From 583fc044cb614c2a82260134a4a6b3662072fe23 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 7 Nov 2026 20:41:46 +0100 Subject: [PATCH] fix(mdns-relay): turn off RA on net1 so the IPv6 forward uses eth0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit sbr confines only the DHCP (IPv4) routes. net1 still takes a SLAAC address and an RA default route, so socat-ipv6 sent every relayed datagram out the IoT VLAN with source fd02:30::…; it came back through the UDM and HA's CNP dropped it (37k POLICY_DENIED to home-assistant:5353 in 24 h). No IPv6 mDNS announcement reached HA. Same tuning as shelly-manager-iot. The annotation bump re-attaches net1 with the new NAD. S28-36 Co-Authored-By: Claude Opus 5.5 --- .../home-assistant-iot/mdns-relay-deployment.yaml | 2 +- .../mdns-relay-network-attachment.yaml | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml b/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml index 632155d1..5da9e1b1 100644 --- a/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml +++ b/kubernetes/apps/home-assistant-iot/mdns-relay-deployment.yaml @@ -44,7 +44,7 @@ spec: annotations: # Bump to restart the pod and re-attach net1 (DHCP via multus). # 2026-10-06: first attach on containernetworking/plugins v1.9.1. - homelab.renner.uno/restarted-for: "2026-10-06 cni-plugins v1.9.1 attach check" + homelab.renner.uno/restarted-for: "2026-11-07 net1 without RA (S28-36)" k8s.v1.cni.cncf.io/networks: mdns-relay-iot spec: # Runs where the node patch declares the IoT VLAN (ens19). diff --git a/kubernetes/apps/home-assistant-iot/mdns-relay-network-attachment.yaml b/kubernetes/apps/home-assistant-iot/mdns-relay-network-attachment.yaml index 739d6cf4..63252711 100644 --- a/kubernetes/apps/home-assistant-iot/mdns-relay-network-attachment.yaml +++ b/kubernetes/apps/home-assistant-iot/mdns-relay-network-attachment.yaml @@ -31,6 +31,11 @@ spec: # dropped. The relay's forward path to Home Assistant runs over eth0, so # that route has to stay intact. # + # sbr covers IPv4 only. With Router Advertisements net1 gets a global IPv6 + # address and default route in the main table, and the IPv6 forward to the + # Service leaves via net1 with an IoT source, which HA's CNP drops. tuning + # turns RA processing off; the link-local address ff02::fb needs stays. + # # Requires the cni-dhcp-daemon DaemonSet in infrastructure/multus. config: | { @@ -45,6 +50,13 @@ spec: "type": "dhcp" } }, + { + "type": "tuning", + "sysctl": { + "net.ipv6.conf.IFNAME.accept_ra": "0", + "net.ipv6.conf.IFNAME.autoconf": "0" + } + }, { "type": "sbr" } -- 2.54.0