From c68b9ad7c24bbb1f6d8df71f45586c7cdda95cf6 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Mon, 2 Nov 2026 10:36:01 +0100 Subject: [PATCH] fix(shelly-manager): disable TCP black-hole detection in the pod netns Cilium sets net.ipv4.tcp_mtu_probing=1 in every pod netns (packetization-layer-pmtud-mode: blackhole). Shelly devices stop ACKing for seconds while they write flash during an OTA; after tcp_retries1 timeouts the kernel treats that as a PMTU black hole and halves the MSS on every stall, from 1440 down to the 48-byte floor. Upward probes need an open congestion state with cwnd >= 11, which the stalling device never allows, so the download stays at 48-byte segments and fills the device's receive buffer. The tuning plugin of the IoT attachment sets the sysctl to 0 for the pod netns; the annotation bump rolls the pod so the attachment is re-run. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0185Qb5YG28FfnVi1ujMEV5C --- .../apps/home-assistant-iot/shelly-manager-deployment.yaml | 2 +- .../shelly-manager-network-attachment.yaml | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml b/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml index 9ffba998..c21261e1 100644 --- a/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml +++ b/kubernetes/apps/home-assistant-iot/shelly-manager-deployment.yaml @@ -46,7 +46,7 @@ spec: k8s.v1.cni.cncf.io/networks: shelly-manager-iot # Changing this rolls the pod, which is the only way a change to the # shelly-manager-iot attachment takes effect. - net.renner.uno/iot-attachment-config: "tuning-no-ra" + net.renner.uno/iot-attachment-config: "tuning-no-ra-no-mtu-probing" spec: # eth0 (Cilium-managed pod network) is still the primary — it # carries the ingress, mosquitto LB return path, etc. The macvlan diff --git a/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml b/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml index bc4a1476..1f781267 100644 --- a/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml +++ b/kubernetes/apps/home-assistant-iot/shelly-manager-network-attachment.yaml @@ -50,6 +50,9 @@ spec: # to IPv6 clients on v30iot leave via net1, bypassing Cilium's LoadBalancer # reverse NAT. tuning turns RA processing off on net1; the link-local # address mDNS uses stays. + # + # tcp_mtu_probing (pod-wide; Cilium sets 1): Shelly flash-write stalls + # trip black-hole detection, which cuts firmware downloads to 48-byte MSS. config: | { "cniVersion": "0.3.1", @@ -67,7 +70,8 @@ spec: "type": "tuning", "sysctl": { "net.ipv6.conf.IFNAME.accept_ra": "0", - "net.ipv6.conf.IFNAME.autoconf": "0" + "net.ipv6.conf.IFNAME.autoconf": "0", + "net.ipv4.tcp_mtu_probing": "0" } }, { -- 2.54.0