From fb8a258ed4ff07cd90a95523ffc5df3692d15c8f Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Tue, 8 Sep 2026 10:19:57 +0200 Subject: [PATCH] feat(cilium): name the datapath device instead of probing for it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `devices` was empty, so each agent decided at start which links to attach the eBPF datapath to. All three currently resolve to mgmt0, which is correct — but it is a per-boot inference, stated in no file, over a broadcast domain that also holds an address-less enp87s0. That asymmetry is what #793 turned into a 13.5 h VIP outage: the UDM learned the node address against the NIC with no BPF program on it. The sysctl guards added there keep the wrong answer from being reachable; this makes the right one reviewable. Naming a single device also fixes the direct-routing device, which the chart otherwise leaves to the same probe. Behaviour-neutral by construction: `cilium-dbg status` reports exactly `mgmt0 (Direct Routing)` on k8s-1, k8s-2 and k8s-3 today, and mgmt0 is the only candidate — it holds the node address and both default routes. Rendering the release's values through the 1.20.1 chart changes one line of cilium-config, `devices: "" -> "mgmt0"`, and nothing else. Two things this does not do. Upstream advises setting `devices` only when auto-detection is unsuitable, and here it is not; the case for naming it is that a datapath binding belongs in git, not that the probe is wrong. And it is not enforcement: with no match the agent falls back to probing rather than refusing to start, so a renamed link reverts to auto-detection silently. Merging rolls the agent DaemonSet through the reloader annotation, two of three at once per its updateStrategy — the same path every cilium-config change already takes. Refs #576 Co-Authored-By: Claude Fable 5.1 --- kubernetes/infrastructure/cilium/helmrelease.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/kubernetes/infrastructure/cilium/helmrelease.yaml b/kubernetes/infrastructure/cilium/helmrelease.yaml index 78978975..5a086d2c 100644 --- a/kubernetes/infrastructure/cilium/helmrelease.yaml +++ b/kubernetes/infrastructure/cilium/helmrelease.yaml @@ -65,6 +65,21 @@ spec: kubeProxyReplacement: true socketLB: enabled: true + # Which links the eBPF datapath attaches to: NodePort/LoadBalancer, + # masquerading, and — because this names exactly one — the direct-routing + # device. Left empty the agent probes for links with a non-local route, + # which resolves to mgmt0 on all three nodes today. Naming it makes the + # datapath's attachment a line in git instead of a per-boot decision. + # + # mgmt0 is the only candidate: it holds the node address and both default + # routes. enp87s0 shares its broadcast domain but carries no address, so + # the probe skips it — the asymmetry behind #793, where the UDM learned + # the node IP against that NIC and delivered to a link with no BPF program. + # + # Not a hard binding: with no match the agent falls back to probing rather + # than refusing to start, so a renamed link reverts to auto-detection + # silently. This declares intent; it does not enforce it. + devices: "mgmt0" prometheus: # Without agent metrics, BPF map utilisation is invisible: a full policy # map only shows up as "no space left on device" in the log while pod