Autonomous session: Phase-2 platform authoring + Flux bootstrap progress
Author-only Phase-2 components (platform suspended; cluster untouched): - platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE) - platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS) - platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2 - conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2) - bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume) Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG). Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed
1 parent
397f29e99a
commit
cc89b4b830
19 files changed
+1567
-221
No files matched your search
@@ -1,11 +1,20 @@
|
||||
---
|
||||
# Cilium — CNI, kube-proxy replacement, Gateway API, Egress Gateway, Hubble (ADR-0002).
|
||||
# Phase 0 STUB. Values are PLACEHOLDERS; fill in during Phase 1/2 (WS-NET).
|
||||
# Serves: R-NET-01..07, R-DNS-01, R-SEC-02. Owner: WS-NET (bootstrap shared with WS-INFRA).
|
||||
#
|
||||
# IMPORTANT (cross-workstream contract): Cilium's INITIAL install is performed by the Ansible
|
||||
# bootstrap (spec docs/02, Phase 1), replacing k3s flannel/kube-proxy. This HelmRelease manages
|
||||
# Cilium CONFIG going forward. Its values MUST match the Ansible bootstrap values (kubeProxyReplacement,
|
||||
# k8sServiceHost/Port) or Flux and the bootstrap will fight. Owner: WS-NET + WS-INFRA.
|
||||
# ============================ PARITY CONTRACT ============================
|
||||
# Cilium's INITIAL install is performed by the Ansible k3s bootstrap (spec docs/02, Phase 1) —
|
||||
# a cluster needs a CNI before Flux can run. This HelmRelease ADOPTS and manages Cilium's config
|
||||
# thereafter (docs/05). The values below MUST EQUAL the Ansible bootstrap values, or Flux and the
|
||||
# bootstrap will fight over the running CNI and break cluster networking.
|
||||
#
|
||||
# SOURCE OF TRUTH (do not diverge without updating both):
|
||||
# infra/ansible/roles/cilium/templates/cilium-values.yaml.j2
|
||||
# infra/ansible/roles/cilium/defaults/main.yml (cilium_version, k3s_api_host/port)
|
||||
#
|
||||
# Every value tagged [parity] below is asserted identical to the Ansible render. If you change one
|
||||
# here, change it in the Ansible role in the same PR. (docs/02 Cilium-ownership contract.)
|
||||
# ========================================================================
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
@@ -16,7 +25,9 @@ spec:
|
||||
chart:
|
||||
spec:
|
||||
chart: cilium
|
||||
version: ">=1.16.0 <1.17.0" # TODO(WS-NET): pin exact version at bring-up; Renovate maintains
|
||||
# [parity] Pinned to the exact version the Ansible bootstrap installs
|
||||
# (cilium_version in roles/cilium/defaults/main.yml). Renovate bumps both together.
|
||||
version: "1.16.5"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: cilium
|
||||
@@ -27,21 +38,35 @@ spec:
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
# Placeholder values — see values.yaml for the annotated skeleton. Inlined here so the intent
|
||||
# (Cilium REPLACES flannel + kube-proxy + Traefik) is visible at the release.
|
||||
# Values are inlined so the intent (Cilium REPLACES flannel + kube-proxy + Traefik) is visible at
|
||||
# the release. MUST equal the Ansible bootstrap render (see PARITY CONTRACT header).
|
||||
values:
