konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

fix(bird): route LoadBalancer VIP replies into table 47 (#1547) #1548

Closed
hermes-bot wants to merge 1 commits from fix/vip-replies-table-47 into main
pull from: fix/vip-replies-table-47
merge into: :main
Conversation 0 Commits 1 Files Changed 7
+112 -6
1 Commits
Author SHA1 Message Date
hermes-bot d0da46b054 fix(bird): route LoadBalancer VIP replies into table 47 (#1547)
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details 
A reply from a LoadBalancer VIP reaches the kernel's routing decision
with the VIP as its source: Cilium reverses the service NAT in
from-container before the packet enters the stack. The pod-source rules
1000/1001 do not match it, so it took main's default over mgmt0 while
the request had arrived on ingress0 as the BGP next hop.

bird's DaemonSet gets a vip-rules container that reads every enabled
CiliumLoadBalancerIPPool and keeps one rule per block, priority 1002,
`from <block> lookup 47`, reconciled every minute. The pool stays the
only place the prefixes are written. Like the pod rules, a rule into an
empty table 47 (bird gone) falls through to main.

bgp-pool's blocks move from start/stop to the equivalent CIDRs so each
block maps to one rule. Cilium v1.20.4 LB-IPAM compares a modified
pool's blocks by first and last address (handlePoolModified,
LBRange.EqualCIDR), and allowFirstLastIPs unset keeps .0/.255 and
fd99::/fd99::ff allocatable, so the ranges are kept and no service is
reallocated.

Closes #1547
 2026-11-02 06:36:08 +00:00