commit 119f23917af6d2ce8f2f2c38db02c6b909fcdcf5 parent 77fcc527449eebfbfb9ce07885febd860b2c5a27 Author: MTRNord <MTRNord@users.noreply.github.com> Date: Sat, 21 Mar 2026 16:47:22 +0100 add a missing route for v6 since we cant go via the hetzner network Signed-off-by: MTRNord <MTRNord@users.noreply.github.com> Diffstat:
| A | infrastructure_talos/configs/cilium-ipv6-wg-route.yaml | | | 52 | ++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| M | infrastructure_talos/configs/kustomization.yaml | | | 1 | + |
2 files changed, 53 insertions(+), 0 deletions(-)
diff --git a/infrastructure_talos/configs/cilium-ipv6-wg-route.yaml b/infrastructure_talos/configs/cilium-ipv6-wg-route.yaml @@ -0,0 +1,52 @@ +--- +# Adds a kernel route for the IPv6 pod CIDR via cilium_wg0 on every node. +# +# With Cilium WireGuard + dual-stack, Cilium routes pod IPv6 traffic entirely +# in BPF without installing kernel routes. This is fine for regular pods but +# breaks cilium-health secondary endpoint probes which run from the host +# network namespace and rely on kernel routing. +# +# The more-specific per-node /64 routes via cilium_host still take priority +# for local pod traffic (longest prefix match wins). +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: cilium-ipv6-wg-route + namespace: kube-system + labels: + app: cilium-ipv6-wg-route +spec: + selector: + matchLabels: + app: cilium-ipv6-wg-route + template: + metadata: + labels: + app: cilium-ipv6-wg-route + spec: + hostNetwork: true + tolerations: + - operator: Exists + priorityClassName: system-node-critical + containers: + - name: route-keeper + image: alpine:3.21 + command: + - sh + - -c + - | + while true; do + if ip link show cilium_wg0 > /dev/null 2>&1; then + ip -6 route replace fd00:10:244::/56 dev cilium_wg0 2>/dev/null + fi + sleep 30 + done + securityContext: + privileged: true + resources: + requests: + cpu: 1m + memory: 8Mi + limits: + cpu: 10m + memory: 16Mi diff --git a/infrastructure_talos/configs/kustomization.yaml b/infrastructure_talos/configs/kustomization.yaml @@ -9,3 +9,4 @@ resources: - cnpg-cluster.yaml - velero-schedules.yaml - velero-alerts.yaml + - cilium-ipv6-wg-route.yaml