Cilium adoption prerequisite (blocks the DOM-2 CNI swap; FQDN-egress renderer already merged default-off) #60

Open
opened 2026-07-01 21:22:34 +00:00 by plat · 2 comments
Owner

DOM-2 delivered the per-app CiliumNetworkPolicy toFQDNs egress renderer (mcp, default-off PLAT_FQDN_EGRESS, proven live on Cilium: api.github.com ALLOW / gitlab+pypi BLOCK; std NetworkPolicy still enforces under Cilium). The germination CNI SWAP to Cilium is DEFERRED — two reproducible blockers on k3s/k3d: (A) kube-proxy present → Cilium does not bind the registry-mirror hostPort 127.0.0.1:31100 (only under kube-proxy-replacement) → in-cluster image pulls fail; (B) kpr=true → Flux/metrics-server CrashLoop with x509 apiserver cert-trust failure (known k3s+Cilium-kpr incompatibility; bpf.hostLegacyRouting did not fix). PREREQUISITE (pick one) before adopting Cilium: (a) make the registry mirror not depend on hostPort (NodePort/hostNetwork socat) so kube-proxy can stay, OR (b) resolve the k3s+Cilium-kpr apiserver cert-trust (dedicated apiserver LB SAN/cert). Then flip PLAT_FQDN_EGRESS=1 and the egress feature lights up unchanged. Evidence + the bin/up swap were in the closed PR #59.

DOM-2 delivered the per-app CiliumNetworkPolicy toFQDNs egress renderer (mcp, default-off PLAT_FQDN_EGRESS, proven live on Cilium: api.github.com ALLOW / gitlab+pypi BLOCK; std NetworkPolicy still enforces under Cilium). The germination CNI SWAP to Cilium is DEFERRED — two reproducible blockers on k3s/k3d: (A) kube-proxy present → Cilium does not bind the registry-mirror hostPort 127.0.0.1:31100 (only under kube-proxy-replacement) → in-cluster image pulls fail; (B) kpr=true → Flux/metrics-server CrashLoop with x509 apiserver cert-trust failure (known k3s+Cilium-kpr incompatibility; bpf.hostLegacyRouting did not fix). PREREQUISITE (pick one) before adopting Cilium: (a) make the registry mirror not depend on hostPort (NodePort/hostNetwork socat) so kube-proxy can stay, OR (b) resolve the k3s+Cilium-kpr apiserver cert-trust (dedicated apiserver LB SAN/cert). Then flip PLAT_FQDN_EGRESS=1 and the egress feature lights up unchanged. Evidence + the bin/up swap were in the closed PR #59.
Author
Owner

Prerequisite (a) implemented, pending live validation: plat/gitops#12 (plat/gitops#12) makes the registry mirror independent of the CNI-managed hostPort, so kube-proxy can stay for the Cilium swap.

Design in one line: the mirror endpoint splits into a hostNetwork Caddy DaemonSet that does a plain loopback-only bind 127.0.0.1:31100 in the host netns (no CNI portmap, no service-proxy datapath — binds identically under flannel+kube-proxy, Cilium+kube-proxy, or Cilium+kpr, directly clearing blocker A) plus a pod-network registry-realm-rewrite Deployment that keeps the Www-Authenticate realm rewrite and the pod-sourced hop to forgejo-http, so allow-ingress-forgejo is untouched. The creation-time registries.yaml address 127.0.0.1:31100 keeps being served as-is — no recipe change, works for already-created platforms.

Status: static validation only (kustomize render, caddy validate/adapt, apiserver --dry-run=server incl. Kyverno admission). Deliberately NOT rolled on the shared live cluster — it is image-pull-critical. Remaining before flipping the swap: a disposable germination to prove end-to-end pull-through, the rollover port handoff (hostPort pod -> hostNetwork pod), and then a Cilium (kpr off) germination to confirm pulls and light up PLAT_FQDN_EGRESS=1.

**Prerequisite (a) implemented, pending live validation:** plat/gitops#12 (https://git.open-platform.sh/plat/gitops/pulls/12) makes the registry mirror independent of the CNI-managed hostPort, so kube-proxy can stay for the Cilium swap. Design in one line: the mirror endpoint splits into a `hostNetwork` Caddy DaemonSet that does a plain loopback-only `bind 127.0.0.1:31100` in the host netns (no CNI portmap, no service-proxy datapath — binds identically under flannel+kube-proxy, Cilium+kube-proxy, or Cilium+kpr, directly clearing blocker A) plus a pod-network `registry-realm-rewrite` Deployment that keeps the Www-Authenticate realm rewrite and the pod-sourced hop to forgejo-http, so `allow-ingress-forgejo` is untouched. The creation-time `registries.yaml` address `127.0.0.1:31100` keeps being served as-is — no recipe change, works for already-created platforms. Status: static validation only (kustomize render, `caddy validate`/`adapt`, apiserver `--dry-run=server` incl. Kyverno admission). Deliberately NOT rolled on the shared live cluster — it is image-pull-critical. Remaining before flipping the swap: a disposable germination to prove end-to-end pull-through, the rollover port handoff (hostPort pod -> hostNetwork pod), and then a Cilium (kpr off) germination to confirm pulls and light up `PLAT_FQDN_EGRESS=1`.
Author
Owner

Prerequisite (a) DELIVERED and on prod + in the seed: plat/gitops#12 (hostNetwork loopback forwarder + pod-network realm rewriter + NET_BIND_SERVICE capfix) merged after live validation on val076 (fresh admission Running, 127.0.0.1:31100 bound in node netns, crictl pull green). The mirror no longer depends on CNI hostPort plumbing — the Cilium swap can proceed against blocker (A); blocker (B) kpr apiserver cert-trust remains open. Issue stays open for the swap itself.

Prerequisite (a) DELIVERED and on prod + in the seed: plat/gitops#12 (hostNetwork loopback forwarder + pod-network realm rewriter + NET_BIND_SERVICE capfix) merged after live validation on val076 (fresh admission Running, 127.0.0.1:31100 bound in node netns, crictl pull green). The mirror no longer depends on CNI hostPort plumbing — the Cilium swap can proceed against blocker (A); blocker (B) kpr apiserver cert-trust remains open. Issue stays open for the swap itself.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
open-platform/mitosis#60
No description provided.