Adds a complete Kubernetes sidecar setup under testing/k8s/ that runs
FIPS as a sidecar container, injecting the mesh TUN interface (fips0)
into any co-located app container via shared pod network namespace.
- Multi-stage Dockerfile builds fips and fipsctl from source (debian
trixie / rust slim-trixie), producing a minimal runtime image with
iproute2, iptables, dnsmasq, and the two binaries
- entrypoint.sh generates fips.yaml from environment variables, rewrites
/etc/resolv.conf to route .fips DNS through dnsmasq, applies optional
iptables isolation, clamps TCP MSS, then starts dnsmasq and execs the
daemon
- pod.yaml annotated example Pod manifest with Secret, sysctl tuning,
readiness/liveness probes, and resource limits
- scripts/build.sh convenience wrapper for docker build
- testing/k8s/.dockerignore keeps the build context small
- README.md usage guide covering quick start, isolation modes, env vars,
multi-peer JSON config, troubleshooting
The PTB source was set to the local FIPS address, which Linux ignores
(loopback PTB security check). Change the source to the original
packet's destination (the remote peer) so the kernel sees it as coming
from a remote router and honors the PMTU update.
Add test coverage for the PTB source address invariant in both the
icmp unit tests and the node integration tests.
Cherry-picked from v0l PR #6 (issue #5):
1. remove_active_peer() now removes the end-to-end session from
self.sessions when evicting a peer. The stale Established entry
caused initiate_session() to silently return Ok(()) via the
is_established() guard, preventing session re-establishment after
link-layer reconnection.
2. initiate_peer_connections() pre-seeds the identity cache from
configured peer npubs at startup, so TUN packets can be dispatched
immediately without waiting for handshake completion.
3. schedule_reconnect() preserves accumulated backoff when a retry
entry already exists, preventing exponential backoff reset on
repeated link-dead cycles.
Includes regression tests for all three fixes.
Kieran
