feat(talos): send pod-to-pod over pod0 via table 48 (#576 )

The last step of the traffic-class split. The bird mesh already fills table 48 with one route per peer pod CIDR, next hop the peer's pod0 address; these two rules are what make the kernel look there. Source AND destination are matched. Source alone would also catch the node's own traffic to a pod, which would then leave with a pod0 source — an address CiliumNode does not list, so Cilium would classify it as world rather than host and policy would drop it. Destination alone would catch traffic from anywhere. Priority 980/981 sits ahead of the 990/991 pair that sends the cluster and local networks to main, so pod-to-pod wins for that traffic and everything else is unchanged. Traffic to a pod on the same node falls through: table 48 holds only the peers' CIDRs, the lookup misses, and 990/991 send it to main and cilium_host. Verified on k8s-1 with --mode=try, 200 requests per family from a pod on k8s-1 to a pod on k8s-2: pod0 gained 6957 transmit packets, matching 400 requests, while pod0 receive moved by 45 — the peer is unpatched and still answers over mgmt0, the same asymmetry the earlier measurement showed. Both rules were installed as expected, one per family. Refs #576 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Merge pull request 'fix(bird): originate the node's own pod CIDR instead of learning it' (#854 ) from fix/bird-static into master
2026-09-16 11:04:05 +02:00 · 2026-09-16 09:00:04 +00:00
1 changed files with 23 additions and 0 deletions
@@ -41,6 +41,29 @@ machine:
 # Priorities are below main (32766) and clear of the rule Cilium installs at 9.
 # The two families are separate rule tables, so the priorities need not match;
 # the document name is the priority and must be unique.
+# Pod to pod between nodes goes over pod0, via table 48, which the bird mesh
+# fills with one route per peer pod CIDR and the peer's pod0 address as the
+# next hop. Ahead of 990/991 so it wins for that traffic, and matching source
+# AND destination so nothing else lands there: the node's own traffic to a pod
+# would otherwise leave with a pod0 source, which CiliumNode does not list, so
+# Cilium would classify it as world rather than host.
+#
+# Traffic to a pod on this node falls through — table 48 holds only the peers'
+# CIDRs, so the lookup misses and 990/991 send it to main and cilium_host.
+apiVersion: v1alpha1
+kind: RoutingRuleConfig
+name: "980"
+src: fd10:244::/48
+dst: fd10:244::/48
+table: "48"
+---
+apiVersion: v1alpha1
+kind: RoutingRuleConfig
+name: "981"
+src: 10.244.0.0/16
+dst: 10.244.0.0/16
+table: "48"
+---
 apiVersion: v1alpha1
 kind: RoutingRuleConfig
 name: "990"