fix(bird): originate the node's own pod CIDR instead of learning it

IPv6 populated table 48 on all three nodes; IPv4 was empty. The daemon log gives the reason: KRT: Received route 10.244.0.0/24 with strange next-hop 10.244.0.195. Cilium's IPv4 pod route points at a next hop inside the prefix it describes, which BIRD's kernel protocol refuses. The IPv6 route is a device route with no next hop, so it passed — the asymmetry, not a filter, is why one family worked.

Reading the route back made BIRD's view depend on the shape Cilium happens to install. The prefix is already in the Node object, so a static protocol originates it directly: blackhole, because the route exists only to be advertised, and the sole kernel protocol exporting from these tables takes BGP routes.

That removes the kernel-learning tables, the pipes and the own-CIDR filters entirely — with them the dependence on learn all, on ifname, and on the maximum-length exclusion.

Verified: the templates render OWN_POD4 10.244.0.0/24 and OWN_POD6 fd10:244::/64 from the live k8s-1 object, and bird -p parses the result inside the image with exit 0.

Refs #576

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

kubernetes/infrastructure/bird/bird.conf

@@ -6,46 +6,27 @@ include "/etc/bird/defines.conf";
 router id from "pod0";
 log stderr all;
 
-# Mirrors of the kernel main table, filtered to this node's own pod CIDR.
-# master4/master6 are implicit and hold what BGP exchanges.
-ipv4 table kmain4;
-ipv6 table kmain6;
-
 protocol device { scan time 10; }
 
-# Two conditions. cilium_host also carries its own host address, which the
-# length check drops; and Cilium's routes for the OTHER nodes are protocol
-# kernel too, which the interface check drops. ifname is set for the
-# gatewayless IPv6 device route as well, so this works in both families.
-filter own_pod4 {
-  if ifname !~ "cilium_host" then reject;
-  if net.len = 32 then reject;
-  accept;
+# This node's own pod CIDR, originated rather than read back out of the kernel.
+# Reading it back made BIRD's view depend on the shape of Cilium's route, and
+# the IPv4 one is rejected outright: its next hop sits inside the prefix it
+# describes, which KRT refuses with "strange next-hop". The prefix comes from
+# the Node object either way, so there is nothing to learn.
+#
+# blackhole because this route is only ever advertised. Nothing installs it:
+# the only kernel protocol exporting from these tables takes BGP routes.
+protocol static own4 {
+  ipv4 { table master4; };
+  route OWN_POD4 blackhole;
 }
-filter own_pod6 {
-  if ifname !~ "cilium_host" then reject;
-  if net.len = 128 then reject;
-  accept;
+protocol static own6 {
+  ipv6 { table master6; };
+  route OWN_POD6 blackhole;
 }
 
-# learn all, not learn: plain learn skips routes marked proto kernel, which is
-# what Cilium's are.
-protocol kernel klearn4 {
-  learn all;
-  scan time 10;
-  ipv4 { table kmain4; import filter own_pod4; export none; };
-}
-protocol kernel klearn6 {
-  learn all;
-  scan time 10;
-  ipv6 { table kmain6; import filter own_pod6; export none; };
-}
-
-protocol pipe own4 { table kmain4; peer table master4; export all; import none; }
-protocol pipe own6 { table kmain6; peer table master6; export all; import none; }
-
-# Only BGP-learned routes reach table 48. The local CIDR stays in main, where
-# cilium_host already serves it.
+# Only BGP-learned routes reach table 48 — not the static above, and not
+# anything else that may end up in the master tables.
 filter to_t48 {
   if source != RTS_BGP then reject;
   accept;
@@ -65,9 +46,6 @@ protocol kernel k48v6 {
 # iBGP over pod0. 64514 keeps clear of Cilium's 64513, which peers with the UDM
 # from ingress0 and is unrelated.
 #
-# No prefix filters: the only route this node offers is its own pod CIDR, which
-# own_pod4/6 already selected, and the only peers are the other cluster nodes.
-#
 # direct is explicit because iBGP defaults to multihop, which makes the gateway
 # recursive — BIRD would try to resolve the peer in the pod RIB. strict bind
 # keeps the listener off mgmt0 and ingress0.

kubernetes/infrastructure/bird/daemonset.yaml

@@ -60,9 +60,12 @@ spec:
           effect: NoSchedule
       initContainers:
         - name: render-config
-          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
-          # The dated tag is rebuilt within the day it names.
-          imagePullPolicy: Always
+          # By digest, not by the dated tag: the tag is rebuilt within the day
+          # it names, and the cluster's image path keeps resolving it to the
+          # first build of that day — imagePullPolicy: Always does not help,
+          # because the tag itself resolves stale. Update this when the image
+          # is rebuilt.
+          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -88,8 +91,7 @@ spec:
               mountPath: /etc/bird
       containers:
         - name: bird
-          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
-          imagePullPolicy: Always
+          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
           resources:
             requests:
               cpu: "50m"

kubernetes/infrastructure/bird/defines.tmpl

@@ -1,2 +1,7 @@
 define MY6 = {{ index .metadata.annotations "net.renner.uno/pod0-v6" }};
 define MY4 = {{ index .metadata.annotations "net.renner.uno/pod0-v4" }};
+{{/* podCIDRs follows the cluster's podSubnets order, v4 first. A flip puts an
+     IPv6 prefix into an ipv4 protocol, which fails the parse in the init
+     container rather than passing silently. */}}
+define OWN_POD4 = {{ index .spec.podCIDRs 0 }};
+define OWN_POD6 = {{ index .spec.podCIDRs 1 }};