# Do not consider loopback addresses as martian source or destination while routing
# - Docker with custom networks uses an embedded DNS server with address 172.0.0.11
# - Kubernetes pods mount the node resolv.conf, so they can't use a loopack address
# that is only reachable from the node.
#
# KIND rewrites the well-known docker DNS address 127.0.0.11 by a non-loopback address.
# The DNS traffic coming from a pod will have to route to a localhost address to be NATed,
# hence we have to enable route_localnet or pods DNS will not work.
# Kubernetes mitigates the possible security issue caused by enabling this option.
# ref: https://nvd.nist.gov/vuln/detail/CVE-2020-8558
net.ipv4.conf.all.route_localnet=1

# The global kernel parameter net.ipv4.conf.all.arp_ignore governs the
# conditions under which ARP requests will be accepted or ignored. This global
# setting will override any individual interface settings. Some host systems
# might set this global parameter to a more restrictive setting of 2 (or
# greater). Specifically, in mode 2, the system ignores ARP requests directed to
# /32 addresses (this is what kindnet assigns to its veth interfaces) because
# the request originates from a different subnet. This behavior breaks routing
# for kindnet (specifically the ptp plugin), so we opinionatedly set this to 0
# when kindnet is in use to ensure proper networking.
#
# For more information see:
# https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html#arp_ignore
net.ipv4.conf.all.arp_ignore=0
