fix(shelly-manager): keep firmware traffic off the IoT macvlan #1516

2026-10-28T15:27:41Z

claude-bot commented

2026-10-28 15:27:41 +00:00

net1 (macvlan on v30iot) carries mDNS only. Firmware traffic stays on eth0.

Cause (captured)

Captured with cilium-dbg monitor --related-to 1708 on k8s-1 while edge-1 (fd02:30::…cebc) requested http://[fd99::8a]/:

The SYN reaches the pod on [fd10:244::7f67]:8082, and the policy verdict is allow.
The pod sends no reply via eth0. The pod's per-interface IPv6 counters for the request: eth0 in +12, out +0; net1 out +8.

In the pod's IPv6 table, net1 holds on-link routes for fd02:30::/64 and 2003:d6:970a:4901::/64, plus a default route from Router Advertisements. sbr only confines IPv4. Separately, [::]:8082 also listened on net1.

Change

shelly-manager-iot attachment: add the tuning plugin with net.ipv6.conf.IFNAME.accept_ra=0 and autoconf=0. This is the same plugin and placeholder matter-server-iot uses. net1 keeps its link-local address for mDNS.
Deployment:
- POD_IPS from status.podIPs. shelly-manager binds 8080, 8082 and 9090 to exactly these addresses (konairius/shelly-manager branch firmware-no-macvlan).
- ASPNETCORE_URLS goes back to the pod IPv4 for all three ports, for images that do not read POD_IPS.
- A pod-template annotation so the pod restarts with the new attachment.

Tested

kubectl apply --dry-run=server accepts the attachment and the Deployment, including the status.podIPs env field.

🤖 Generated with Claude Code

net1 (macvlan on v30iot) carries mDNS only. Firmware traffic stays on eth0. ## Cause (captured) Captured with `cilium-dbg monitor --related-to 1708` on k8s-1 while edge-1 (`fd02:30::…cebc`) requested `http://[fd99::8a]/`: - The SYN reaches the pod on `[fd10:244::7f67]:8082`, and the policy verdict is allow. - The pod sends no reply via eth0. The pod's per-interface IPv6 counters for the request: eth0 in +12, out +0; net1 out +8. In the pod's IPv6 table, net1 holds on-link routes for `fd02:30::/64` and `2003:d6:970a:4901::/64`, plus a default route from Router Advertisements. `sbr` only confines IPv4. Separately, `[::]:8082` also listened on net1. ## Change - `shelly-manager-iot` attachment: add the `tuning` plugin with `net.ipv6.conf.IFNAME.accept_ra=0` and `autoconf=0`. This is the same plugin and placeholder `matter-server-iot` uses. net1 keeps its link-local address for mDNS. - Deployment: - `POD_IPS` from `status.podIPs`. shelly-manager binds 8080, 8082 and 9090 to exactly these addresses (konairius/shelly-manager branch `firmware-no-macvlan`). - `ASPNETCORE_URLS` goes back to the pod IPv4 for all three ports, for images that do not read `POD_IPS`. - A pod-template annotation so the pod restarts with the new attachment. ## Tested - `kubectl apply --dry-run=server` accepts the attachment and the Deployment, including the `status.podIPs` env field. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-10-28 15:27:42 +00:00

fix(shelly-manager): no IPv6 router advertisements on the IoT NIC

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

a8c1710cab

Captured on k8s-1 (cilium-dbg monitor, endpoint 1708): an IPv6 SYN from
edge-1 (fd02:30::/64) to fd99::8a reached the pod on 8082, but no reply
left via eth0; the pod has on-link and default IPv6 routes on net1 from
RAs. sbr only confines IPv4. Turn RA processing off on net1 with the
tuning plugin (as matter-server already uses it) and roll the pod.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit 20fcdfe738 into main

2026-10-28 15:38:04 +00:00

claude-bot changed title from ~~fix(shelly-manager): no IPv6 router advertisements on the IoT NIC~~ to fix(shelly-manager): keep firmware traffic off the IoT macvlan

2026-10-28 15:44:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1516