From 14d5ccbadd565051cff6b5611df4fe15ee2f0c25 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Fri, 18 Sep 2026 21:33:51 -0500 Subject: [PATCH] =?UTF-8?q?fix(unifi):=20pin=20the=20MAC=20=E2=80=94=20an?= =?UTF-8?q?=20unpinned=20MAC=20is=20why=20the=20guest=20keeps=20losing=20i?= =?UTF-8?q?ts=20IP?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Operator set console-password in the SOPS secret (installer-url deliberately left as REPLACE-ME, which install-uos handles by printing 'not set yet' and exiting 0; the uosserver guard exits before it is even read). Root cause of the lost address, from evidence rather than inference. KubeVirt generates a fresh MAC per VMI when none is pinned. cloud-init writes /etc/netplan/50-cloud-init.yaml matching the MAC it saw, and will not rewrite it while the NoCloud instance-id is unchanged — and that instance-id is domain.firmware.uuid, stable across restarts by design. So every VMI recreation handed the guest a MAC its retained netplan did not match, leaving enp1s0 administratively DOWN, never even attempting DHCP. What the 2026-09-12 boot log shows, and why it fits: cloud-init's own device table reads 'enp1s0 | Up: False | Address: .'; there are no apt failures because the per-instance modules were skipped; yet UOS is installed (6.3 GB of 40 GB) and qemu-guest-agent answers — both of which required working network on an EARLIER VMI. The MAC is identical between the current VMI status and that boot log, so it did not change on this boot; the mismatch is against a netplan written under a previous incarnation. Pinned to the MAC the current VMI already holds, so nothing changes for this guest. Combined with the instance-id bump already merged, the next restart re-runs cloud-init, rewrites netplan against a MAC that is now permanent, and the interface should come up — and the console password is in place as the fallback if it does not. Still unverified from outside: the netplan file's actual contents. That needs the console the operator can now reach. Co-Authored-By: Claude Opus 5 --- apps/vms/unifi/30-virtualmachine.yaml | 14 ++++++++++++++ apps/vms/unifi/unifi-uos-installer.sops.yaml | 18 +++++++++--------- 2 files changed, 23 insertions(+), 9 deletions(-) diff --git a/apps/vms/unifi/30-virtualmachine.yaml b/apps/vms/unifi/30-virtualmachine.yaml index fec037e..d01f8c1 100644 --- a/apps/vms/unifi/30-virtualmachine.yaml +++ b/apps/vms/unifi/30-virtualmachine.yaml @@ -95,8 +95,22 @@ spec: disk: bus: virtio interfaces: + # MAC PINNED 2026-09-18, and this is a root-cause fix, not cosmetics. + # KubeVirt generates a fresh MAC for every VMI when none is pinned. cloud-init writes + # /etc/netplan/50-cloud-init.yaml with a `match` on the MAC it saw, and it will NOT rewrite + # that file while the NoCloud instance-id is unchanged — and the instance-id here is + # domain.firmware.uuid, which is stable across restarts by design. So each VMI recreation + # handed the guest a NEW MAC that the retained netplan did not match, leaving enp1s0 + # administratively DOWN with no address and no DHCP attempt. + # That is exactly what the evidence shows for the boot of 2026-09-12: cloud-init's own + # device table reports `enp1s0 | Up: False | Address: .`, no apt failures are logged + # (because the per-instance modules were skipped), yet UOS is installed and + # qemu-guest-agent runs — both of which required a working network on an EARLIER VMI. + # Pinning the MAC to the value the current VMI already holds makes the guest's netplan + # match permanently, so this cannot recur on the next recreation. - name: default masquerade: {} + macAddress: a6:d7:c0:b3:72:fa # Declaring ports on a masquerade iface (a) restricts pod->VM forwarding to exactly # these and (b) surfaces them as containerPorts on the virt-launcher pod so the # LoadBalancer Services + CiliumNetworkPolicy ingress can target/match them. diff --git a/apps/vms/unifi/unifi-uos-installer.sops.yaml b/apps/vms/unifi/unifi-uos-installer.sops.yaml index 33403ac..89d5f03 100644 --- a/apps/vms/unifi/unifi-uos-installer.sops.yaml +++ b/apps/vms/unifi/unifi-uos-installer.sops.yaml @@ -5,8 +5,8 @@ metadata: namespace: unifi type: Opaque stringData: - installer-url: ENC[AES256_GCM,data:CGCWLMiHlF57/w==,iv:/tilBVekwbHkAjSBi5UKUljfaqPo/hXhNqMYS4LY/kA=,tag:b7SeEM30ua/HvutGHYEdXg==,type:str] - console-password: ENC[AES256_GCM,data:gkPbmZ4g7he2WA==,iv:T9PUgAmOsrt4LUB+5vXBr9ctOPsXP5z/vMWr2ls+3ko=,tag:83HDr4kCrUF7u83fpIkm4A==,type:str] + installer-url: ENC[AES256_GCM,data:2sdkFOPxQ4ZrBQ==,iv:OnEip59rvdSulZASp5J8Gj2M55wuYD9TcACd63lqwBA=,tag:hJ437ZbPEnee/t48Sm6eBg==,type:str] + console-password: ENC[AES256_GCM,data:XwTpKiqnzBz/ydaa+Mbv,iv:A2sWqkDaM+GD4e0t8wKC75UM15WprYmNHNEpNyb+m/c=,tag:VKlGvpyRIQ4dqcgWTpuqiQ==,type:str] sops: kms: [] gcp_kms: [] @@ -16,14 +16,14 @@ sops: - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIV3hvNUVRTWxINmtaQkp5 - a0VkYitYNHFWUGRhYncxVXl4MFdET1VmQTJZCnVXaDhaRHpQVkdHWG4xUElqRFNG - VUhPU3dpa0VMWGxQdUxGeDZuNFZWVm8KLS0tIEFMY2RNVDBvMG51SkhqVzlXUjRR - TG9kcHdSTU5QOGpnLzkyVW9hUWJLem8KW536eEsviMq5/uyg3/RT/PrEgr4PBL3E - yNemOTU76DdU81/neHb/6NVWT44ffLoCltgSrCQ0ieBwDAorjQ3bEg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRYlFOZ25ycWRCWUpyMjdQ + OFMrWUNyMWJOVlF3MU9DY1phWnhZQ1YyeFVZCkc0WTVia2RyTkhreFYyS3Bya08r + bWwvMWt5a3E5OXh5b0xIT0FKQUE0d0UKLS0tIDJSaEc5YndEOFgrbkhlZm5TRVI5 + RVo1bWwxL0lCR2NpUENUdGovREF1K1UKnJHnFsUkg4drovNCB5xSqVUaQF48b1No + tI5+ABiIv3fjuuf+hW7lOm7M1F3jAwlNAgbe8wBqS2C9Wx5MV1kGDA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-09-19T01:51:00Z" - mac: ENC[AES256_GCM,data:yKGOdLKnIUUeSyJuzyp4CiJFhTyIJv6S8PTEdnioCpeSoRpptWYQIKR8BUrYx1/4NnghvOEyS5o0nRT56dq7vf2G+CoRf03/alDW/YHUjkAfIRjorPCO638mjdIPDytfsTBOyBXnjzjMlhHwoDjHskk+J66Qm42xFd476w9cYig=,iv:M1SwKW2ZUehklgUP+n3fefb2XoDDPBs5HnTklVh3KwM=,tag:q6eoA+pdHnwWKxQODCN7jQ==,type:str] + lastmodified: "2026-09-19T02:30:07Z" + mac: ENC[AES256_GCM,data://GkUcyrDWgcNE769Q37CT95NQYQ6KVHN31+ZQBu+S1FD1Gk7GCyHyaGPRzUjcQk60WgD12brLwr9F0e021L40NTK/ZHvsnBtFd8WpydUNLOuCitJShlMX1/VsXZvP0FHeV0/PZlb1Qebzunhgkwt8B4FUJ0D+yycNzlDrFz1Ko=,iv:iVJLPIKs4inK+dzDd06ewC8euHXMwcmwIip4ntnEmp4=,tag:X93BJEVMrIlYoQO3KiZJ0g==,type:str] pgp: [] encrypted_regex: ^(data|stringData)$ version: 3.9.4