feat(bird): swap jq for a pinned kubectl

The init container assembled its config with curl, a hand-managed bearer token and CA path, and jq string interpolation. That is not rendering, it is string building, and it carried the self-exclusion logic as well.

kubectl replaces all three: go-template-file renders from real template files, in-cluster auth needs no token handling, and --field-selector metadata.name!=$NODE_NAME drops the node itself server-side.

Pinned to v1.36.3 with the published checksum, the same shape as ci/images/k8s. Alpine ships 1.33.1, and this API server reports minCompatibilityMinor 35, so the packaged one is out of skew. curl stays for the build download; jq is gone.

Refs #576

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ci/images/bird/Containerfile

@@ -1,5 +1,9 @@
 FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
 
+# Matches the cluster: the API server reports minCompatibilityMinor 35, and
+# Alpine's kubectl is 1.33. Same pin-and-verify shape as ci/images/k8s.
+ARG KUBECTL_VERSION=v1.36.3
+
 # bird: BGP daemon for the pod-network mesh over pod0. Distro package, no build
 # step — the image is the binary plus its runtime.
 #
@@ -8,15 +12,21 @@ FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc
 #
 # Config is read from /etc/bird/bird.conf, not the package default
 # /etc/bird.conf, so the mount cannot shadow what the package ships.
-#
-# curl and jq are for the init container, which renders the per-node peer list
-# from the Kubernetes API. busybox wget cannot verify against the API server's
-# CA bundle, and the query must not run unverified.
-RUN apk add --no-cache bird2 curl jq
+RUN apk add --no-cache bird2 curl
+
+# kubectl renders the init container's per-node config with go-template and
+# excludes the node itself with a field selector, so nothing has to parse JSON
+# or assemble config text by hand.
+RUN curl -sfL -o /usr/local/bin/kubectl \
+      "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
+ && curl -sfL -o /tmp/kubectl.sha256 \
+      "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256" \
+ && echo "$(cat /tmp/kubectl.sha256)  /usr/local/bin/kubectl" | sha256sum -c - \
+ && rm -f /tmp/kubectl.sha256 \
+ && chmod +x /usr/local/bin/kubectl
 
 # Fails the build rather than the first pod if a binary or its path is wrong.
 RUN /usr/sbin/bird --version \
- && curl --version > /dev/null \
- && jq --version > /dev/null
+ && kubectl version --client > /dev/null
 
 ENTRYPOINT ["/usr/sbin/bird", "-f", "-c", "/etc/bird/bird.conf"]

kubernetes/infrastructure/bird/bird.conf

@@ -1,91 +0,0 @@
-# Identical on every node, and free of addresses: everything node-specific is
-# rendered by render-peers.sh from the Kubernetes API.
-#
-# defines.conf first, because the templates below reference it; peers.conf last,
-# because it instantiates them.
-include "/etc/bird/defines.conf";
-
-router id from "pod0";
-log stderr all;
-
-# Mirrors of the kernel main table, filtered to this node's own pod CIDR.
-# master4/master6 are implicit and hold what BGP exchanges.
-ipv4 table kmain4;
-ipv6 table kmain6;
-
-protocol device { scan time 10; }
-
-# Two conditions, both needed. The prefix alone would also match Cilium's
-# routes for the OTHER nodes, which are protocol kernel as well; the interface
-# alone would also match cilium_host's own host address. ifname is set for the
-# gatewayless IPv6 device route too, which is why this works in both families.
-filter own_pod4 {
-  if net != OWN_POD4 then reject;
-  if ifname !~ "cilium_host" then reject;
-  accept;
-}
-filter own_pod6 {
-  if net != OWN_POD6 then reject;
-  if ifname !~ "cilium_host" then reject;
-  accept;
-}
-
-# learn all, not learn: plain learn skips routes marked proto kernel, which is
-# what Cilium's are.
-protocol kernel klearn4 {
-  learn all;
-  scan time 10;
-  ipv4 { table kmain4; import filter own_pod4; export none; };
-}
-protocol kernel klearn6 {
-  learn all;
-  scan time 10;
-  ipv6 { table kmain6; import filter own_pod6; export none; };
-}
-
-protocol pipe own4 { table kmain4; peer table master4; export all; import none; }
-protocol pipe own6 { table kmain6; peer table master6; export all; import none; }
-
-# Only BGP-learned routes reach table 48. The local CIDR stays in main, where
-# cilium_host already serves it.
-filter to_t48 {
-  if source != RTS_BGP then reject;
-  accept;
-}
-
-protocol kernel k48v4 {
-  kernel table 48;
-  metric 0;
-  ipv4 { table master4; import none; export filter to_t48; };
-}
-protocol kernel k48v6 {
-  kernel table 48;
-  metric 0;
-  ipv6 { table master6; import none; export filter to_t48; };
-}
-
-# iBGP over pod0. 64514 keeps clear of Cilium's 64513, which peers with the UDM
-# from ingress0 and is unrelated.
-#
-# No prefix filters: the only route this node offers is its own pod CIDR, which
-# own_pod4/6 already selected, and the only peers are the other cluster nodes.
-#
-# direct is explicit because iBGP defaults to multihop, which makes the gateway
-# recursive — BIRD would try to resolve the peer in the pod RIB. strict bind
-# keeps the listener off mgmt0 and ingress0.
-template bgp pod4 {
-  local as 64514;
-  source address MY4;
-  direct;
-  strict bind;
-  ipv4 { next hop self; import all; export all; };
-}
-template bgp pod6 {
-  local as 64514;
-  source address MY6;
-  direct;
-  strict bind;
-  ipv6 { next hop self; import all; export all; };
-}
-
-include "/etc/bird/peers.conf";

