From 125ca428bc940ba38bd3515ad4ba6f0456b2962f Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sun, 16 Aug 2026 02:04:50 -0500 Subject: [PATCH] fix(phase1): two execution-surfaced bugs bringing up k3s+Cilium - ansible.cfg: stdout_callback 'yaml' (community.general.yaml) was REMOVED in ansible-core 2.20 -> use builtin default + result_format=yaml. - cilium-values: egressGateway.enabled requires ipv4+eBPF masquerade or the agent fatals at startup ('egress gateway requires --enable-ipv4-masquerade and --enable-bpf-masquerade'). Add enableIPv4Masquerade + bpf.masquerade=true (also the correct pairing with kubeProxyReplacement; [parity] w/ platform/cilium). Verified live: 3/3 nodes Ready, embedded-etcd HA, Cilium status OK, CoreDNS up. Co-Authored-By: Claude Opus 4.8 (1M context) --- infra/ansible/ansible.cfg | 4 +++- infra/ansible/roles/cilium/templates/cilium-values.yaml.j2 | 6 ++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/infra/ansible/ansible.cfg b/infra/ansible/ansible.cfg index 0d8663b..d23f4ce 100644 --- a/infra/ansible/ansible.cfg +++ b/infra/ansible/ansible.cfg @@ -3,7 +3,9 @@ inventory = inventory/hosts.ini roles_path = roles host_key_checking = False retry_files_enabled = False -stdout_callback = yaml +# ansible-core 2.20 removed community.general.yaml; use the builtin default with YAML result format. +stdout_callback = default +result_format = yaml interpreter_python = auto_silent [ssh_connection] diff --git a/infra/ansible/roles/cilium/templates/cilium-values.yaml.j2 b/infra/ansible/roles/cilium/templates/cilium-values.yaml.j2 index e360506..0704adb 100644 --- a/infra/ansible/roles/cilium/templates/cilium-values.yaml.j2 +++ b/infra/ansible/roles/cilium/templates/cilium-values.yaml.j2 @@ -17,6 +17,12 @@ gatewayAPI: egressGateway: enabled: true +# Egress Gateway REQUIRES masquerade (ipv4 + eBPF). eBPF masquerade is the correct +# pairing with kubeProxyReplacement. [parity] must match platform/cilium HelmRelease. +enableIPv4Masquerade: true +bpf: + masquerade: true + # Flow observability / isolation audit (ADR-0002). hubble: enabled: true