claude-botandClaude Fable 5
3939fe51f6
ci/woodpecker/pr/pr-review Pipeline was successful
Review blocker: my previous filename fix used bash substring syntax
${TALOS_SCHEMATIC:0:12}, but the apply step runs under busybox ash
(Alpine /bin/sh) which errors 'Bad substitution' — the repo already uses
cut for this exact reason. Replaced with $(echo "$TALOS_SCHEMATIC" |
cut -c1-12). The HCL substr() in talos_image.tf is unaffected (not shell).
Also finishes the comment sweep the prior commit claimed but didn't: 4
more stale 'eth1' host-NIC references in the matter/otbr/music-assistant
NAD headers are now ens19. Grep confirms zero eth1 left in the v30iot
NAD/deployment files.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014S5CLfizEtzHS51kxJFQgc
58 lines
2.2 KiB
YAML
58 lines
2.2 KiB
YAML
---
|
|
# OTBR's second NIC: macvlan attached to the v30iot interface
|
|
# (`ens19`; same parent matter-server uses). Mirrors the matter-server NAD
|
|
# pattern. OTBR needs real L2 presence on the IoT subnet to:
|
|
# - advertise the Thread Border Router service via mDNS/SRP so Matter
|
|
# commissioners and Thread devices on the LAN can find it
|
|
# - listen for RAs on the IPv6 link so the BR can publish a usable
|
|
# off-mesh-routable (OMR) prefix into the Thread mesh
|
|
# A Cilium-managed pod IP (eth0 on the cluster pod CIDR) cannot do
|
|
# multicast on the IoT VLAN, so without this attachment OTBR's BR side
|
|
# is invisible.
|
|
#
|
|
# The address is leased from the UniFi DHCP server on v30iot. This pod
|
|
# doesn't go through Cilium IPAM — the address lives on the IoT VLAN, not
|
|
# the pod CIDR.
|
|
#
|
|
# This attachment previously pinned 10.2.30.227 via static IPAM. That
|
|
# address is inside the DHCP pool (10.2.30.100-.254) and the UDM leased
|
|
# it to a Miele fridge; the two fought over it from 2026-05-13 onward.
|
|
# OTBR binds by interface (BACKBONE_INTERFACE=net1, REST_HOST=0.0.0.0)
|
|
# and HA reaches it at otbr.home-assistant.svc.cluster.local:8081, so no
|
|
# consumer depends on the address. Requires the cni-dhcp-daemon DaemonSet
|
|
# in infrastructure/multus.
|
|
#
|
|
# No gateway is set: default route stays on the pod's primary
|
|
# (Cilium-managed) interface so non-IoT egress doesn't leak through
|
|
# ens19. The macvlan only needs the connected /24 to talk to devices on
|
|
# the IoT subnet.
|
|
apiVersion: k8s.cni.cncf.io/v1
|
|
kind: NetworkAttachmentDefinition
|
|
metadata:
|
|
name: otbr-iot
|
|
spec:
|
|
# Chained CNI: macvlan leases the v30iot address by DHCP, then `sbr`
|
|
# confines net1's routes to a source-based routing table. Without it the
|
|
# DHCP-supplied default gateway (10.2.30.1) installs a second default
|
|
# route on net1 alongside eth0's, and cluster-internal replies egress the
|
|
# IoT VLAN and are dropped. Static IPAM used to sidestep this by never
|
|
# setting a gateway; a leased address comes with one.
|
|
config: |
|
|
{
|
|
"cniVersion": "0.3.1",
|
|
"name": "otbr-iot",
|
|
"plugins": [
|
|
{
|
|
"type": "macvlan",
|
|
"master": "ens19",
|
|
"mode": "bridge",
|
|
"ipam": {
|
|
"type": "dhcp"
|
|
}
|
|
},
|
|
{
|
|
"type": "sbr"
|
|
}
|
|
]
|
|
}
|