From dae312ba5d89e6d05c70e85283fbb5e329bb9720 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 18 Apr 2026 22:28:29 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20Cilium=20lbExternalClusterIP=20for=20pod?= =?UTF-8?q?=E2=86=92LB=20hairpin?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With L2 announcements, the LoadBalancer VIP is advertised via ARP on the LAN, so traffic from a pod to its own cluster's LB VIP times out. Enable bpf.lbExternalClusterIP so Cilium redirects the socket straight to the backend pod, fixing server-to-server OIDC from paperless to auth.k.renner.uno. Co-Authored-By: Claude Opus 4.7 (1M context) --- kubernetes/infrastructure/cilium/helmrelease.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kubernetes/infrastructure/cilium/helmrelease.yaml b/kubernetes/infrastructure/cilium/helmrelease.yaml index d216cda1..4d58d799 100644 --- a/kubernetes/infrastructure/cilium/helmrelease.yaml +++ b/kubernetes/infrastructure/cilium/helmrelease.yaml @@ -34,6 +34,11 @@ spec: ipam: mode: kubernetes kubeProxyReplacement: true + bpf: + # Let pods reach the cluster's own LoadBalancer external IPs; Cilium + # redirects the socket directly to the backend pod instead of sending + # traffic out to the VIP and back (which fails with L2 announcements). + lbExternalClusterIP: true # Talos-specific settings securityContext: capabilities: