From 1972c9b0af700dfb75514052fcdcce0cc57ae9a8 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 2 May 2026 12:23:11 +0200 Subject: [PATCH] =?UTF-8?q?fix(otbr):=20drop=20hostNetwork=20=E2=80=94=20w?= =?UTF-8?q?rong=20abstraction=20for=20this=20pod?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OTBR's only outbound need is the spinel TCP connection to slzb-thread.renner.uno:6638. HA and matter-server reach OTBR's REST API via the ClusterIP Service. None of that requires the host's network namespace. The wiki's hostnetwork-app-workload-antipattern applies here. If border-router coordination on the IoT VLAN ever becomes a real requirement, the right answer is a Cilium-L2 LoadBalancer pinned IP (same shape as home-assistant-iot / mosquitto-iot), not hostNetwork. Co-Authored-By: Claude Opus 4.7 (1M context) --- kubernetes/apps/otbr/deployment.yaml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/kubernetes/apps/otbr/deployment.yaml b/kubernetes/apps/otbr/deployment.yaml index 846f1526..f069b279 100644 --- a/kubernetes/apps/otbr/deployment.yaml +++ b/kubernetes/apps/otbr/deployment.yaml @@ -16,11 +16,12 @@ spec: labels: app.kubernetes.io/name: otbr spec: - # OTBR needs a real network namespace it can attach the wpan0 Thread - # interface to + IPv6 forwarding. hostNetwork on edge keeps it on the - # same L2 as the network-attached SLZB Thread RCP. - hostNetwork: true - dnsPolicy: ClusterFirstWithHostNet + # Regular pod network. The only outbound this pod needs is the + # spinel TCP connection to slzb-thread.renner.uno:6638; everything + # else (HA, matter-server) talks to OTBR via the ClusterIP + # Service. If border-router coordination on the IoT VLAN is ever + # needed it gets its own Cilium-L2 LoadBalancer IP (analogous to + # home-assistant-iot / mosquitto-iot), not hostNetwork. nodeSelector: topology.kubernetes.io/zone: edge tolerations: