fix: [alert] LokiCanaryMissingEntries (cluster) (#844)

Reviewed-on: k.renner/homelab#842

kubernetes/apps/immich/machine-learning.yaml

@@ -32,7 +32,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: immich-machine-learning
-          image: ghcr.io/immich-app/immich-machine-learning:v3.2.1 # {"$imagepolicy": "flux-system:immich-machine-learning"}
+          image: ghcr.io/immich-app/immich-machine-learning:v3.2.2 # {"$imagepolicy": "flux-system:immich-machine-learning"}
           ports:
             - name: http
               containerPort: 3003

kubernetes/apps/immich/server.yaml

@@ -87,7 +87,7 @@ spec:
               mountPath: /ca
       containers:
         - name: immich-server
-          image: ghcr.io/immich-app/immich-server:v3.2.1 # {"$imagepolicy": "flux-system:immich-server"}
+          image: ghcr.io/immich-app/immich-server:v3.2.2 # {"$imagepolicy": "flux-system:immich-server"}
           ports:
             - name: http
               containerPort: 3001

kubernetes/apps/monitoring-rules/prometheusrule-loki.yaml

@@ -47,10 +47,21 @@ spec:
         - alert: LokiCanaryMissingEntries
           # loki-canary writes test logs and reads them back. Missing
           # entries mean the ingest → store → query path lost data.
-          expr: sum(increase(loki_canary_missing_entries_total[10m])) > 0
+          #
+          # Aggregated per pod, not cluster-wide: the canary is a DaemonSet
+          # and pushes directly to Loki, so a single wedged node stalls only
+          # its own canary. A bare sum() turned that into an unlabelled
+          # "log data loss" alert that named neither the node nor Loki.
+          # Grouping by pod keeps genuine Loki data loss loud (every canary
+          # fires) while a single-node stall is self-describing.
+          expr: sum by (pod) (increase(loki_canary_missing_entries_total[10m])) > 0
           for: 10m
           labels:
             severity: warning
           annotations:
-            summary: "Loki canary detected missing log entries"
-            description: "loki-canary reported entries it wrote were not returned by the read path in the last 10m — log data loss."
+            summary: "Loki canary {{ $labels.pod }} detected missing log entries"
+            description: >-
+              loki-canary {{ $labels.pod }} reported entries it wrote were not
+              returned by the read path in the last 10m. If only this canary is
+              affected, suspect its node (blocked I/O, resource starvation)
+              rather than Loki; if all canaries are affected, suspect Loki.

kubernetes/talos/patches/k8s-1.yaml

@@ -182,8 +182,14 @@ addresses:
 # network's clients selectively, so the client goes rather than the record.
 # DHCP is off on VLAN 47 for the same reason.
 #
-# The metric loses to mgmt0's default 1024 deliberately: this pass only adds
-# the segment. The default route moves here in the change that flips it.
+# Both defaults live in table 47, not in main, so only the pod-source rules in
+# site-homelab.yaml reach them. mgmt0 keeps main's default and with it every
+# reply the node sends from its own addresses.
+#
+# The v6 gateway is the UDM's configured ULA on this segment, the same address
+# BGP peers with. The RA-learned link-local would be the alternative and is not
+# a value to write down. accept_ra_defrtr stays 0 for that reason: the RA
+# default would land in main, where it does not belong.
 apiVersion: v1alpha1
 kind: VLANConfig
 name: ingress0
@@ -193,8 +199,10 @@ up: true
 addresses:
   - address: 10.2.47.11/24
 routes:
+  - gateway: fd02:47::1
+    table: "47"
   - gateway: 10.2.47.1
-    metric: 2048
+    table: "47"
 ---
 # Dedicated Ceph cluster network on X710 port 1, VLAN 49, untagged on the
 # wire. OSD-to-OSD replication and nothing else. The udev rule in the machine

kubernetes/talos/patches/k8s-2.yaml

@@ -129,8 +129,10 @@ up: true
 addresses:
   - address: 10.2.47.12/24
 routes:
+  - gateway: fd02:47::1
+    table: "47"
   - gateway: 10.2.47.1
-    metric: 2048
+    table: "47"
 ---
 # Dedicated Ceph cluster network on X710 port 1, VLAN 49, untagged on the
 # wire. OSD-to-OSD replication only, not routed off its own segment.

kubernetes/talos/patches/k8s-3.yaml

@@ -116,8 +116,10 @@ up: true
 addresses:
   - address: 10.2.47.13/24
 routes:
+  - gateway: fd02:47::1
+    table: "47"
   - gateway: 10.2.47.1
-    metric: 2048
+    table: "47"
 ---
 # Dedicated Ceph cluster network — see k8s-1.yaml. The node holds NO address
 # here on purpose; the link is handed whole to the OSD pod (host-device).

kubernetes/talos/patches/site-homelab.yaml

@@ -20,3 +20,47 @@ machine:
       validSubnets:
         - 10.2.40.0/24
         - fd40::/64
+---
+# Pod egress leaves over ingress0. Matching on the pod source prefix is what
+# keeps the node's own traffic out of it: the node IP, the API VIP and apid all
+# answer on mgmt0, and a reply that left over ingress0 would carry an mgmt0
+# source onto VLAN 47.
+#
+# The routing decision runs before Cilium's masquerade hook, so the rule sees
+# the pod address and the masquerade then rewrites it to ingress0's.
+#
+# Table 47 holds nothing but the two default routes, so the destination rules
+# below have to run first: without them a pod's packet to a service or to a pod
+# on another node also matches the source rule, finds only the default, and
+# leaves for the UDM. Measured — in-cluster DNS stopped resolving.
+#
+# They send everything inside the cluster and the local networks back to main.
+# The prefixes are Cilium's ipv4/ipv6NativeRoutingCIDR, which already mark what
+# is not foreign traffic.
+#
+# Priorities are below main (32766) and clear of the rule Cilium installs at 9.
+# The two families are separate rule tables, so the priorities need not match;
+# the document name is the priority and must be unique.
+apiVersion: v1alpha1
+kind: RoutingRuleConfig
+name: "990"
+dst: fd00::/8
+table: main
+---
+apiVersion: v1alpha1
+kind: RoutingRuleConfig
+name: "991"
+dst: 10.0.0.0/8
+table: main
+---
+apiVersion: v1alpha1
+kind: RoutingRuleConfig
+name: "1000"
+src: fd10:244::/48
+table: "47"
+---
+apiVersion: v1alpha1
+kind: RoutingRuleConfig
+name: "1001"
+src: 10.244.0.0/16
+table: "47"