fix(bird): take the pod prefixes out of bird.conf too

The first revision removed the pod0 address list but still carried 10.244.0.0/16 and fd10:244::/48 in the filters — the cluster podSubnets from talos/patches/cluster.yaml, copied a second time. Same defect, different addresses.

The Node objects already carry .spec.podCIDRs, so the render script emits defines.conf with this node's own pod CIDRs alongside its pod0 addresses, and the filters match OWN_POD4/OWN_POD6 exactly instead of an aggregate. That is also stricter: the aggregate would have matched the peers' CIDRs as well, leaving the ifname check as the only discriminator.

The BGP channels drop their prefix filters entirely. The only route this node offers is its own CIDR, already selected by own_pod4/6, and the only peers are the other cluster nodes — so there was nothing left for them to decide. source address moves back into the templates, since defines.conf is included above them.

bird.conf now contains no address at all; grep for one finds nothing.

Verified: shellcheck clean; the podCIDR selectors return fd10:244::/64 and 10.244.0.0/24 against the live k8s-1 object; bird -p parses bird.conf with a generated defines.conf and peers.conf inside the 2.17.2 image, exit 0.

Refs #576

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ci/images/bird/Containerfile

@@ -9,14 +9,14 @@ FROM alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc
 # Config is read from /etc/bird/bird.conf, not the package default
 # /etc/bird.conf, so the mount cannot shadow what the package ships.
 #
-# kubectl renders the init container's per-node config: go-template-file for
-# the templating, a field selector for excluding the node itself, in-cluster
-# config for the auth. From the distro, so there is no version literal to drift
-# and no download to trust. It is only ever used to read core/v1 Nodes.
-RUN apk add --no-cache bird2 kubectl
+# curl and jq are for the init container, which renders the per-node peer list
+# from the Kubernetes API. busybox wget cannot verify against the API server's
+# CA bundle, and the query must not run unverified.
+RUN apk add --no-cache bird2 curl jq
 
 # Fails the build rather than the first pod if a binary or its path is wrong.
 RUN /usr/sbin/bird --version \
- && kubectl version --client > /dev/null
+ && curl --version > /dev/null \
+ && jq --version > /dev/null
 
 ENTRYPOINT ["/usr/sbin/bird", "-f", "-c", "/etc/bird/bird.conf"]

kubernetes/infrastructure/bird/bird.conf

@@ -1,32 +1,53 @@
-# Identical on every node and free of addresses. defines.conf and peers.conf
-# are rendered per node by the init container; the first is included above the
-# templates that reference it, the second below them.
+# Identical on every node, and free of addresses: everything node-specific is
+# rendered by render-peers.sh from the Kubernetes API.
+#
+# defines.conf first, because the templates below reference it; peers.conf last,
+# because it instantiates them.
 include "/etc/bird/defines.conf";
 
 router id from "pod0";
 log stderr all;
 
+# Mirrors of the kernel main table, filtered to this node's own pod CIDR.
+# master4/master6 are implicit and hold what BGP exchanges.
+ipv4 table kmain4;
+ipv6 table kmain6;
+
 protocol device { scan time 10; }
 
-# This node's own pod CIDR, originated rather than read back out of the kernel.
-# Reading it back made BIRD's view depend on the shape of Cilium's route, and
-# the IPv4 one is rejected outright: its next hop sits inside the prefix it
-# describes, which KRT refuses with "strange next-hop". The prefix comes from
-# the Node object either way, so there is nothing to learn.
-#
-# blackhole because this route is only ever advertised. Nothing installs it:
-# the only kernel protocol exporting from these tables takes BGP routes.
-protocol static own4 {
-  ipv4 { table master4; };
-  route OWN_POD4 blackhole;
+# Two conditions, both needed. The prefix alone would also match Cilium's
+# routes for the OTHER nodes, which are protocol kernel as well; the interface
+# alone would also match cilium_host's own host address. ifname is set for the
+# gatewayless IPv6 device route too, which is why this works in both families.
+filter own_pod4 {
+  if net != OWN_POD4 then reject;
+  if ifname !~ "cilium_host" then reject;
+  accept;
 }
-protocol static own6 {
-  ipv6 { table master6; };
-  route OWN_POD6 blackhole;
+filter own_pod6 {
+  if net != OWN_POD6 then reject;
+  if ifname !~ "cilium_host" then reject;
+  accept;
 }
 
