feat(talos): node network on VLAN 46, etcd pinned to VLAN 40 (#576 step 1)

- node0: VLANConfig on the uplink trunk, VLAN 46, static fd02:46::1x/64 and 10.2.46.1x/24, accept_ra 0. Closed like pod0. Unused until the node IP moves there (step 3). - cluster.etcd.advertisedSubnets pinned to 10.2.40.0/24 so a reboot cannot pick a node0 address: Talos never updates an existing member's peer URLs. Applied live with talosctl patch --mode=no-reboot, k8s-3 first. Node IPs unchanged, etcd 3/3 healthy, node0 reachable node to node over v6 and v4. Refs #576 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-23 13:25:12 +02:00
4 changed files with 45 additions and 0 deletions
@@ -58,6 +58,12 @@ machine:
      imageGCHighThresholdPercent: 70
      imageGCLowThresholdPercent: 60
 cluster:
+  # etcd advertises on the management VLAN until the node↔node move (#576
+  # step 3). Pinned so the node0 addresses cannot be picked on a reboot: Talos
+  # never updates an existing member's peer URLs.
+  etcd:
+    advertisedSubnets:
+      - 10.2.40.0/24
  # controlPlane.endpoint is NOT here: `talosctl gen config` takes it as its
  # second argument, and bootstrap.sh already passes https://k8s.renner.uno:6443
  # there. Setting it again in this patch restated the same value in a second
@@ -17,6 +17,8 @@ machine:
    # pod0 is a closed L2 fabric between the three nodes: statically
    # addressed, no gateway, nothing to learn from an RA.
    net.ipv6.conf.pod0.accept_ra: "0"
+    # node0 is closed the same way.
+    net.ipv6.conf.node0.accept_ra: "0"
    # ingress0 keeps RAs, at the default accept_ra of 2: an IPv6 default
    # router is a link-local address learned only from the RA, and with
    # net.ipv6.conf.all.forwarding=1 — which Cilium sets — Linux ignores RAs
@@ -177,6 +179,19 @@ addresses:
  - address: 10.2.48.11/24
  - address: fd02:48::11/64
 ---
+# Node network, VLAN 46: traffic among the three nodes themselves (#576) — the
+# node IP, etcd, apiserver↔kubelet. Closed like pod0: statically addressed, no
+# gateway, never routed via the UDM. Unused until the node IP moves here.
+apiVersion: v1alpha1
+kind: VLANConfig
+name: node0
+vlanID: 46
+parent: uplink
+up: true
+addresses:
+  - address: fd02:46::11/64
+  - address: 10.2.46.11/24
+---
 # Ingress network, VLAN 47. World-to-pod: the BGP session, the next hop for
 # every advertised LoadBalancer VIP, and the masquerade source for pod egress.
 # Publicly routed, which is what separates it from pod0.
@@ -16,6 +16,7 @@ machine:
    # ingress0 keeps RAs: it learns its IPv6 router and its address from them,
    # and only the default route is held back — see k8s-1.yaml.
    net.ipv6.conf.pod0.accept_ra: "0"
+    net.ipv6.conf.node0.accept_ra: "0"
    net.ipv6.conf.ingress0.accept_ra_defrtr: "0"
    # Answer ARP only on the link that owns the address — see k8s-1.yaml (#793).
    net.ipv4.conf.all.arp_ignore: "1"
@@ -122,6 +123,17 @@ addresses:
  - address: 10.2.48.12/24
  - address: fd02:48::12/64
 ---
+# Node network, VLAN 46 — see k8s-1.yaml.
+apiVersion: v1alpha1
+kind: VLANConfig
+name: node0
+vlanID: 46
+parent: uplink
+up: true
+addresses:
+  - address: fd02:46::12/64
+  - address: 10.2.46.12/24
+---
 # Ingress network, VLAN 47. World-to-pod, publicly routed, statically
 # addressed — see k8s-1.yaml for why it is not leased.
 apiVersion: v1alpha1
@@ -12,6 +12,7 @@ machine:
    # ingress0 keeps RAs: it learns its IPv6 router and its address from them,
    # and only the default route is held back — see k8s-1.yaml.
    net.ipv6.conf.pod0.accept_ra: "0"
+    net.ipv6.conf.node0.accept_ra: "0"
    net.ipv6.conf.ingress0.accept_ra_defrtr: "0"
    # Answer ARP only on the link that owns the address — see k8s-1.yaml (#793).
    net.ipv4.conf.all.arp_ignore: "1"
@@ -109,6 +110,17 @@ addresses:
  - address: 10.2.48.13/24
  - address: fd02:48::13/64
 ---
+# Node network, VLAN 46 — see k8s-1.yaml.
+apiVersion: v1alpha1
+kind: VLANConfig
+name: node0
+vlanID: 46
+parent: uplink
+up: true
+addresses:
+  - address: fd02:46::13/64
+  - address: 10.2.46.13/24
+---
 # Ingress network, VLAN 47. World-to-pod, publicly routed, statically
 # addressed — see k8s-1.yaml for why it is not leased.
 apiVersion: v1alpha1