fix(bird): take the pod prefixes out of bird.conf too

The first revision removed the pod0 address list but still carried 10.244.0.0/16 and fd10:244::/48 in the filters — the cluster podSubnets from talos/patches/cluster.yaml, copied a second time. Same defect, different addresses.

The Node objects already carry .spec.podCIDRs, so the render script emits defines.conf with this node's own pod CIDRs alongside its pod0 addresses, and the filters match OWN_POD4/OWN_POD6 exactly instead of an aggregate. That is also stricter: the aggregate would have matched the peers' CIDRs as well, leaving the ifname check as the only discriminator.

The BGP channels drop their prefix filters entirely. The only route this node offers is its own CIDR, already selected by own_pod4/6, and the only peers are the other cluster nodes — so there was nothing left for them to decide. source address moves back into the templates, since defines.conf is included above them.

bird.conf now contains no address at all; grep for one finds nothing.

Verified: shellcheck clean; the podCIDR selectors return fd10:244::/64 and 10.244.0.0/24 against the live k8s-1 object; bird -p parses bird.conf with a generated defines.conf and peers.conf inside the 2.17.2 image, exit 0.

Refs #576

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

kubernetes/infrastructure/bird/bird.conf

@@ -0,0 +1,91 @@
+# Identical on every node, and free of addresses: everything node-specific is
+# rendered by render-peers.sh from the Kubernetes API.
+#
+# defines.conf first, because the templates below reference it; peers.conf last,
+# because it instantiates them.
+include "/etc/bird/defines.conf";
+
+router id from "pod0";
+log stderr all;
+
+# Mirrors of the kernel main table, filtered to this node's own pod CIDR.
+# master4/master6 are implicit and hold what BGP exchanges.
+ipv4 table kmain4;
+ipv6 table kmain6;
+
+protocol device { scan time 10; }
+
+# Two conditions, both needed. The prefix alone would also match Cilium's
+# routes for the OTHER nodes, which are protocol kernel as well; the interface
+# alone would also match cilium_host's own host address. ifname is set for the
+# gatewayless IPv6 device route too, which is why this works in both families.
+filter own_pod4 {
+  if net != OWN_POD4 then reject;
+  if ifname !~ "cilium_host" then reject;
+  accept;
+}
+filter own_pod6 {
+  if net != OWN_POD6 then reject;
+  if ifname !~ "cilium_host" then reject;
+  accept;
+}
+
+# learn all, not learn: plain learn skips routes marked proto kernel, which is
+# what Cilium's are.
+protocol kernel klearn4 {
+  learn all;
+  scan time 10;
+  ipv4 { table kmain4; import filter own_pod4; export none; };
+}
+protocol kernel klearn6 {
+  learn all;
+  scan time 10;
+  ipv6 { table kmain6; import filter own_pod6; export none; };
+}
+
+protocol pipe own4 { table kmain4; peer table master4; export all; import none; }
+protocol pipe own6 { table kmain6; peer table master6; export all; import none; }
+
+# Only BGP-learned routes reach table 48. The local CIDR stays in main, where
+# cilium_host already serves it.
+filter to_t48 {
+  if source != RTS_BGP then reject;
+  accept;
+}
+
+protocol kernel k48v4 {
+  kernel table 48;
+  metric 0;
+  ipv4 { table master4; import none; export filter to_t48; };
+}
+protocol kernel k48v6 {
+  kernel table 48;
+  metric 0;
+  ipv6 { table master6; import none; export filter to_t48; };
+}
+
+# iBGP over pod0. 64514 keeps clear of Cilium's 64513, which peers with the UDM
+# from ingress0 and is unrelated.
+#
+# No prefix filters: the only route this node offers is its own pod CIDR, which
+# own_pod4/6 already selected, and the only peers are the other cluster nodes.
+#
+# direct is explicit because iBGP defaults to multihop, which makes the gateway
+# recursive — BIRD would try to resolve the peer in the pod RIB. strict bind
+# keeps the listener off mgmt0 and ingress0.
+template bgp pod4 {
+  local as 64514;
+  source address MY4;
+  direct;
+  strict bind;
+  ipv4 { next hop self; import all; export all; };
+}
+template bgp pod6 {
+  local as 64514;
+  source address MY6;
+  direct;
+  strict bind;
+  ipv6 { next hop self; import all; export all; };
+}
+
+include "/etc/bird/peers.conf";

