Add iptables NETMAP init container to Plex for local network treatment

[Copilot]

Plex running on Wanda with Cilium CNI only treats clients as "local" when they originate from the same /16 subnet as the pod. Traffic arriving via LoadBalancer IP 10.151.24.161 appears to come from different subnets than the pod network 10.42.0.0/16, causing remote treatment.

Changes

• Added init container to kubernetes/apps/wanda/plex-patch.yaml that installs iptables and applies NETMAP SNAT rule
• Dynamic subnet detection extracts pod network prefix from pod IP at runtime
• Security context grants only NET_ADMIN and NET_RAW capabilities (no privileged mode)

initContainers:
  - name: setup-iptables
    image: alpine:3.21
    command:
      - /bin/sh
      - -c
      - |
        apk add --no-cache iptables
        POD_IP=$(hostname -i | awk '{print $1}')
        POD_SUBNET=$(echo $POD_IP | cut -d'.' -f1-2)
        iptables -t nat -A PREROUTING -p tcp --dport 32400 -j NETMAP --to ${POD_SUBNET}.0.0/16
    securityContext:
      capabilities:
        add: [NET_ADMIN, NET_RAW]

The NETMAP rule rewrites source addresses in PREROUTING to appear as though they originate from the pod network. Operates at pod network namespace level, compatible with Cilium eBPF datapath.

Original prompt

Problem

Plex running on the Wanda Kubernetes cluster with Cilium CNI only treats clients as "local" if they come from the same subnet as the Plex server pod. Currently:

• Plex pod IP: 10.42.9.231 (Kubernetes cluster network)
• LoadBalancer IP: 10.151.24.161 (native Unifi network range)
• Clients connecting through the LoadBalancer appear to come from different subnets and are not treated as "local"

Solution

Add an init container to the Plex deployment that sets up iptables SNAT rules to make incoming traffic appear to originate from the pod network (10.42.0.0/16). This will make Plex treat all clients as "local".

Implementation

Modify kubernetes/apps/wanda/plex-patch.yaml to add:

1. An initContainers section with:

   • Alpine-based init container
   • Privileged security context with NET_ADMIN and NET_RAW capabilities
   • Script to install iptables and configure NETMAP rules
   • Dynamic detection of pod subnet

2. The init container should:

   • Install iptables package
   • Get the pod's IP address dynamically
   • Extract the pod subnet (e.g., 10.42.0.0/16)
   • Apply NETMAP SNAT rules to port 32400 to make traffic appear from pod network
   • Log the applied rules for debugging

Technical Details

The iptables rule should use NETMAP target in the PREROUTING chain:

iptables -t nat -A PREROUTING -p tcp --dport 32400 -j NETMAP --to ${POD_SUBNET}.0.0/16

This approach operates at the pod network namespace level and works within Cilium's eBPF-based CNI.

Files to Modify

• kubernetes/apps/wanda/plex-patch.yaml - Add initContainers configuration under spec.values

Expected Behavior

After deployment:

• Plex will see all incoming connections as originating from the 10.42.0.0/16 network
• Clients will be treated as "local" regardless of their actual source network
• No changes required to Cilium configuration

Security Considerations

The init container requires elevated privileges (NET_ADMIN capability) to modify iptables. This is scoped to the pod's network namespace only and the init container terminates after setup.

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[autonomous-bancey]

Plan Result (test_vpn_gateway)

No changes. Your infrastructure matches the configuration.

[autonomous-bancey]

Plan Result (generate_ansible_inventory)

No changes. Your infrastructure matches the configuration.

[autonomous-bancey]

Plan Result (prod_twingate)

No changes. Your infrastructure matches the configuration.

[autonomous-bancey]

Plan Result (test_gameserver)

No changes. Your infrastructure matches the configuration.

[autonomous-bancey]

Plan Result (prod_vpn_gateway)

No changes. Your infrastructure matches the configuration.

[autonomous-bancey]

Plan Result (prod_gameserver)

No changes. Your infrastructure matches the configuration.

[autonomous-bancey]

Plan Result (prod_dns)

No changes. Your infrastructure matches the configuration.

[autonomous-bancey]

Plan Result (wanda_virtual_machines)

No changes. Your infrastructure matches the configuration.

[autonomous-bancey]

Plan Result (tiny_virtual_machines)

No changes. Your infrastructure matches the configuration.