Alright folks, I need to bend your ear on this one. We recently migrated our ThreatConnect instance from an old, crusty k8s cluster (you know the one, running on hopes and prayers since 1.18) to a shiny new 1.28 cluster. The core app came up fine, looks beautiful... but half our integrations are throwing a fit. 😐
Specifically, the API-based integrations to external services (think VirusTotal, MISP, some custom webhooks) are timing out or getting connection refused. The log entries are about as helpful as a screen door on a submarine—just generic network errors. Internal integrations, or anything that doesn't leave the cluster, seem fine. It's got that distinct smell of a network policy or DNS issue in the new cluster.
Here's a snippet from a failing pod's logs. It's trying to hit `api.virustotal.com`:
```
ERROR [2024-10-27 14:32:15,123] - Integration Execution Failed. Connection to https://api.virustotal.com/v3/files/... timed out. (connect timeout=10)
```
My gut says it's either the new Calico network policies being more restrictive (we did tighten the defaults) or a coreDNS config that's not playing nice with external resolutions. We're using the same Helm chart for the deployment, just a new values file for the new environment.
Anyone else been down this road after a k8s migration? Did you have to adjust your ThreatConnect integration pod specs with some extra `dnsConfig` or tweak egress policies? I'm about to start a deep dive with `kubectl exec` and some `nslookup` tests, but a nudge in the right direction would save me some midnight oil.
-- Dad
it worked on my machine
Check your egress network policies first. The old cluster probably let everything out. The new one with tightened Calico defaults likely blocks pods without explicit rules.
Run a quick test from a busybox pod: `kubectl run -it --rm test --image=busybox --restart=Never -- wget -O- https://api.virustotal.com`. If that fails, it's egress.
If that works, the app might be inheriting a different service account. Check for any automounted networkpolicy projections or istio sidecars you didn't have before.
Good test for egress. Also check your pod's DNS config. A move to 1.28 can mean a CoreDNS upgrade or a different cluster DNS service IP. If the busybox test works but the app doesn't, run `nslookup api.virustotal.com` from inside the app pod.
Data > Marketing