fix(infrastructure): LAPI ServersTransport behind the Traefik CRDs (phase 2: remove)

Phase 1 (#802) put the ServersTransport under post-crds and infrastructure-crds has applied it. The copy in crowdsec/lapi-ingress.yaml goes; the Ingress stays (core kind). With it, the infrastructure apply set holds no traefik.io consumer any more, which is what a cold rebuild needs. Prune: infrastructure reconciles first and skips the object if the last applier label names infrastructure-crds; otherwise it deletes and infrastructure-crds recreates it seconds later. Only the public LAPI ingress used by the external bouncers is behind that transport. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Merge pull request 'fix(ceph): state the cluster CIDR — host-device leaves Rook's canary no NIC' (#807 ) from ceph-address-ranges into master
2026-09-07 07:48:22 +02:00 · 2026-09-07 05:22:30 +00:00 · 2026-09-07 05:17:09 +00:00 · 2026-09-06 23:46:51 +02:00
5 changed files with 20 additions and 15 deletions
@@ -31,22 +31,12 @@
 # serves read-only decision streams to a valid bouncer key and nothing else.
 # The admin surface is cscli, in-cluster. If the source address ever becomes
 # deterministic, an ipAllowList can be added on top.
---
+#
 # The LAPI serves HTTPS only once tls.enabled is set — there is no plaintext
 # fallback and no second port; 8080 is the TLS port. Its certificate comes
 # from the chart's own self-signed CA, so Traefik needs that CA to verify the
-# backend. SANs include crowdsec-service.crowdsec.svc.cluster.local, which is
-# what the Service resolves to.
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: crowdsec-lapi
-  namespace: crowdsec
-spec:
-  serverName: crowdsec-service.crowdsec.svc.cluster.local
-  rootCAs:
-    - secret: crowdsec-root-secret
---
+# backend; the ServersTransport carrying it is a traefik.io CRD consumer and
+# lives in post-crds/crowdsec-lapi-serverstransport.yaml.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -31,7 +31,5 @@ resources:
  - traefik-crowdsec-middleware.yaml
  - traefik-rate-limit-middleware.yaml
  - traefik-security-headers-middleware.yaml
-  # Phase 1 of a two-Kustomization move: also still in crowdsec/lapi-ingress.yaml
-  # until this layer has applied it once, so prune never runs ahead of apply.
  - crowdsec-lapi-serverstransport.yaml
  - ../network-policies/
@@ -14,6 +14,13 @@ machine:
    # Disabling v6 on a VLAN parent does not affect the VLAN child.
    net.ipv6.conf.enp2s0f0np0.disable_ipv6: "1"
    net.ipv6.conf.enp87s0.disable_ipv6: "1"
+    # That network also carries the mgmt VLAN's ARP. Answer ARP only on the
+    # link that owns the address, or the UDM learns the node IP against
+    # enp87s0's MAC and delivers IPv4 to a NIC Cilium is not attached to (#793).
+    net.ipv4.conf.all.arp_ignore: "1"
+    net.ipv4.conf.default.arp_ignore: "1"
+    net.ipv4.conf.all.arp_announce: "2"
+    net.ipv4.conf.default.arp_announce: "2"
  install:
    # Select disks by serial only. A broad selector such as
    # `disk.transport == 'nvme'` matches every drive in the machine, and the
@@ -12,6 +12,11 @@ machine:
    # cluster IPv6 egress.
    net.ipv6.conf.enp2s0f0np0.disable_ipv6: "1"
    net.ipv6.conf.enp87s0.disable_ipv6: "1"
+    # Answer ARP only on the link that owns the address — see k8s-1.yaml (#793).
+    net.ipv4.conf.all.arp_ignore: "1"
+    net.ipv4.conf.default.arp_ignore: "1"
+    net.ipv4.conf.all.arp_announce: "2"
+    net.ipv4.conf.default.arp_announce: "2"
  install:
    # Select the installer target by serial so it cannot land on the OSD drive
    # or on EPHEMERAL, whatever order the kernel enumerates them in.
@@ -8,6 +8,11 @@ machine:
    # k8s-1.yaml.
    net.ipv6.conf.enp2s0f0np0.disable_ipv6: "1"
    net.ipv6.conf.enp87s0.disable_ipv6: "1"
+    # Answer ARP only on the link that owns the address — see k8s-1.yaml (#793).
+    net.ipv4.conf.all.arp_ignore: "1"
+    net.ipv4.conf.default.arp_ignore: "1"
+    net.ipv4.conf.all.arp_announce: "2"
+    net.ipv4.conf.default.arp_announce: "2"
  install:
    # Select the installer target by serial so it cannot land on the OSD drive
    # or on EPHEMERAL, whatever order the kernel enumerates them in.
Author	SHA1	Message	Date
claude-botandClaude Fable 5.1	5d52e42887	fix(infrastructure): LAPI ServersTransport behind the Traefik CRDs (phase 2: remove) ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details Phase 1 (#802) put the ServersTransport under post-crds and infrastructure-crds has applied it. The copy in crowdsec/lapi-ingress.yaml goes; the Ingress stays (core kind). With it, the infrastructure apply set holds no traefik.io consumer any more, which is what a cold rebuild needs. Prune: infrastructure reconciles first and skips the object if the last applier label names infrastructure-crds; otherwise it deletes and infrastructure-crds recreates it seconds later. Only the public LAPI ingress used by the external bouncers is behind that transport. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-07 07:48:22 +02:00
k.renner	57b2485487	Merge pull request 'fix(ceph): state the cluster CIDR — host-device leaves Rook's canary no NIC' (#807 ) from ceph-address-ranges into master ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#807	2026-09-07 05:22:30 +00:00
k.renner	cbd47596bf	Merge pull request 'fix(talos): answer ARP only on the link that owns the address' (#804 ) from fix/arp-flux-second-nic into master Reviewed-on: k.renner/homelab#804	2026-09-07 05:17:09 +00:00
claude-botandClaude Fable 5.1	4d629bfd66	fix(talos): answer ARP only on the link that owns the address ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details Every node has a second, address-less NIC (enp87s0) up on the untagged fallback network, which shares the mgmt VLAN's broadcast domain. With the Linux default arp_ignore=0 the host answers ARP for the node IP from that NIC too, so the UDM can learn 10.2.40.x against enp87s0's MAC. Inbound IPv4 then arrives on a device Cilium is not attached to, never reaches cil_from_netdev, and is routed straight back to the UDM by the default route — a loop that made every IPv4 LoadBalancer VIP on the affected node unreachable for 13.5 hours. IPv6 was untouched because NDP only answers on the interface that owns the address. The flux was measurable on all three nodes: an ARP request for a node IP from a neighbour returned replies from two MACs. Which node's entry had actually flipped at the UDM was a race, and it moved during the diagnosis. arp_ignore=1 answers only when the target address is configured on the receiving interface; arp_announce=2 stops the host from sourcing ARP from an interface that does not own the address. Applied live with talosctl on all three nodes before this commit and verified with enp87s0 up: each node now answers from its mgmt0 MAC only. A node property, so it lives next to the existing enp87s0 sysctls in each machine patch rather than in the site patch. Refs #793, #576 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-06 23:46:51 +02:00