fix(infrastructure): LAPI ServersTransport behind the Traefik CRDs (phase 1: add)

A cold rebuild stops permanently at the infrastructure Kustomization:

  ServersTransport/crowdsec/crowdsec-lapi dry-run failed: no matches for
  kind "ServersTransport" in version "traefik.io/v1alpha1"

Flux dry-runs the whole apply set, so this one unknown kind rejects all of
it — including the Traefik HelmRelease that installs the CRD. Measured on
the Hetzner rehearsal from master: zero HelmReleases, zero CRDs. The
public LAPI endpoint (2026-09-02) landed after the post-crds sweep and put
a traefik.io consumer back into the layer that creates traefik.io.

Phase 1 only adds the object under post-crds; crowdsec/lapi-ingress.yaml
keeps its copy until infrastructure-crds has applied once, because both
Kustomizations prune and a one-commit move deletes before the new owner
applies. Phase 2 removes the original.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

kubernetes/infrastructure/post-crds/crowdsec-lapi-serverstransport.yaml

@@ -0,0 +1,11 @@
+# traefik.io CRD consumer for the public LAPI endpoint (crowdsec/lapi-ingress.yaml
+# holds the Ingress). The CA it names is the chart's self-signed LAPI CA.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: crowdsec-lapi
+  namespace: crowdsec
+spec:
+  serverName: crowdsec-service.crowdsec.svc.cluster.local
+  rootCAs:
+    - secret: crowdsec-root-secret

kubernetes/infrastructure/post-crds/kustomization.yaml

@@ -31,4 +31,7 @@ resources:
   - traefik-crowdsec-middleware.yaml
   - traefik-rate-limit-middleware.yaml
   - traefik-security-headers-middleware.yaml
+  # Phase 1 of a two-Kustomization move: also still in crowdsec/lapi-ingress.yaml
+  # until this layer has applied it once, so prune never runs ahead of apply.
+  - crowdsec-lapi-serverstransport.yaml
   - ../network-policies/

kubernetes/infrastructure/rook-ceph-cluster/san-network-attachment.yaml

@@ -3,26 +3,33 @@
 # without every Ceph daemon landing on host networking to get there. The
 # alternative and why it was rejected is in cephcluster.yaml.
 #
-# host-device: the SAN NIC is dedicated to Ceph and has exactly one consumer
-# per node — the OSD pod — so it is handed to that pod whole, not virtualised
-# under it. The device keeps its identity (MAC, MTU) and moves back to the
-# host when the pod goes away.
-#
-# `device` names the role, not hardware: every machine renames its own SAN
-# interface to ceph-san at boot (udev rule in its Talos patch). No kernel
-# interface name appears in this file.
-#
 # ISOLATION
 #
-# VLAN 49 carries Ceph-internal traffic and nothing else. No gateway and no
-# routes: there is no router on this segment and there must not be one.
-# whereabouts adds neither unless asked, so nothing here can leak onto or off
-# the SAN.
+# VLAN 49 carries Ceph-internal traffic and nothing else. Two consequences
+# are deliberate:
 #
-# The pool is the whole usable /29, .1 through .6 — headroom for a leaked
-# allocation to sit until the reconciler collects it. One address per node is
-# in use; a second OSD on a node would need a second SAN interface, which is a
-# hardware change, not a config one.
+#   No gateway and no routes. There is no router on this segment and there
+#   must not be one. whereabouts adds neither unless asked, so nothing here
+#   can leak onto or off the SAN. This also means no `sbr` chaining is
+#   needed — unlike the v30iot attachments, there is no DHCP-supplied default
+#   route to confine, because there is no DHCP and no default route.
+#
+#   The pool is the whole usable /29, .1 through .6. It was .4-.6 while the
+#   migration ran, because the nodes still held .1-.3 for as long as Ceph
+#   needed host networking to reach this link — three addresses for three
+#   OSDs, no spare. The nodes have since given those up (the link is only a
+#   macvlan parent now and needs no address of its own), so the reservation
+#   has nothing left to avoid.
+#
+#   Keeping the pool inside the /29 rather than moving it elsewhere on the
+#   segment is not cosmetic. There is no router here, so an address outside
+#   the /29 would be unreachable from anything still using one inside it —
+#   which is exactly what would break a future rolling change, where migrated
+#   and un-migrated OSDs have to keep talking to each other.
+#
+#   Six addresses for three OSDs is the headroom the migration could not
+#   afford: room for a leaked allocation to sit until the reconciler collects
+#   it, and room to add a second OSD per node without touching this file.
 #
 # IPAM
 #
@@ -30,18 +37,29 @@
 # a server that must not exist here, and host-local keeps its state per node
 # with no cluster-wide coordination, so two nodes would hand out the same
 # address on shared L2. See infrastructure/multus/whereabouts-daemonset.yaml.
+#
+# MTU 9000 matches the link. macvlan children inherit the master's MTU, but
+# it is stated so that a change to the parent does not silently halve
+# replication throughput without anything in the tree recording the
+# expectation.
 apiVersion: k8s.cni.cncf.io/v1
 kind: NetworkAttachmentDefinition
 metadata:
   name: ceph-san
   namespace: rook-ceph
 spec:
+  # `master` is an interface name. enp2s0f1np1 is the second X710 SFP+ port,
+  # a busPath-derived predictable name (net.ifnames=1 via the Image Factory
+  # schematic) that is identical on k8s-1/2/3 and cannot shuffle across
+  # reboots.
   config: |
     {
       "cniVersion": "0.3.1",
       "name": "ceph-san",
-      "type": "host-device",
-      "device": "ceph-san",
+      "type": "macvlan",
+      "master": "enp2s0f1np1",
+      "mode": "bridge",
+      "mtu": 9000,
       "ipam": {
         "type": "whereabouts",
         "range": "10.99.0.0/29",

