feat(network): VLAN 11 link radius0 on the nodes, Cilium VLAN bypass #1560

2026-11-04T14:05:53Z

claude-bot commented

2026-11-04 14:05:53 +00:00

VLAN 11 "(11) RADIUS" (UniFi network, 10.2.11.0/24, zone Isolated) carries the FreeRADIUS proxy traffic to the UDM RADIUS, which only accepts clients from its own configured networks (the pod CIDR is rejected as unknown client).

kubernetes/talos/patches/k8s-{1,2,3}.yaml: VLANConfig radius0 (VLAN 11 on uplink, up), link only — no addresses, no DHCP — plus net.ipv6.conf.radius0.disable_ipv6: "1" (VLAN 11 sends RAs). Macvlan parent for the FreeRADIUS attachment, same role as ens19 for VLAN 30.
kubernetes/infrastructure/cilium/helmrelease.yaml: bpf.vlanBypass: [30, 11]. radius0 is address-less, so its tagged frames meet Cilium's VLAN filter on uplink; without the entry DHCP on the attachment fails with no buffer space available (#592). bootstrap.sh reads these values from the HelmRelease, so this is the only copy.

The node uplinks (port profile "VM Host", tagged auto) already carry VLAN 11.

Rollout

Talos machine config is not applied by any pipeline. Per node, one node first:

talosctl -n <node> patch machineconfig --patch @<radius0 patch> --mode=try --timeout=5m
talosctl -n <node> get links radius0                                    # up
talosctl -n <node> get addresses | grep radius0                         # nothing
talosctl -n <node> read /proc/sys/net/ipv6/conf/radius0/disable_ipv6    # 1

then persist and continue with the next node. The Cilium value takes effect after an agent restart (kubectl -n kube-system rollout restart ds/cilium).

The FreeRADIUS attachment that uses radius0 is a separate PR and must only be merged after both steps.

🤖 Generated with Claude Code

VLAN 11 "(11) RADIUS" (UniFi network, 10.2.11.0/24, zone Isolated) carries the FreeRADIUS proxy traffic to the UDM RADIUS, which only accepts clients from its own configured networks (the pod CIDR is rejected as `unknown client`). - `kubernetes/talos/patches/k8s-{1,2,3}.yaml`: `VLANConfig radius0` (VLAN 11 on `uplink`, up), link only — no addresses, no DHCP — plus `net.ipv6.conf.radius0.disable_ipv6: "1"` (VLAN 11 sends RAs). Macvlan parent for the FreeRADIUS attachment, same role as `ens19` for VLAN 30. - `kubernetes/infrastructure/cilium/helmrelease.yaml`: `bpf.vlanBypass: [30, 11]`. `radius0` is address-less, so its tagged frames meet Cilium's VLAN filter on `uplink`; without the entry DHCP on the attachment fails with `no buffer space available` (#592). `bootstrap.sh` reads these values from the HelmRelease, so this is the only copy. The node uplinks (port profile "VM Host", tagged auto) already carry VLAN 11. ## Rollout Talos machine config is not applied by any pipeline. Per node, one node first: ``` talosctl -n <node> patch machineconfig --patch @<radius0 patch> --mode=try --timeout=5m talosctl -n <node> get links radius0 # up talosctl -n <node> get addresses | grep radius0 # nothing talosctl -n <node> read /proc/sys/net/ipv6/conf/radius0/disable_ipv6 # 1 ``` then persist and continue with the next node. The Cilium value takes effect after an agent restart (`kubectl -n kube-system rollout restart ds/cilium`). The FreeRADIUS attachment that uses `radius0` is a separate PR and must only be merged after both steps. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-11-04 14:05:53 +00:00

feat(network): VLAN 11 link radius0 on the nodes, Cilium VLAN bypass

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ed3be3156b

VLAN 11 "(11) RADIUS" carries the FreeRADIUS proxy traffic to the UDM
RADIUS, which accepts clients from its own networks only.

- Talos k8s-{1,2,3}: VLANConfig radius0 (VLAN 11 on uplink), link only,
  no addresses, IPv6 disabled (VLAN 11 sends RAs).
- Cilium bpf.vlanBypass [30, 11]: radius0 is address-less like ens19, so
  its tagged frames meet the VLAN filter on uplink (#592).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot referenced this pull request

2026-11-04 14:06:10 +00:00

feat(radius): proxy UniFi Endpoint logins to the UDM over VLAN 11 #1561

k.renner merged commit ac2d5d13a1 into main

2026-11-04 14:07:20 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1560