netbird-ingress: run one routing peer per node (DaemonSet) #45

2026-06-26T10:23:25Z

k.renner commented

2026-06-26 10:23:25 +00:00

Converts the single-replica netbird-ingress Deployment to a DaemonSet so every node runs its own rootless routing peer — HA, no single point of failure.

kind: Deployment → DaemonSet (drop replicas/Recreate; RollingUpdate maxUnavailable: 1 so peers roll one node at a time)
per-node peer name: NB_HOSTNAME=netbird-ingress-$(NODE_NAME) via the downward API (each peer shows its node in the dashboard)
securityContext / image / probes / egress CNP unchanged (rootless, capless)

Node coverage: runs on k8s-1/2/3 (3 peers). k8s-edge is excluded — it has a workload-class=pinned:NoSchedule taint and the DaemonSet does not tolerate it (correct — no routing peer needed on the reserved node). Say so if you want it there too and I'll add the toleration.

🛠 NetBird-side: make sure the 10.2.99.0/24 + fd99::/64 route uses the k8s-ingress-router group as its routing peer (not a single peer), so NetBird distributes/fails over across all DaemonSet members.

🤖 Generated with Claude Code

Converts the single-replica `netbird-ingress` Deployment to a **DaemonSet** so every node runs its own rootless routing peer — HA, no single point of failure. - `kind: Deployment → DaemonSet` (drop `replicas`/`Recreate`; `RollingUpdate maxUnavailable: 1` so peers roll one node at a time) - per-node peer name: `NB_HOSTNAME=netbird-ingress-$(NODE_NAME)` via the downward API (each peer shows its node in the dashboard) - securityContext / image / probes / egress CNP unchanged (rootless, capless) **Node coverage:** runs on `k8s-1/2/3` (3 peers). `k8s-edge` is excluded — it has a `workload-class=pinned:NoSchedule` taint and the DaemonSet does not tolerate it (correct — no routing peer needed on the reserved node). Say so if you want it there too and I'll add the toleration. 🛠 **NetBird-side:** make sure the `10.2.99.0/24` + `fd99::/64` route uses the **`k8s-ingress-router` group** as its routing peer (not a single peer), so NetBird distributes/fails over across all DaemonSet members. 🤖 Generated with Claude Code

k.renner added 1 commit 2026-06-26 10:23:25 +00:00

netbird-ingress: run one routing peer per node (DaemonSet) 3b878c9287

Convert the single-replica Deployment to a DaemonSet so every node runs
its own rootless NetBird routing peer. With the mesh route/nameserver
pointed at the k8s-ingress-router group, NetBird distributes and fails the
route over across all per-node peers — no single point of failure if a
node or pod drops.

- kind Deployment -> DaemonSet (drop replicas/Recreate; RollingUpdate
  maxUnavailable=1 so peers roll one node at a time)
- per-node peer name: NB_HOSTNAME=netbird-ingress-$(NODE_NAME) via the
  downward API, so each peer shows its node in the dashboard
- securityContext/image/probes/egress CNP unchanged (rootless, capless)

NetBird-side: ensure the 10.2.99.0/24 + fd99::/64 route uses the
k8s-ingress-router GROUP as its routing peer (not a single peer) so all
DaemonSet members serve it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit dd3f78d53b into master

2026-06-26 10:23:48 +00:00

k.renner referenced this issue from a commit

2026-06-26 10:23:49 +00:00

Merge pull request 'netbird-ingress: run one routing peer per node (DaemonSet)' (#45) from netbird-ingress-daemonset into master

claude-bot referenced this pull request

2026-09-25 06:29:39 +00:00

chore(wiki): image build.1790317650 (Facts page) #958

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#45