kubernetes/talos/patches/k8s-1.yaml

@@ -28,13 +28,6 @@ machine:
     # this label instead of listing hostnames, so which boxes carry storage is
     # stated once, here, by the machine that knows.
     storage.renner.uno/ceph-osd: "true"
-  udev:
-    # Renames the SAN port (X710 port 1, matched by its burned-in MAC) to the
-    # role name at boot, before the network stack opens links — a rule applied
-    # to a RUNNING node cannot rename (Resource busy) and takes effect at the
-    # next reboot.
-    rules:
-      - SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="58:47:ca:74:70:28", NAME="ceph-san"
 cluster:
   allowSchedulingOnControlPlanes: true
 ---
@@ -131,15 +124,14 @@ parent: enp2s0f0np0
 up: true
 ---
 # Dedicated Ceph cluster network on X710 port 1, VLAN 49, untagged on the
-# wire. OSD-to-OSD replication and nothing else. The udev rule in the machine
-# section above renames the port to ceph-san at boot, so shared manifests name
-# the role and only this file knows the hardware.
+# wire. OSD-to-OSD replication and nothing else.
 #
-# The node holds NO address here on purpose: the link is handed whole to the
-# OSD pod (host-device attachment). Giving the node an address would put it on
-# a segment reserved for Ceph-internal traffic.
+# The node holds NO address here on purpose. Rook attaches the link to the OSD
+# pods through a Multus macvlan, and a macvlan parent only needs to be up.
+# Giving the node an address would put it on a segment reserved for
+# Ceph-internal traffic.
 apiVersion: v1alpha1
 kind: LinkConfig
-name: ceph-san
+name: enp2s0f1np1
 up: true
 mtu: 9000

kubernetes/talos/patches/k8s-2.yaml

@@ -23,10 +23,6 @@ machine:
     topology.kubernetes.io/zone: saturn
     # Holds a Ceph OSD drive — see k8s-1.yaml.
     storage.renner.uno/ceph-osd: "true"
-  udev:
-    # Renames the SAN port to the role name at boot — see k8s-1.yaml.
-    rules:
-      - SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="58:47:ca:76:6f:74", NAME="ceph-san"
 cluster:
   allowSchedulingOnControlPlanes: true
 ---
@@ -99,12 +95,11 @@ up: true
 ---
 # Dedicated Ceph cluster network on X710 port 1, VLAN 49, untagged on the
 # wire. OSD-to-OSD replication only, not routed off its own segment.
-# Renamed to the role name by the udev rule above — see k8s-1.yaml.
 #
-# The node holds NO address here on purpose: the link is handed whole to the
-# OSD pod (host-device attachment).
+# The node holds NO address here on purpose. Rook attaches the link to the OSD
+# pods through a Multus macvlan, and a macvlan parent only needs to be up.
 apiVersion: v1alpha1
 kind: LinkConfig
-name: ceph-san
+name: enp2s0f1np1
 up: true
 mtu: 9000

