<p>I have installed a k8s cluster on AWS with kops and I have followed instructions to deploy api-platform on that cluster with helm.</p>

<p>I don't understand why the php pod log shows a 405 when php-pod try to invalidate cache into varnish-pod.</p>

<p>In the Varnish pod inside /usr/local/etc/varnish/default.vcl my whitelist is the default one</p>

<pre><code># Hosts allowed to send BAN requests
acl invalidators {
  "localhost";
  "php";
}
</code></pre>

<p>UPDATE I think that the problem can be generalized in this way: from a pod A inside a service A I want to call a service B. I need that in the request (received in pod B) is preserved the IP of the service A not the IP of the pod A. </p>

<p>My original problem can be  summarize with:</p>

<p>from a pod A inside a service A I want to call a service B. I need that in the request (received in pod B) is preserved in the origin the IP  of the service A not the IP of the pod A.</p>

<p>But Kubernetes networking model need that:</p>

<ul>
<li>all containers can communicate with all other containers without NAT</li>
<li>all nodes can communicate with all containers (and vice-versa) without NAT</li>
<li>the IP that a container sees itself as is the same IP that others see it as</li>
</ul>

<p>So my needed can't be satisfied.</p>

<p>So my solution is to use <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/network-policies/</a> and not to rely to a ip-based whitelist in the varnish vcl config.</p>
