Pings from one another don't work.
kdc can't discover worker-3's ARP address. ARP discovery gets to worker-3, which replies back, but the reply never arrives at kdc's eth0 interface.
If the ARP address for worker-3 is added to kdc forcefully, ICMP echos go out and are received by worker-3 and replied back. However, replies don't arrive at kdc's eth0 interface.