fix(cilium): arm the conflist cleanup and roll the agent node by node (#832 )

Phase 1 of 2 for the Multus CNI config race in #832. No behavioural change on its own: it prepares the cluster so phase 2 can move Cilium's conflist out of /etc/cni/net.d without leaving a stale copy behind. cni.uninstall: true makes the agent's preStop hook (/cni-uninstall.sh) delete *cilium*.conf{,list} from the directory mounted at /host/etc/cni/net.d — the current cni.confPath. Nothing else in Cilium ever touches a previous confPath, so this hook is the only declarative way to remove /etc/cni/net.d/05-cilium.conflist from the three live nodes when phase 2 changes confPath. The hook reads the flag from the old pod's ConfigMap mount, which is why it has to be rolled out and settled before the path change lands. The script removes config files only; the cilium-cni binary stays. updateStrategy.rollingUpdate.maxUnavailable: 1 replaces the chart default of 2 so the agent rolls one node at a time. Phase 2 is cluster-wide CNI plumbing where a wrong path stops pod creation on the node; one node at a time keeps two of three healthy while it happens. Verified with helm template against cilium 1.20.x: the rendered DaemonSet carries maxUnavailable: 1 and cilium-config gains cni-uninstall: "true". kubernetes/bootstrap.sh extracts these values from the HelmRelease, so a cold rebuild installs the same thing. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-19 21:32:31 +02:00
1 changed files with 10 additions and 0 deletions
@@ -126,6 +126,16 @@ spec:
      # to *.cilium_bak on every reconcile, which kept nuking multus.
      # Setting it false lets multus's config coexist.
      exclusive: false
+      # The agent's preStop hook deletes its own 05-cilium.conflist from the
+      # mounted conf dir. Arms the confPath move in #832: without it the file
+      # stays behind in the old directory forever.
+      uninstall: true
+    # Roll the agent one node at a time. The chart default takes two of three
+    # nodes down together, and a CNI change with wrong paths stops pod creation
+    # on every node it reaches.
+    updateStrategy:
+      rollingUpdate:
+        maxUnavailable: 1
    # Talos-specific settings
    securityContext:
      capabilities: