cilium-ipv6-wg-route.yaml (1496B)
1 --- 2 # Adds a kernel route for the IPv6 pod CIDR via cilium_wg0 on every node. 3 # 4 # With Cilium WireGuard + dual-stack, Cilium routes pod IPv6 traffic entirely 5 # in BPF without installing kernel routes. This is fine for regular pods but 6 # breaks cilium-health secondary endpoint probes which run from the host 7 # network namespace and rely on kernel routing. 8 # 9 # The more-specific per-node /64 routes via cilium_host still take priority 10 # for local pod traffic (longest prefix match wins). 11 apiVersion: apps/v1 12 kind: DaemonSet 13 metadata: 14 name: cilium-ipv6-wg-route 15 namespace: kube-system 16 labels: 17 app: cilium-ipv6-wg-route 18 spec: 19 selector: 20 matchLabels: 21 app: cilium-ipv6-wg-route 22 template: 23 metadata: 24 labels: 25 app: cilium-ipv6-wg-route 26 spec: 27 hostNetwork: true 28 tolerations: 29 - operator: Exists 30 priorityClassName: system-node-critical 31 containers: 32 - name: route-keeper 33 image: alpine:3.21 34 command: 35 - sh 36 - -c 37 - | 38 while true; do 39 if ip link show cilium_wg0 > /dev/null 2>&1; then 40 ip -6 route replace fd00:10:244::/56 dev cilium_wg0 2>/dev/null 41 fi 42 sleep 30 43 done 44 securityContext: 45 privileged: true 46 resources: 47 requests: 48 cpu: 1m 49 memory: 8Mi 50 limits: 51 cpu: 10m 52 memory: 16Mi