feat(talos): send pod-to-pod over pod0 via table 48 (#576)

The last step of the traffic-class split. The bird mesh already fills table 48 with one route per peer pod CIDR, next hop the peer's pod0 address; these two rules are what make the kernel look there.

Source AND destination are matched. Source alone would also catch the node's own traffic to a pod, which would then leave with a pod0 source — an address CiliumNode does not list, so Cilium would classify it as world rather than host and policy would drop it. Destination alone would catch traffic from anywhere.

Priority 980/981 sits ahead of the 990/991 pair that sends the cluster and local networks to main, so pod-to-pod wins for that traffic and everything else is unchanged. Traffic to a pod on the same node falls through: table 48 holds only the peers' CIDRs, the lookup misses, and 990/991 send it to main and cilium_host.

Verified on k8s-1 with --mode=try, 200 requests per family from a pod on k8s-1 to a pod on k8s-2: pod0 gained 6957 transmit packets, matching 400 requests, while pod0 receive moved by 45 — the peer is unpatched and still answers over mgmt0, the same asymmetry the earlier measurement showed. Both rules were installed as expected, one per family.

Refs #576

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

kubernetes/infrastructure/bird/bird.conf

@@ -6,46 +6,27 @@ include "/etc/bird/defines.conf";
 router id from "pod0";
 log stderr all;
 
-# Mirrors of the kernel main table, filtered to this node's own pod CIDR.
-# master4/master6 are implicit and hold what BGP exchanges.
-ipv4 table kmain4;
-ipv6 table kmain6;
-
 protocol device { scan time 10; }
 
-# Two conditions. cilium_host also carries its own host address, which the
-# length check drops; and Cilium's routes for the OTHER nodes are protocol
-# kernel too, which the interface check drops. ifname is set for the
-# gatewayless IPv6 device route as well, so this works in both families.
-filter own_pod4 {
-  if ifname !~ "cilium_host" then reject;
-  if net.len = 32 then reject;
-  accept;
+# This node's own pod CIDR, originated rather than read back out of the kernel.
+# Reading it back made BIRD's view depend on the shape of Cilium's route, and
+# the IPv4 one is rejected outright: its next hop sits inside the prefix it
+# describes, which KRT refuses with "strange next-hop". The prefix comes from
+# the Node object either way, so there is nothing to learn.
+#
+# blackhole because this route is only ever advertised. Nothing installs it:
+# the only kernel protocol exporting from these tables takes BGP routes.
+protocol static own4 {
+  ipv4 { table master4; };
+  route OWN_POD4 blackhole;
 }
-filter own_pod6 {
-  if ifname !~ "cilium_host" then reject;
-  if net.len = 128 then reject;
-  accept;
+protocol static own6 {
+  ipv6 { table master6; };
+  route OWN_POD6 blackhole;
 }
 
-# learn all, not learn: plain learn skips routes marked proto kernel, which is
-# what Cilium's are.
-protocol kernel klearn4 {
-  learn all;
-  scan time 10;
-  ipv4 { table kmain4; import filter own_pod4; export none; };
-}
-protocol kernel klearn6 {
-  learn all;
-  scan time 10;
-  ipv6 { table kmain6; import filter own_pod6; export none; };
-}
-
-protocol pipe own4 { table kmain4; peer table master4; export all; import none; }
-protocol pipe own6 { table kmain6; peer table master6; export all; import none; }
-
-# Only BGP-learned routes reach table 48. The local CIDR stays in main, where
-# cilium_host already serves it.
+# Only BGP-learned routes reach table 48 — not the static above, and not
+# anything else that may end up in the master tables.
 filter to_t48 {
   if source != RTS_BGP then reject;
   accept;
@@ -65,9 +46,6 @@ protocol kernel k48v6 {
 # iBGP over pod0. 64514 keeps clear of Cilium's 64513, which peers with the UDM
 # from ingress0 and is unrelated.
 #
-# No prefix filters: the only route this node offers is its own pod CIDR, which
-# own_pod4/6 already selected, and the only peers are the other cluster nodes.
-#
 # direct is explicit because iBGP defaults to multihop, which makes the gateway
 # recursive — BIRD would try to resolve the peer in the pod RIB. strict bind
 # keeps the listener off mgmt0 and ingress0.

kubernetes/infrastructure/bird/daemonset.yaml

@@ -60,9 +60,12 @@ spec:
           effect: NoSchedule
       initContainers:
         - name: render-config
-          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
-          # The dated tag is rebuilt within the day it names.
-          imagePullPolicy: Always
+          # By digest, not by the dated tag: the tag is rebuilt within the day
+          # it names, and the cluster's image path keeps resolving it to the
+          # first build of that day — imagePullPolicy: Always does not help,
+          # because the tag itself resolves stale. Update this when the image
+          # is rebuilt.
+          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -88,8 +91,7 @@ spec:
               mountPath: /etc/bird
       containers:
         - name: bird
-          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
-          imagePullPolicy: Always
+          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
           resources:
             requests:
               cpu: "50m"

kubernetes/infrastructure/bird/defines.tmpl

@@ -1,2 +1,7 @@
 define MY6 = {{ index .metadata.annotations "net.renner.uno/pod0-v6" }};
 define MY4 = {{ index .metadata.annotations "net.renner.uno/pod0-v4" }};
+{{/* podCIDRs follows the cluster's podSubnets order, v4 first. A flip puts an
+     IPv6 prefix into an ipv4 protocol, which fails the parse in the init
+     container rather than passing silently. */}}
+define OWN_POD4 = {{ index .spec.podCIDRs 0 }};
+define OWN_POD6 = {{ index .spec.podCIDRs 1 }};

kubernetes/talos/patches/site-homelab.yaml

@@ -41,6 +41,29 @@ machine:
 # Priorities are below main (32766) and clear of the rule Cilium installs at 9.
 # The two families are separate rule tables, so the priorities need not match;
 # the document name is the priority and must be unique.
+# Pod to pod between nodes goes over pod0, via table 48, which the bird mesh
+# fills with one route per peer pod CIDR and the peer's pod0 address as the
+# next hop. Ahead of 990/991 so it wins for that traffic, and matching source
+# AND destination so nothing else lands there: the node's own traffic to a pod
+# would otherwise leave with a pod0 source, which CiliumNode does not list, so
+# Cilium would classify it as world rather than host.
+#
+# Traffic to a pod on this node falls through — table 48 holds only the peers'
+# CIDRs, so the lookup misses and 990/991 send it to main and cilium_host.
+apiVersion: v1alpha1
+kind: RoutingRuleConfig
+name: "980"
+src: fd10:244::/48
+dst: fd10:244::/48
+table: "48"
+---
+apiVersion: v1alpha1
+kind: RoutingRuleConfig
+name: "981"
+src: 10.244.0.0/16
+dst: 10.244.0.0/16
+table: "48"
+---
 apiVersion: v1alpha1
 kind: RoutingRuleConfig
 name: "990"