3 Commits

Include renames

Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	3501586841	fix(talos): route LoadBalancer replies through table 47 ... A reply from a Cilium LoadBalancer VIP reaches the routing decision with the VIP as its source, so the pod-source rules 1000/1001 missed it and main sent it out mgmt0 while the request came in over ingress0, the BGP next hop (k8s-3, 2026-11-02: replies from 10.2.99.90 to an IoT device seen only on mgmt0). Rules 1002/1003 send the pool to table 47. The pool becomes a site fact: each site patch carries lb-pool-site (flux-system), and bgp-pool takes its blocks from it by Flux substitution in infrastructure-crds. The CIDR blocks cover the same addresses as the start/stop ranges did (allowFirstLastIPs defaults to Yes). The qemu and hcloud sites carry the production pool, since Services pin their addresses from it. Refs #1547 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185Qb5YG28FfnVi1ujMEV5C	2026-11-02 08:42:49 +01:00
claude-botandClaude Opus 5.5	32a995a6bf	docs(network): traffic classes as built, node-to-node on VLAN 46 (#576) ... NETWORK-traffic-classes.md described table 48 and rules 980/981/990/991, which #857 replaced with one table (47) decided by longest prefix, and listed management as not started. Rewritten to the live state: five classes, table 47 contents owned by bird, node IP and etcd on node0, the etcd leave-and-rejoin procedure, and the mixed-state hazard hit during the node IP move. The bird DaemonSet comment still named table 48. Closes #576 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-23 14:48:12 +02:00
claude-botandClaude Opus 5	f0701370db	docs: describe the traffic-class split as built (#576) ... Replaces the proposal, which was wrong before it was written down. It presented A, B and C as the option space and concluded pod-to-pod was blocked; policy routing was available the whole time and is what moved pod egress and then pod-to-pod. The file recorded a blind spot and gave it the authority of a checked-in document. Three of four classes are separated now, so this describes the built design rather than proposing one, and the PROPOSAL- name goes with it: which link each class uses, the rule order and why 980/981 match source and destination, where each table comes from, how the bird mesh renders itself from the API without repeating an address, and why the node's own CIDR is originated rather than read back from the kernel. Management is the remaining class. Its levers are listed, along with the two approaches the owner rejected — with the caveat that the same reasoning which produced that list also called pod-to-pod impossible, so it is a record of decisions and not an analysis to trust. Failure behaviour is stated because it is what makes the design safe to roll one node at a time: an empty table 48 falls through to main and pod traffic returns to VLAN 40, unseparated rather than broken. bootstrap.sh's reference follows the rename; its point was always that the QEMU/Hetzner sites use two segments, not the homelab's split. Refs #576 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-16 11:18:57 +02:00