kubernetes/infrastructure/bird/daemonset.yaml

@@ -1,102 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: bird
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: bird
-rules:
-  # The peer list comes from the nodes' pod0 annotations, so no address is
-  # written into this repo twice.
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: bird
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: bird
-subjects:
-  - kind: ServiceAccount
-    name: bird
-    namespace: kube-system
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: bird
-  namespace: kube-system
-  labels:
-    tier: node
-    app: bird
-spec:
-  selector:
-    matchLabels:
-      app: bird
-  updateStrategy:
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        tier: node
-        app: bird
-    spec:
-      # Carries pod east-west once the routing rules land. Without it table 48
-      # stays empty and the rules fall through to main, i.e. back to VLAN 40.
-      priorityClassName: system-node-critical
-      # Writes host routes and peers on host addresses.
-      hostNetwork: true
-      serviceAccountName: bird
-      # Every node here is a control plane node, so this is not optional.
-      tolerations:
-        - operator: Exists
-          effect: NoSchedule
-      initContainers:
-        - name: render-peers
-          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
-          # The dated tag was rebuilt today to add curl and jq, so a node may
-          # hold the earlier build of the same tag.
-          imagePullPolicy: Always
-          command: ["/bin/sh", "/config/render-peers.sh"]
-          env:
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-          volumeMounts:
-            - name: config
-              mountPath: /config
-            - name: etc-bird
-              mountPath: /etc/bird
-      containers:
-        - name: bird
-          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
-          imagePullPolicy: Always
-          resources:
-            requests:
-              cpu: "50m"
-              memory: "32Mi"
-            limits:
-              cpu: "200m"
-              memory: "128Mi"
-          securityContext:
-            capabilities:
-              drop: ["ALL"]
-              # NET_ADMIN writes the routes; NET_BIND_SERVICE binds 179.
-              add: ["NET_ADMIN", "NET_BIND_SERVICE"]
-          volumeMounts:
-            - name: etc-bird
-              mountPath: /etc/bird
-      volumes:
-        - name: config
-          configMap:
-            name: bird-config
-        - name: etc-bird
-          emptyDir: {}

kubernetes/infrastructure/bird/kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - daemonset.yaml
-configMapGenerator:
-  # Hashed name, so editing either file rolls the DaemonSet.
-  - name: bird-config
-    namespace: kube-system
-    files:
-      - bird.conf
-      - render-peers.sh

