100 aggressively from startup — BEFORE
# gluetun can complete its first health check — so tun0 routing (rule 101) takes over.
echo "Starting routing fix loop..."
(while true; do ip rule del priority 100 2>/dev/null; sleep 1; done) &
echo "Waiting for gluetun health endpoint..." echo "Waiting for gluetun health endpoint..."
while ! wget -q -T 3 -O- http://127.0.0.1:9999 > /dev/null 2>&1; do sleep 3; done until wget -q -T 3 -O- http://127.0.0.1:9999 > /dev/null 2>&1; do sleep 3; done
echo "gluetun ready" echo "gluetun ready — VPN is up"
# gluetun adds 'ip rule priority 100 from <pod-IP> lookup 200' which routes # Install curl now that VPN is routing correctly
# ALL pod traffic through eth0, bypassing tun0. The iptables OUTPUT DROP policy
# then blocks non-VPN, non-cluster traffic. Removing rule 100 allows traffic to
# fall through to 'priority 101 not fwmark 0xca6c lookup 51820' (tun0/VPN).
ip rule del priority 100 2>/dev/null && echo "Fixed VPN routing (removed rule 100)" || echo "Rule 100 not present"
# Install curl (succeeds now that VPN traffic routes correctly)
until apk add -q curl 2>/dev/null; do sleep 5; done until apk add -q curl 2>/dev/null; do sleep 5; done
echo "Watching /tmp/gluetun/forwarded_port for assigned port..." echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
@@ -373,11 +373,15 @@ spec:
- sh - sh
- -c - -c
- | - |
echo "Starting routing fix loop..."
(while true; do ip rule del priority 100 2>/dev/null; sleep 1; done) &
echo "Waiting for gluetun health endpoint..." echo "Waiting for gluetun health endpoint..."
while ! wget -q -T 3 -O- http://127.0.0.1:9999 > /dev/null 2>&1; do sleep 3; done until wget -q -T 3 -O- http://127.0.0.1:9999 > /dev/null 2>&1; do sleep 3; done
echo "gluetun ready" echo "gluetun ready — VPN is up"
ip rule del priority 100 2>/dev/null && echo "Fixed VPN routing (removed rule 100)" || echo "Rule 100 not present"
until apk add -q curl 2>/dev/null; do sleep 5; done until apk add -q curl 2>/dev/null; do sleep 5; done
echo "Watching /tmp/gluetun/forwarded_port for assigned port..." echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
TTL=300 TTL=300
while true; do while true; do