kubernetes/infrastructure/bird/daemonset.yaml

@@ -0,0 +1,102 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bird
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: bird
+rules:
+  # The peer list comes from the nodes' pod0 annotations, so no address is
+  # written into this repo twice.
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: bird
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: bird
+subjects:
+  - kind: ServiceAccount
+    name: bird
+    namespace: kube-system
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: bird
+  namespace: kube-system
+  labels:
+    tier: node
+    app: bird
+spec:
+  selector:
+    matchLabels:
+      app: bird
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        tier: node
+        app: bird
+    spec:
+      # Carries pod east-west once the routing rules land. Without it table 48
+      # stays empty and the rules fall through to main, i.e. back to VLAN 40.
+      priorityClassName: system-node-critical
+      # Writes host routes and peers on host addresses.
+      hostNetwork: true
+      serviceAccountName: bird
+      # Every node here is a control plane node, so this is not optional.
+      tolerations:
+        - operator: Exists
+          effect: NoSchedule
+      initContainers:
+        - name: render-peers
+          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
+          # The dated tag was rebuilt today to add curl and jq, so a node may
+          # hold the earlier build of the same tag.
+          imagePullPolicy: Always
+          command: ["/bin/sh", "/config/render-peers.sh"]
+          env:
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: etc-bird
+              mountPath: /etc/bird
+      containers:
+        - name: bird
+          image: gitea.renner.uno/gitea_admin/bird:2026-09-16
+          imagePullPolicy: Always
+          resources:
+            requests:
+              cpu: "50m"
+              memory: "32Mi"
+            limits:
+              cpu: "200m"
+              memory: "128Mi"
+          securityContext:
+            capabilities:
+              drop: ["ALL"]
+              # NET_ADMIN writes the routes; NET_BIND_SERVICE binds 179.
+              add: ["NET_ADMIN", "NET_BIND_SERVICE"]
+          volumeMounts:
+            - name: etc-bird
+              mountPath: /etc/bird
+      volumes:
+        - name: config
+          configMap:
+            name: bird-config
+        - name: etc-bird
+          emptyDir: {}

kubernetes/infrastructure/bird/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - daemonset.yaml
+configMapGenerator:
+  # Hashed name, so editing either file rolls the DaemonSet.
+  - name: bird-config
+    namespace: kube-system
+    files:
+      - bird.conf
+      - render-peers.sh

