feat(bird): put node0 in the pod routing table (#576 step 2)

Pod-sourced traffic is routed from table 47. Once the node IP moves to
VLAN 46 (step 3), pods reach node addresses there: the kubernetes
ClusterIP (socket LB rewrites it to the apiserver's advertise address),
hostNetwork pod IPs, and replies to kubelet probes. Without the attached
node0 route in table 47 those flows take the default to the UDM and every
in-cluster API client breaks. Taking it from the interface, like the
other attached networks, keeps the table in one owner.

Refs #576

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

kubernetes/infrastructure/bird/bird.conf

@@ -23,7 +23,7 @@ protocol device { scan time 10; }
 # down. The usual advice is not to export these to the kernel because it
 # maintains them itself — true of main, not of a table the kernel never fills.
 protocol direct attached {
-  interface "mgmt0", "ingress0", "pod0";
+  interface "mgmt0", "ingress0", "pod0", "node0";
   ipv4 { table master4; };
   ipv6 { table master6; };
 }

kubernetes/infrastructure/cilium/helmrelease.yaml

@@ -118,14 +118,21 @@ spec:
       # traffic out to the VIP and back (which fails with L2 announcements).
       lbExternalClusterIP: true
     cni:
-      # Multus (kubernetes/infrastructure/multus) runs alongside Cilium and
-      # writes 00-multus.conf to /etc/cni/net.d so kubelet picks multus
-      # first; multus then delegates to Cilium's 05-cilium.conflist via
-      # clusterNetwork. The default `exclusive: true` makes cilium-cni's
-      # install step rename anything alphabetically before its own config
-      # to *.cilium_bak on every reconcile, which kept nuking multus.
-      # Setting it false lets multus's config coexist.
+      # Multus is the only writer of /etc/cni/net.d (#832): Cilium's conflist
+      # goes to /etc/cni/net.d/multus/, which the container runtime does not
+      # read, and Multus delegates to it via clusterNetwork. Without this a
+      # pod created after a reboot, before Multus rewrote 00-multus.conf, came
+      # up with Cilium alone. See kubernetes/infrastructure/multus.
+      confPath: /etc/cni/net.d/multus
+      # The default `exclusive: true` renames other configs in the conf dir to
+      # *.cilium_bak on every reconcile, which kept nuking multus.
       exclusive: false
+    # One agent at a time: the chart default of 2 restarts two of three
+    # nodes' datapath at once.
+    updateStrategy:
+      type: RollingUpdate
+      rollingUpdate:
+        maxUnavailable: 1
     # Talos-specific settings
     securityContext:
       capabilities:

kubernetes/infrastructure/multus/multus-daemonset.yaml

@@ -111,10 +111,18 @@ metadata:
   name: multus
   namespace: kube-system
 ---
+# Multus is the only writer of /etc/cni/net.d (#832). Cilium writes its conflist
+# to /etc/cni/net.d/multus/, a subdirectory the container runtime does not read
+# (libcni skips directories); Multus picks it up there via multusAutoconfigDir
+# and writes 00-multus.conf. Until that file exists the runtime has no network
+# config at all, so no pod can be created with Cilium alone after a reboot.
+#
+# The "-subdir" names date from the node-by-node rollout; renaming would roll
+# Multus again for nothing.
 kind: ConfigMap
 apiVersion: v1
 metadata:
-  name: multus-daemon-config
+  name: multus-daemon-config-subdir
   namespace: kube-system
   labels:
     tier: node
@@ -127,7 +135,7 @@ data:
         "logLevel": "verbose",
         "logToStderr": true,
         "cniConfigDir": "/host/etc/cni/net.d",
-        "multusAutoconfigDir": "/host/etc/cni/net.d",
+        "multusAutoconfigDir": "/host/etc/cni/net.d/multus",
         "multusConfigFile": "auto",
         "socketDir": "/host/run/multus/"
     }
@@ -135,16 +143,16 @@ data:
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: kube-multus-ds
+  name: kube-multus-ds-subdir
   namespace: kube-system
   labels:
     tier: node
     app: multus
-    name: multus
+    name: multus-subdir
 spec:
   selector:
     matchLabels:
-      name: multus
+      name: multus-subdir
   updateStrategy:
     type: RollingUpdate
   template:
@@ -152,7 +160,7 @@ spec:
       labels:
         tier: node
         app: multus
-        name: multus
+        name: multus-subdir
     spec:
       # Upstream ships this DaemonSet with no priority class, so it runs at 0
       # and can preempt nothing. Any event that makes the pod need a fresh
@@ -224,6 +232,10 @@ spec:
           volumeMounts:
             - name: cni
               mountPath: /host/etc/cni/net.d
+            # Exists before Multus starts, so it waits for Cilium's conflist
+            # instead of exiting on a missing directory.
+            - name: cni-cilium-conf
+              mountPath: /host/etc/cni/net.d/multus
             # multus-daemon expects that cnibin path must be identical between pod and container host.
             # e.g. if the cni bin is in '/opt/cni/bin' on the container host side, then it should be mount to '/opt/cni/bin' in multus-daemon,
             # not to any other directory, like '/opt/bin' or '/usr/bin'.
@@ -279,6 +291,10 @@ spec:
         - name: cni
           hostPath:
             path: /etc/cni/net.d
+        - name: cni-cilium-conf
+          hostPath:
+            path: /etc/cni/net.d/multus
+            type: DirectoryOrCreate
         - name: cnibin
           hostPath:
             path: /opt/cni/bin
@@ -287,7 +303,7 @@ spec:
             path: /
         - name: multus-daemon-config
           configMap:
-            name: multus-daemon-config
+            name: multus-daemon-config-subdir
             items:
               - key: daemon-config.json
                 path: daemon-config.json

kubernetes/infrastructure/multus/whereabouts-reconciler.yaml

@@ -39,9 +39,11 @@ spec:
         name: whereabouts-reconciler
     spec:
       serviceAccountName: whereabouts
-      # Every node here is a control plane node.
+      # Every node here is a control plane node. Keyed: a keyless Exists would
+      # also tolerate node.kubernetes.io/unschedulable and ignore cordons.
       tolerations:
-        - operator: Exists
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
           effect: NoSchedule
       containers:
         - name: whereabouts-reconciler