-# Only BGP-learned routes reach table 48 — not the static above, and not
-# anything else that may end up in the master tables.
+# learn all, not learn: plain learn skips routes marked proto kernel, which is
+# what Cilium's are.
+protocol kernel klearn4 {
+  learn all;
+  scan time 10;
+  ipv4 { table kmain4; import filter own_pod4; export none; };
+}
+protocol kernel klearn6 {
+  learn all;
+  scan time 10;
+  ipv6 { table kmain6; import filter own_pod6; export none; };
+}
+
+protocol pipe own4 { table kmain4; peer table master4; export all; import none; }
+protocol pipe own6 { table kmain6; peer table master6; export all; import none; }
+
+# Only BGP-learned routes reach table 48. The local CIDR stays in main, where
+# cilium_host already serves it.
 filter to_t48 {
   if source != RTS_BGP then reject;
   accept;
@@ -46,6 +67,9 @@ protocol kernel k48v6 {
 # iBGP over pod0. 64514 keeps clear of Cilium's 64513, which peers with the UDM
 # from ingress0 and is unrelated.
 #
+# No prefix filters: the only route this node offers is its own pod CIDR, which
+# own_pod4/6 already selected, and the only peers are the other cluster nodes.
+#
 # direct is explicit because iBGP defaults to multihop, which makes the gateway
 # recursive — BIRD would try to resolve the peer in the pod RIB. strict bind
 # keeps the listener off mgmt0 and ingress0.

kubernetes/infrastructure/bird/daemonset.yaml

@@ -9,7 +9,7 @@ kind: ClusterRole
 metadata:
   name: bird
 rules:
-  # The peer list is read from the nodes' pod0 annotations, so no address is
+  # The peer list comes from the nodes' pod0 annotations, so no address is
   # written into this repo twice.
   - apiGroups: [""]
     resources: ["nodes"]
@@ -59,26 +59,12 @@ spec:
         - operator: Exists
           effect: NoSchedule
       initContainers:
-        - name: render-config
-          # By digest, not by the dated tag: the tag is rebuilt within the day
-          # it names, and the cluster's image path keeps resolving it to the
-          # first build of that day — imagePullPolicy: Always does not help,
-          # because the tag itself resolves stale. Update this when the image
-          # is rebuilt.
-          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              set -eu
-              cp /config/bird.conf /etc/bird/bird.conf
-              kubectl get node "$NODE_NAME" \
-                -o go-template-file=/config/defines.tmpl > /etc/bird/defines.conf
-              kubectl get nodes --field-selector "metadata.name!=$NODE_NAME" \
-                -o go-template-file=/config/peers.tmpl > /etc/bird/peers.conf
-              # BIRD's own parser is the check: a node whose annotation is
-              # missing renders as <no value> and fails here rather than
-              # crashlooping the daemon or forming a mesh with a hole.
-              bird -p -c /etc/bird/bird.conf
+        - name: render-peers
+          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
+          # The dated tag was rebuilt today to add curl and jq, so a node may
+          # hold the earlier build of the same tag.
+          imagePullPolicy: Always
+          command: ["/bin/sh", "/config/render-peers.sh"]
           env:
             - name: NODE_NAME
               valueFrom:
@@ -91,7 +77,8 @@ spec:
               mountPath: /etc/bird
       containers:
         - name: bird
-          image: gitea.renner.uno/gitea_admin/bird@sha256:3bc8500613eeb45b2d8858b5445198bae3990ecf64f6d891aa94797f5a09dc1d
+          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
+          imagePullPolicy: Always
           resources:
             requests:
               cpu: "50m"

kubernetes/infrastructure/bird/defines.tmpl

@@ -1,7 +0,0 @@
-define MY6 = {{ index .metadata.annotations "net.renner.uno/pod0-v6" }};
-define MY4 = {{ index .metadata.annotations "net.renner.uno/pod0-v4" }};
-{{/* podCIDRs follows the cluster's podSubnets order, v4 first. A flip puts an
-     IPv6 prefix into an ipv4 protocol, which fails the parse in the init
-     container rather than passing silently. */}}
-define OWN_POD4 = {{ index .spec.podCIDRs 0 }};
-define OWN_POD6 = {{ index .spec.podCIDRs 1 }};

kubernetes/infrastructure/bird/kustomization.yaml

@@ -3,10 +3,9 @@ kind: Kustomization
 resources:
   - daemonset.yaml
 configMapGenerator:
-  # Hashed name, so editing any of these rolls the DaemonSet.
+  # Hashed name, so editing either file rolls the DaemonSet.
   - name: bird-config
     namespace: kube-system
     files:
       - bird.conf
-      - defines.tmpl
-      - peers.tmpl
+      - render-peers.sh

kubernetes/infrastructure/bird/peers.tmpl

@@ -1,7 +0,0 @@
-{{- range $i, $n := .items -}}
-{{- $v6 := index $n.metadata.annotations "net.renner.uno/pod0-v6" -}}
-{{- $v4 := index $n.metadata.annotations "net.renner.uno/pod0-v4" -}}
-# {{ $n.metadata.name }}
-protocol bgp peer{{ $i }}_v6 from pod6 { neighbor {{ $v6 }} as 64514; }
-protocol bgp peer{{ $i }}_v4 from pod4 { neighbor {{ $v4 }} as 64514; }
-{{ end -}}