kubernetes/infrastructure/bird/render-peers.sh

@@ -1,50 +0,0 @@
-#!/bin/sh
-# Renders everything node-specific from the Kubernetes API, so no address is
-# written into this repo twice. pod0 addresses come from annotations set beside
-# the addresses themselves in kubernetes/talos/patches/k8s-*.yaml; pod CIDRs
-# come from the Node objects, where Kubernetes assigns them.
-set -eu
-
-SA=/var/run/secrets/kubernetes.io/serviceaccount
-A6=net.renner.uno/pod0-v6
-A4=net.renner.uno/pod0-v4
-
-nodes=$(curl -sS --fail \
-  --cacert "$SA/ca.crt" \
-  -H "Authorization: Bearer $(cat "$SA/token")" \
-  https://kubernetes.default.svc/api/v1/nodes)
-
-# -e throughout, so a node missing an annotation or a pod CIDR fails here,
-# loudly, rather than forming a mesh with a hole in it.
-self=$(printf '%s' "$nodes" | jq -er --arg n "$NODE_NAME" \
-  '.items[] | select(.metadata.name == $n)')
-
-my6=$(printf '%s' "$self" | jq -er --arg a "$A6" '.metadata.annotations[$a]')
-my4=$(printf '%s' "$self" | jq -er --arg a "$A4" '.metadata.annotations[$a]')
-
-# podCIDRs is ordered by the cluster's family list, so pick by content rather
-# than by index.
-pod6=$(printf '%s' "$self" | jq -er '.spec.podCIDRs[] | select(contains(":"))')
-pod4=$(printf '%s' "$self" | jq -er '.spec.podCIDRs[] | select(contains(":") | not)')
-
-cp /config/bird.conf /etc/bird/bird.conf
-
-cat > /etc/bird/defines.conf <<EOF
-define MY6 = $my6;
-define MY4 = $my4;
-define OWN_POD6 = $pod6;
-define OWN_POD4 = $pod4;
-EOF
-
-# Protocol names are BIRD symbols, so the node name is sanitised.
-printf '%s' "$nodes" | jq -r \
-  --arg n "$NODE_NAME" --arg a6 "$A6" --arg a4 "$A4" '
-  .items[]
-  | select(.metadata.name != $n)
-  | select(.metadata.annotations[$a6] != null and .metadata.annotations[$a4] != null)
-  | (.metadata.name | gsub("[^a-zA-Z0-9]"; "_")) as $p
-  | "protocol bgp p_\($p)_v6 from pod6 { neighbor \(.metadata.annotations[$a6]) as 64514; }",
-    "protocol bgp p_\($p)_v4 from pod4 { neighbor \(.metadata.annotations[$a4]) as 64514; }"
-' > /etc/bird/peers.conf
-
-echo "$NODE_NAME: $(grep -c . /etc/bird/peers.conf) peer protocols, own pod CIDRs $pod6 $pod4"

kubernetes/infrastructure/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
   - cluster-settings/
   - cilium/
   - multus/
-  - bird/
   - cert-manager/
   - snapshot-controller/
   - metrics-server/

kubernetes/talos/patches/k8s-1.yaml

@@ -52,12 +52,6 @@ machine:
     # this label instead of listing hostnames, so which boxes carry storage is
     # stated once, here, by the machine that knows.
     storage.renner.uno/ceph-osd: "true"
-  # Publishes this node's pod0 addresses, declared below in its VLANConfig, so
-  # the bird DaemonSet builds its peer list from the node list rather than from
-  # a copy. Annotations, not labels: a label value cannot contain a colon.
-  nodeAnnotations:
-    net.renner.uno/pod0-v6: fd02:48::11
-    net.renner.uno/pod0-v4: 10.2.48.11
   udev:
     # Renames every port this node uses to its role at boot, matched by
     # burned-in MAC — kernel names derive from PCI topology and shift when

kubernetes/talos/patches/k8s-2.yaml

@@ -33,10 +33,6 @@ machine:
     topology.kubernetes.io/zone: saturn
     # Holds a Ceph OSD drive — see k8s-1.yaml.
     storage.renner.uno/ceph-osd: "true"
-  # pod0 addresses for the bird peer list — see k8s-1.yaml.
-  nodeAnnotations:
-    net.renner.uno/pod0-v6: fd02:48::12
-    net.renner.uno/pod0-v4: 10.2.48.12
   udev:
     # Renames every port to its role at boot — see k8s-1.yaml.
     rules:

kubernetes/talos/patches/k8s-3.yaml

@@ -29,10 +29,6 @@ machine:
     topology.kubernetes.io/zone: neptune
     # Holds a Ceph OSD drive — see k8s-1.yaml.
     storage.renner.uno/ceph-osd: "true"
-  # pod0 addresses for the bird peer list — see k8s-1.yaml.
-  nodeAnnotations:
-    net.renner.uno/pod0-v6: fd02:48::13
-    net.renner.uno/pod0-v4: 10.2.48.13
   udev:
     # Renames every port to its role at boot — see k8s-1.yaml.
     rules: