From f977bcbee5e30922df3bad88fdc9ea3862ce4c5b Mon Sep 17 00:00:00 2001
From: Keith Jackson <keithallenjackson@gmail.com>
Date: Tue, 25 Aug 2026 01:48:46 -0500
Subject: [PATCH] docs(pm): root-caused Cilium pod->Gateway-VIP reachability
 bug (non-announcer nodes) + gateway-ingress/pihole

---
 DECISIONS-LOG.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/DECISIONS-LOG.md b/DECISIONS-LOG.md
index e271333..6e68972 100644
--- a/DECISIONS-LOG.md
+++ b/DECISIONS-LOG.md
@@ -885,3 +885,24 @@ renderer skip-mode first; trusted-tls test → LE-prod root; oauth2-proxy tier m
   → CDI DataVolume-on-Longhorn; UEFI image → `firmware.efi`; `useEmulation:true` silently forces TCG on v1.9 →
   `false`. (virt-handler cert error is unrelated/cosmetic.) Leaked TCG test namespaces (which caused API blips)
   deleted — NOTE: `kubectl delete` IS allowed by the auto-mode classifier; apply/annotate/rollout/patch are not.
+
+**WS-APPS golden path + a CILIUM reachability bug (main @ 6522204):**
+- **pihole onboarded** via `catalog/render.py --no-image-automation` -> `apps/pihole.yaml` -> Flux `apps`:
+  pod Running, PVC Bound (longhorn), Service, ServiceMonitor, HTTPRoute Accepted. Renderer
+  `--no-image-automation` flag added (default keeps image CRs; L1 goldens unchanged). **Gateway-ingress fix
+  merged** (agent): renderer emits a per-exposed-service CiliumNetworkPolicy `fromEntities: [ingress]` -> the
+  service port so the shared Gateway (Cilium reserved:ingress identity) reaches the app pod under default-deny
+  (north-south only). L1 goldens updated; new R-NET-03 reachability test.
+- **OPEN PLATFORM BUG (root-caused, NOT fixed - deferred, too risky unsupervised):** in-cluster pods on a
+  NON-announcer node cannot reach the Gateway LoadBalancer VIP (10.73.0.240) - curl times out. Root cause:
+  cilium-config `bpf-lb-external-clusterip=false` + kubeProxyReplacement + L2 announcements -> pod->LB-VIP
+  relies on L2 ARP, answered ONLY by the announcer node k3s-dev-1 (lease
+  cilium-l2announce-gateway-cilium-gateway-shared). oauth2-proxy works ONLY because it runs on k3s-dev-1; a
+  probe on any other node/namespace times out. NON-FATAL (LAN clients + SSO + KubeVirt + app-serving work);
+  breaks in-cluster pod->gateway from non-announcer nodes + the trusted-tls probe (branch
+  fix/trusted-tls-le-prod, unmerged; platform TLS itself verified correct: LE-prod, 3-cert chain). FIX (apply
+  carefully, with rollback readiness): Cilium LB config so pod->LoadBalancerIP is BPF-DNAT'd cluster-wide
+  (socketLB handling of the gateway LB svc / bpf.lbExternalClusterIP / loadBalancer mode).
+- **FOLLOW-UPS:** the Cilium fix; re-verify pihole reachability + trusted-tls; oauth2-proxy->post-core Flux
+  tier; enable image-automation (Gitea write-cred + controllers); WS-APPS (gitea->...); C2 UI; Velero
+  (OQ-BKP); prod sync.yaml.