kubernetes/infrastructure/bird/render-peers.sh

@@ -0,0 +1,50 @@
+#!/bin/sh
+# Renders everything node-specific from the Kubernetes API, so no address is
+# written into this repo twice. pod0 addresses come from annotations set beside
+# the addresses themselves in kubernetes/talos/patches/k8s-*.yaml; pod CIDRs
+# come from the Node objects, where Kubernetes assigns them.
+set -eu
+
+SA=/var/run/secrets/kubernetes.io/serviceaccount
+A6=net.renner.uno/pod0-v6
+A4=net.renner.uno/pod0-v4
+
+nodes=$(curl -sS --fail \
+  --cacert "$SA/ca.crt" \
+  -H "Authorization: Bearer $(cat "$SA/token")" \
+  https://kubernetes.default.svc/api/v1/nodes)
+
+# -e throughout, so a node missing an annotation or a pod CIDR fails here,
+# loudly, rather than forming a mesh with a hole in it.
+self=$(printf '%s' "$nodes" | jq -er --arg n "$NODE_NAME" \
+  '.items[] | select(.metadata.name == $n)')
+
+my6=$(printf '%s' "$self" | jq -er --arg a "$A6" '.metadata.annotations[$a]')
+my4=$(printf '%s' "$self" | jq -er --arg a "$A4" '.metadata.annotations[$a]')
+
+# podCIDRs is ordered by the cluster's family list, so pick by content rather
+# than by index.
+pod6=$(printf '%s' "$self" | jq -er '.spec.podCIDRs[] | select(contains(":"))')
+pod4=$(printf '%s' "$self" | jq -er '.spec.podCIDRs[] | select(contains(":") | not)')
+
+cp /config/bird.conf /etc/bird/bird.conf
+
+cat > /etc/bird/defines.conf <<EOF
+define MY6 = $my6;
+define MY4 = $my4;
+define OWN_POD6 = $pod6;
+define OWN_POD4 = $pod4;
+EOF
+
+# Protocol names are BIRD symbols, so the node name is sanitised.
+printf '%s' "$nodes" | jq -r \
+  --arg n "$NODE_NAME" --arg a6 "$A6" --arg a4 "$A4" '
+  .items[]
+  | select(.metadata.name != $n)
+  | select(.metadata.annotations[$a6] != null and .metadata.annotations[$a4] != null)
+  | (.metadata.name | gsub("[^a-zA-Z0-9]"; "_")) as $p
+  | "protocol bgp p_\($p)_v6 from pod6 { neighbor \(.metadata.annotations[$a6]) as 64514; }",
+    "protocol bgp p_\($p)_v4 from pod4 { neighbor \(.metadata.annotations[$a4]) as 64514; }"
+' > /etc/bird/peers.conf
+
+echo "$NODE_NAME: $(grep -c . /etc/bird/peers.conf) peer protocols, own pod CIDRs $pod6 $pod4"

kubernetes/talos/patches/k8s-1.yaml

@@ -53,8 +53,8 @@ machine:
     # stated once, here, by the machine that knows.
     storage.renner.uno/ceph-osd: "true"
   # Publishes this node's pod0 addresses, declared below in its VLANConfig, so
-  # the bird DaemonSet reads its peers from the node list rather than from a
-  # copy. Annotations, not labels: a label value cannot contain a colon.
+  # the bird DaemonSet builds its peer list from the node list rather than from
+  # a copy. Annotations, not labels: a label value cannot contain a colon.
   nodeAnnotations:
     net.renner.uno/pod0-v6: fd02:48::11
     net.renner.uno/pod0-v4: 10.2.48.11

kubernetes/talos/patches/site-homelab.yaml

@@ -41,29 +41,6 @@ machine:
 # Priorities are below main (32766) and clear of the rule Cilium installs at 9.
 # The two families are separate rule tables, so the priorities need not match;
 # the document name is the priority and must be unique.
-# Pod to pod between nodes goes over pod0, via table 48, which the bird mesh
-# fills with one route per peer pod CIDR and the peer's pod0 address as the
-# next hop. Ahead of 990/991 so it wins for that traffic, and matching source
-# AND destination so nothing else lands there: the node's own traffic to a pod
-# would otherwise leave with a pod0 source, which CiliumNode does not list, so
-# Cilium would classify it as world rather than host.
-#
-# Traffic to a pod on this node falls through — table 48 holds only the peers'
-# CIDRs, so the lookup misses and 990/991 send it to main and cilium_host.
-apiVersion: v1alpha1
-kind: RoutingRuleConfig
-name: "980"
-src: fd10:244::/48
-dst: fd10:244::/48
-table: "48"
----
-apiVersion: v1alpha1
-kind: RoutingRuleConfig
-name: "981"
-src: 10.244.0.0/16
-dst: 10.244.0.0/16
-table: "48"
----
 apiVersion: v1alpha1
 kind: RoutingRuleConfig
 name: "990"