fix: [alert] KubeContainerWaiting (home-assistant) (#592 )

2026-08-25 23:47:26 +00:00
3 changed files with 28 additions and 0 deletions
@@ -77,6 +77,21 @@ spec:
      # redirects the socket directly to the backend pod instead of sending
      # traffic out to the VIP and back (which fails with L2 announcements).
      lbExternalClusterIP: true
+      # VLAN ids whose tagged frames are passed to the stack instead of being
+      # dropped by Cilium's VLAN filter. Unset, the filter drops every tagged
+      # frame the datapath sees — which is what strands the v30iot macvlan
+      # pods on a converted node: there `ens19` (VLAN 30) and `mgmt0`
+      # (VLAN 40) are VLAN sub-interfaces of the enp2s0f0np0 trunk, so a
+      # macvlan child's DHCP DISCOVER leaves tagged and dies as
+      # DROP_VLAN_FILTER. The CNI DHCP daemon reports that as "no buffer
+      # space available" (a tc drop surfaces to an AF_PACKET sender as
+      # ENOBUFS, not as a timeout) and the pod sits in ContainerCreating
+      # forever — issue #592, predicted in RUNBOOK-baremetal-conversion.md.
+      # Lists only the two VLANs a node terminates; [0] would bypass the
+      # filter for every id. Takes effect on agent restart.
+      # Keep in lockstep with vlan-bpf-bypass in
+      # kubernetes/talos/patches/cilium-cni.yaml and kubernetes/talos/cilium.yaml.
+      vlanBypass: [30, 40]
    cni:
      # Multus (kubernetes/infrastructure/multus) runs alongside Cilium and
      # writes 00-multus.conf to /etc/cni/net.d so kubelet picks multus
@@ -306,6 +306,12 @@ data:
  # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic
  # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
  bpf-map-dynamic-size-ratio: "0.0025"
+  # VLAN ids whose tagged frames bypass the eBPF datapath rather than being
+  # dropped by the VLAN filter. 30 (v30iot, the macvlan parent) and 40 (mgmt)
+  # are VLAN sub-interfaces of the trunk on a bare-metal node. Keep in lockstep
+  # with patches/cilium-cni.yaml and values.bpf.vlanBypass in
+  # kubernetes/infrastructure/cilium/helmrelease.yaml.
+  vlan-bpf-bypass: "30,40"
  # bpf-policy-map-max specifies the maximum number of entries in endpoint
  # policy map (per endpoint). Keep in lockstep with patches/cilium-cni.yaml and
  # values.bpf.policyMapMax in kubernetes/infrastructure/cilium/helmrelease.yaml.
@@ -324,6 +324,13 @@ cluster:
          # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic
          # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
          bpf-map-dynamic-size-ratio: "0.0025"
+          # VLAN ids whose tagged frames bypass the eBPF datapath rather than being
+          # dropped by the VLAN filter. 30 (v30iot, the macvlan parent) and 40 (mgmt)
+          # are VLAN sub-interfaces of the trunk on a bare-metal node, so without this
+          # a cold rebuild comes up with the v30iot macvlan pods unable to DHCP. Keep
+          # in lockstep with kubernetes/talos/cilium.yaml and values.bpf.vlanBypass in
+          # kubernetes/infrastructure/cilium/helmrelease.yaml.
+          vlan-bpf-bypass: "30,40"
          # bpf-policy-map-max specifies the maximum number of entries in endpoint
          # policy map (per endpoint). Keep in lockstep with values.bpf.policyMapMax
          # in kubernetes/infrastructure/cilium/helmrelease.yaml, and with the third