From e11ba99991cfc9f584276400e63e3d38976826dc Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Wed, 26 Aug 2026 02:37:31 +0200 Subject: [PATCH] fix(cilium): roll the agent DaemonSet when cilium-config changes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cilium reads datapath options once, at agent start, and the chart puts no config checksum on the pod template. A changed ConfigMap therefore leaves every agent running the previous datapath until something restarts it, and nothing does — the DaemonSet is not rolled by a ConfigMap-only Helm change. This already cost an outage. vlan-bpf-bypass landed in cilium-config and every v30iot macvlan workload stayed broken until the agents were deleted by hand, one node at a time (issue #592). The merge looked successful: HelmRelease Ready, release upgraded, key present in the ConfigMap, and nothing working. policyMapMax carries the same exposure. Its comment says "takes effect on agent restart", which is documentation standing in for automation — as does the equivalent note in the two bootstrap copies. Reloader is already deployed and used across the repo for the same purpose. Named per-ConfigMap rather than blanket, matching the existing convention. The trade, stated plainly: any cilium-config change now rolls the CNI cluster-wide, node by node. That is the same disruption a datapath change already required; the difference is that it happens on its own rather than being forgotten. Co-Authored-By: Claude Opus 5 (1M context) --- .../infrastructure/cilium/helmrelease.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/kubernetes/infrastructure/cilium/helmrelease.yaml b/kubernetes/infrastructure/cilium/helmrelease.yaml index 044977db..1886933e 100644 --- a/kubernetes/infrastructure/cilium/helmrelease.yaml +++ b/kubernetes/infrastructure/cilium/helmrelease.yaml @@ -33,6 +33,24 @@ spec: remediation: retries: 3 values: + # Roll the agent DaemonSet when cilium-config changes. Cilium reads + # datapath options once, at agent start, and the chart puts no config + # checksum on the pod template — so a changed ConfigMap leaves every agent + # running the previous datapath until something restarts it. Nothing did. + # + # This is not hypothetical. vlan-bpf-bypass reached cilium-config and every + # v30iot macvlan workload stayed broken until the agents were deleted by + # hand, one node at a time (issue #592). policyMapMax has the same + # exposure, and its comment below says "takes effect on agent restart" — + # documentation standing in for automation. + # + # The trade: any cilium-config change now rolls the CNI cluster-wide, + # node by node. That is disruptive-ish, but it is what a datapath change + # already required — the difference is that it now happens on its own + # instead of being forgotten. Reloader is already deployed for exactly + # this pattern; named per-ConfigMap rather than blanket, as elsewhere. + annotations: + configmap.reloader.stakater.com/reload: cilium-config # Which pod labels feed security-identity computation. Patterns are # start-anchored regexes; a leading "!" excludes while keeping the default # set. Woodpecker stamps every step pod with woodpecker-ci.org/task-uuid -- 2.54.0