Calico

WireGuard Kernel Module Silently Overwrites AllowedIPs in Trie, Breaking Peer Routing Without Errors

The WireGuard kernel module stores AllowedIPs in a single prefix trie per device rather than per peer, causing exact-match insertions of identical CIDR prefixes to reassign nodes and remove them from the previous peer's list. This behavior silently drops routing for affected peers while handshakes and inbound traffic continue, leading to one-way connectivity failures and frame errors. The issue affects road-warrior setups using 0.0.0.0/0, mesh networks, Kubernetes CNI plugins such as Cilium and Calico, and network operating systems including VyOS and OPNsense. No warning is emitted by wg, wg-quick, or the kernel on overwrite, and the longest-prefix-match lookup ensures only equal-length prefixes collide. The root cause resides in allowedips.c where rcu_assign_pointer redirects the trie node and list_move_tail detaches it from the original peer. The same logic appears across Linux, wireguard-go, wireguard-nt, FreeBSD, and OpenBSD implementations.

5 NetworkPolicy Mistakes That Leave Kubernetes Clusters Completely Unprotected

A detailed analysis from OTUS highlights five frequent configuration errors in Kubernetes NetworkPolicy that allow unrestricted traffic despite policies appearing active in the cluster. The article explains that Kubernetes itself does not enforce NetworkPolicy objects; enforcement depends entirely on the CNI plugin such as Calico, Cilium, or Weave Net, while Flannel and kubenet ignore them entirely. Common pitfalls include blocking DNS resolution when applying default-deny egress rules, incorrect use of namespaceSelector versus podSelector leading to overly permissive access, and confusing the top-level podSelector with selectors inside ingress or egress blocks. Additional issues arise when policies fail to account for ingress controllers, hostNetwork pods, or inter-container localhost communication within the same pod. The piece stresses the importance of traffic-based validation rather than relying on kubectl output and recommends testing with deny-all policies plus continuous monitoring during rollout.