kubernetes/infrastructure/bird/render-peers.sh

@@ -0,0 +1,50 @@
+#!/bin/sh
+# Renders everything node-specific from the Kubernetes API, so no address is
+# written into this repo twice. pod0 addresses come from annotations set beside
+# the addresses themselves in kubernetes/talos/patches/k8s-*.yaml; pod CIDRs
+# come from the Node objects, where Kubernetes assigns them.
+set -eu
+
+SA=/var/run/secrets/kubernetes.io/serviceaccount
+A6=net.renner.uno/pod0-v6
+A4=net.renner.uno/pod0-v4
+
+nodes=$(curl -sS --fail \
+  --cacert "$SA/ca.crt" \
+  -H "Authorization: Bearer $(cat "$SA/token")" \
+  https://kubernetes.default.svc/api/v1/nodes)
+
+# -e throughout, so a node missing an annotation or a pod CIDR fails here,
+# loudly, rather than forming a mesh with a hole in it.
+self=$(printf '%s' "$nodes" | jq -er --arg n "$NODE_NAME" \
+  '.items[] | select(.metadata.name == $n)')
+
+my6=$(printf '%s' "$self" | jq -er --arg a "$A6" '.metadata.annotations[$a]')
+my4=$(printf '%s' "$self" | jq -er --arg a "$A4" '.metadata.annotations[$a]')
+
+# podCIDRs is ordered by the cluster's family list, so pick by content rather
+# than by index.
+pod6=$(printf '%s' "$self" | jq -er '.spec.podCIDRs[] | select(contains(":"))')
+pod4=$(printf '%s' "$self" | jq -er '.spec.podCIDRs[] | select(contains(":") | not)')
+
+cp /config/bird.conf /etc/bird/bird.conf
+
+cat > /etc/bird/defines.conf <<EOF
+define MY6 = $my6;
+define MY4 = $my4;
+define OWN_POD6 = $pod6;
+define OWN_POD4 = $pod4;
+EOF
+
+# Protocol names are BIRD symbols, so the node name is sanitised.
+printf '%s' "$nodes" | jq -r \
+  --arg n "$NODE_NAME" --arg a6 "$A6" --arg a4 "$A4" '
+  .items[]
+  | select(.metadata.name != $n)
+  | select(.metadata.annotations[$a6] != null and .metadata.annotations[$a4] != null)
+  | (.metadata.name | gsub("[^a-zA-Z0-9]"; "_")) as $p
+  | "protocol bgp p_\($p)_v6 from pod6 { neighbor \(.metadata.annotations[$a6]) as 64514; }",
+    "protocol bgp p_\($p)_v4 from pod4 { neighbor \(.metadata.annotations[$a4]) as 64514; }"
+' > /etc/bird/peers.conf
+
+echo "$NODE_NAME: $(grep -c . /etc/bird/peers.conf) peer protocols, own pod CIDRs $pod6 $pod4"

kubernetes/infrastructure/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - cluster-settings/
   - cilium/
   - multus/
+  - bird/
   - cert-manager/
   - snapshot-controller/
   - metrics-server/

kubernetes/talos/patches/k8s-1.yaml

@@ -52,6 +52,12 @@ machine:
     # this label instead of listing hostnames, so which boxes carry storage is
     # stated once, here, by the machine that knows.
     storage.renner.uno/ceph-osd: "true"
+  # Publishes this node's pod0 addresses, declared below in its VLANConfig, so
+  # the bird DaemonSet builds its peer list from the node list rather than from
+  # a copy. Annotations, not labels: a label value cannot contain a colon.
+  nodeAnnotations:
+    net.renner.uno/pod0-v6: fd02:48::11
+    net.renner.uno/pod0-v4: 10.2.48.11
   udev:
     # Renames every port this node uses to its role at boot, matched by
     # burned-in MAC — kernel names derive from PCI topology and shift when

kubernetes/talos/patches/k8s-2.yaml

@@ -33,6 +33,10 @@ machine:
     topology.kubernetes.io/zone: saturn
     # Holds a Ceph OSD drive — see k8s-1.yaml.
     storage.renner.uno/ceph-osd: "true"
+  # pod0 addresses for the bird peer list — see k8s-1.yaml.
+  nodeAnnotations:
+    net.renner.uno/pod0-v6: fd02:48::12
+    net.renner.uno/pod0-v4: 10.2.48.12
   udev:
     # Renames every port to its role at boot — see k8s-1.yaml.
     rules:

kubernetes/talos/patches/k8s-3.yaml

@@ -29,6 +29,10 @@ machine:
     topology.kubernetes.io/zone: neptune
     # Holds a Ceph OSD drive — see k8s-1.yaml.
     storage.renner.uno/ceph-osd: "true"
+  # pod0 addresses for the bird peer list — see k8s-1.yaml.
+  nodeAnnotations:
+    net.renner.uno/pod0-v6: fd02:48::13
+    net.renner.uno/pod0-v4: 10.2.48.13
   udev:
     # Renames every port to its role at boot — see k8s-1.yaml.
     rules: