k.rennerandClaude Opus 4.7
d45ab2bad0
Both changes broke ingress: dummy0 claiming the LB pool prefixes (10.2.99.0/24 + fd99::/64) on every node intercepted TCP destined for Service VIPs at the kernel routing layer, beating Cilium's eBPF LB to the punch and breaking Traefik / external-dns / cert-manager / many others that talk to the K8s API ClusterIP. Repeated talosctl patch applications also accumulated cruft in the live machineconfig (duplicate addresses on i40e, two interface entries claiming the control-plane VIP). dummy0 has been removed from all four nodes live via JSON-patch op:remove. sysctls block removed similarly. ICMP-to-LB-IP loop trip is back on the table — Cilium 1.19's eBPF LB still doesn't intercept ICMP, and the AnyIP fix needs to be designed not to interfere with the eBPF LB's TCP/UDP path. The simple "claim the whole pool prefix on dummy0" pattern does interfere; a per-VIP /32+/128 claim per endpoint-hosting node is the next thing to try, but that's a separate follow-up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>