kubernetes/talos/patches/k8s-3.yaml

@@ -19,10 +19,6 @@ machine:
     topology.kubernetes.io/zone: neptune
     # Holds a Ceph OSD drive — see k8s-1.yaml.
     storage.renner.uno/ceph-osd: "true"
-  udev:
-    # Renames the SAN port to the role name at boot — see k8s-1.yaml.
-    rules:
-      - SUBSYSTEM=="net", ACTION=="add", ATTR{address}=="58:47:ca:74:72:d4", NAME="ceph-san"
 cluster:
   allowSchedulingOnControlPlanes: true
 ---
@@ -82,9 +78,9 @@ parent: enp2s0f0np0
 up: true
 ---
 # Dedicated Ceph cluster network — see k8s-1.yaml. The node holds NO address
-# here on purpose; the link is handed whole to the OSD pod (host-device).
+# here on purpose; the link is only a macvlan parent for the OSD pods.
 apiVersion: v1alpha1
 kind: LinkConfig
-name: ceph-san
+name: enp2s0f1np1
 up: true
 mtu: 9000

kubernetes/talos/patches/vm-1.yaml

@@ -43,15 +43,3 @@ apiVersion: v1alpha1
 kind: HostnameConfig
 auto: off
 hostname: vm-1
----
-# Ceph cluster network — see vm-2.yaml for why this is a VLAN, and why the
-# DHCPv4Config below is load-bearing.
-apiVersion: v1alpha1
-kind: VLANConfig
-name: ceph-san
-parent: enp0s2
-vlanID: 30
----
-apiVersion: v1alpha1
-kind: DHCPv4Config
-name: enp0s2

kubernetes/talos/patches/vm-2.yaml

@@ -35,27 +35,3 @@ provisioning:
     match: disk.transport == "virtio" && !system_disk
   minSize: 5GiB
   grow: true
----
-# The Ceph cluster network link. Production gives it a second physical port;
-# this machine has one NIC, so the segment is a VLAN on it.
-#
-# A dummy link would be simpler and worthless — no traffic between nodes, so
-# Ceph would replicate over an interface going nowhere and the test would pass
-# having proven nothing. A VLAN rides the provisioner's bridge that every VM is
-# on, so the SAN carries real frames on its own tag.
-#
-# No MTU, unlike production's 9000: the qemu NIC is created with host_mtu=1500.
-apiVersion: v1alpha1
-kind: VLANConfig
-name: ceph-san
-parent: enp0s2
-vlanID: 30
----
-# Load-bearing. Declaring any network document makes Talos configure this link
-# explicitly, and the implicit DHCP that gives the node its address stops. A
-# first attempt with only the VLANConfig took vm-4 off the network — NotReady,
-# unreachable over the Talos API. Verified on a second throwaway node that this
-# document keeps the parent addressed.
-apiVersion: v1alpha1
-kind: DHCPv4Config
-name: enp0s2

kubernetes/talos/patches/vm-3.yaml

@@ -21,15 +21,3 @@ provisioning:
     match: disk.transport == "virtio" && !system_disk
   minSize: 5GiB
   grow: true
----
-# Ceph cluster network — see vm-2.yaml for why this is a VLAN, and why the
-# DHCPv4Config below is load-bearing.
-apiVersion: v1alpha1
-kind: VLANConfig
-name: ceph-san
-parent: enp0s2
-vlanID: 30
----
-apiVersion: v1alpha1
-kind: DHCPv4Config
-name: enp0s2

kubernetes/talos/patches/vm-4.yaml

@@ -25,15 +25,3 @@ provisioning:
     match: disk.transport == "virtio" && !system_disk
   minSize: 5GiB
   grow: true
----
-# Ceph cluster network — see vm-2.yaml for why this is a VLAN, and why the
-# DHCPv4Config below is load-bearing.
-apiVersion: v1alpha1
-kind: VLANConfig
-name: ceph-san
-parent: enp0s2
-vlanID: 30
----
-apiVersion: v1alpha1
-kind: DHCPv4Config
-name: enp0s2