jakman85andClaude Opus 5.5
f13d336630
Add the at-home peer (10.90.0.3) and list ${WG_CLIENT_CIDR} in the PiHole
DNS frontends' loadBalancerSourceRanges. wg0 is a Cilium device, so tunnel
clients reach the source-range check untranslated; a LAN-only list is
predicted to drop their DNS. Adds an L0 guard that both ranges are present
and every range is RFC1918, and corrects the README's SNAT and IPv6 claims.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
40 lines
2.0 KiB
YAML
40 lines
2.0 KiB
YAML
# =============================================================================
|
|
# L0 STATIC — PiHole's DNS frontends admit the LAN and the VPN, and nothing public
|
|
# Catalog: docs/14 L0 row ("Pre-apply, in CI") — runs WITHOUT a cluster.
|
|
#
|
|
# loadBalancerSourceRanges is the only thing keeping PiHole from being an open resolver, and it
|
|
# must also carry the WireGuard client subnet, because Cilium load-balances tunnel traffic on wg0
|
|
# before the iptables MASQUERADE (so the source it tests is still 10.90.0.x). check.sh's header
|
|
# states the assertions and what they do not prove.
|
|
#
|
|
# STATUS: EXECUTABLE. `check.sh` is a pure offline assertion script (standard library + PyYAML);
|
|
# conformance/run.sh --layer l0 runs it directly and this Chainsaw Test wraps the SAME script.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: pihole-dns-source-ranges
|
|
labels:
|
|
conformance.home.k3s/R-DNS-03: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-DNS-03"
|
|
conformance.home.k3s/layer: "L0"
|
|
# WHOLE-REPO SCOPE: ci/touched-requirements.sh maps apps/* to no R-DNS requirement, so a change
|
|
# to these Services would otherwise select nothing.
|
|
conformance.home.k3s/scope: "whole-repo"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/executable: "true"
|
|
conformance.home.k3s/intent: >-
|
|
Every PiHole LoadBalancer Service lists both the LAN and the WireGuard client subnet in
|
|
loadBalancerSourceRanges, and every range resolves to RFC1918, so VPN clients can resolve
|
|
and PiHole stays unreachable from the internet.
|
|
spec:
|
|
steps:
|
|
- name: assert-pihole-source-ranges
|
|
description: >-
|
|
Collect the PiHole LoadBalancer Services, resolve each source range through cluster-vars,
|
|
and assert both required ranges are present and every range is private.
|
|
try:
|
|
- script:
|
|
content: bash ./check.sh
|