konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

feat(network-policies): CiliumCIDRGroup per client network #1583

Merged
k.renner merged 1 commits from feat/cidr-groups-per-vlan into main 2026-11-06 14:47:46 +00:00
Conversation 0 Commits 1 Files Changed 2
+151
claude-bot commented 2026-11-06 14:45:23 +00:00
Member
Copy Link
Copy Source

Adds one CiliumCIDRGroup per UDM client network (net-iot, net-privat, net-server, net-vpn, …) with its ULA and IPv4 prefixes, taken from the live UDM network config. LoadBalancer CNPs can then restrict their sources with fromCIDRSet: [{cidrGroupRef: net-…}] instead of repeating subnets.

ISP-delegated GUA prefixes are left out because they change; clients reach the fd99:: LB addresses from their ULA.

No policy references the groups yet, so traffic is unchanged. Server-side dry-run of all 17 objects passes.

Refs S28-19

🤖 Generated with Claude Code

Adds one `CiliumCIDRGroup` per UDM client network (`net-iot`, `net-privat`, `net-server`, `net-vpn`, …) with its ULA and IPv4 prefixes, taken from the live UDM network config. LoadBalancer CNPs can then restrict their sources with `fromCIDRSet: [{cidrGroupRef: net-…}]` instead of repeating subnets. ISP-delegated GUA prefixes are left out because they change; clients reach the `fd99::` LB addresses from their ULA. No policy references the groups yet, so traffic is unchanged. Server-side dry-run of all 17 objects passes. Refs S28-19 🤖 Generated with [Claude Code](https://claude.com/claude-code)
claude-bot added 1 commit 2026-11-06 14:45:24 +00:00
feat(network-policies): CiliumCIDRGroup per client network
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
6de87eba4c 
One group per UDM client network (ULA + IPv4; ISP-delegated GUA
prefixes are not stable and are left out), so LoadBalancer CNPs can
restrict sources via fromCIDRSet.cidrGroupRef instead of repeating
subnets. Adds no policy; no traffic changes.

Refs S28-19

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
k.renner merged commit c541190e8e into main 2026-11-06 14:47:46 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#1583