|
||||
# --- kube-proxy replacement (ADR-0001/0002: k3s kube-proxy disabled) ---
|
||||
# [parity] MUST equal Ansible: kubeProxyReplacement: true
|
||||
kubeProxyReplacement: true
|
||||
# TODO(WS-INFRA): k8sServiceHost/k8sServicePort must equal the Ansible bootstrap's API endpoint.
|
||||
k8sServiceHost: "REPLACE-ME" # e.g. the k3s API VIP/host
|
||||
# [parity] MUST equal Ansible: k8sServiceHost/k8sServicePort = the k3s API endpoint
|
||||
# (k3s_api_host/k3s_api_port). This is the primary control-plane node IP. Setting these
|
||||
# wrong (e.g. the old "REPLACE-ME") breaks Cilium's connection to the API server on adopt.
|
||||
k8sServiceHost: "10.73.0.11"
|
||||
k8sServicePort: 6443
|
||||
# --- Gateway API (ingress; replaces Traefik) — docs/09, ADR-0002 ---
|
||||
# [parity] MUST equal Ansible: gatewayAPI.enabled: true
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
# --- Egress Gateway (egress-class steering; part of VPN model with ADR-0013) ---
|
||||
# --- Egress Gateway (egress-class steering; part of the VPN model, ADR-0013) ---
|
||||
# [parity] MUST equal Ansible: egressGateway.enabled: true
|
||||
egressGateway:
|
||||
enabled: true
|
||||
# --- Masquerade (REQUIRED by Egress Gateway) — Phase-1 crash fix ---
|
||||
# [parity] MUST equal Ansible: enableIPv4Masquerade: true + bpf.masquerade: true.
|
||||
# This exact pairing (ipv4 masquerade via eBPF, the correct companion to kubeProxyReplacement)
|
||||
# was the fix for the Phase-1 agent crash. Enabling one without the other regresses it —
|
||||
# keep both, and keep them equal to the Ansible values.
|
||||
enableIPv4Masquerade: true
|
||||
bpf:
|
||||
masquerade: true
|
||||
# --- Hubble (flow observability / isolation audit) ---
|
||||
# [parity] MUST equal Ansible: hubble.{enabled,relay.enabled,ui.enabled}: true
|
||||
hubble:
|
||||
enabled: true
|
||||
relay:
|
||||
@@ -49,7 +74,21 @@ spec:
|
||||
ui:
|
||||
enabled: true # exposure gated behind oauth2-proxy forward-auth later (ADR-0014)
|
||||
# --- L2 announcement for the ingress VIP on the flat LAN (docs/09, OQ-1 resolved) ---
|
||||
# [parity] MUST equal Ansible: l2announcements.enabled: true. IP pool +
|
||||
# CiliumL2AnnouncementPolicy (reserved 10.73.0.240-.250) authored by WS-NET in Phase 2.
|
||||
l2announcements:
|
||||
enabled: true
|
||||
# --- cgroup: k3s ships its own cgroup mount; point Cilium at it, don't auto-mount ---
|
||||
# [parity] MUST equal Ansible cgroup block. Not in the deliverable's headline list, but it IS
|
||||
# part of the working CNI config on k3s: reconciling without it lets Cilium try to auto-mount
|
||||
# cgroupv2 and break on adopt. Kept in parity for a safe Phase-2 adoption.
|
||||
cgroup:
|
||||
autoMount:
|
||||
enabled: false
|
||||
hostRoot: /run/cilium/cgroupv2
|
||||
# NOTE (NON-parity): operator.replicas is deliberately omitted here. The Ansible dev render sets
|
||||
# replicas: 1 to save RAM, but defaults/main.yml declares it explicitly NOT a parity field
|
||||
# (Flux/prod may differ). Only the [parity] values above must match the bootstrap.
|
||||
#
|
||||
# TODO(WS-NET, Phase 2): default-deny baseline, CiliumL2AnnouncementPolicy + IP pool,
|
||||
# Egress Gateway policies, Hubble metrics export to kube-prometheus-stack.
|
||||
+45
-11
@@ -1,13 +1,47 @@
|
||||
# Cilium Helm values — PLACEHOLDER skeleton (Phase 0). Authoritative values live inline in
|
||||
# helmrelease.yaml for now; this file documents the knobs WS-NET must set in Phase 1/2.
|
||||
# Cilium Helm values — REFERENCE COPY of the parity set (docs/02 Cilium-ownership contract).
|
||||
#
|
||||
# MUST match the Ansible bootstrap (docs/02) for the fields the bootstrap also sets.
|
||||
# The AUTHORITATIVE values that Flux reconciles are inlined in helmrelease.yaml. This file is a
|
||||
# readable, un-nested mirror of that value set so WS-NET can diff it against the live cluster and
|
||||
# the Ansible bootstrap render at a glance. Keep the two in sync.
|
||||
#
|
||||
# kubeProxyReplacement: true # k3s kube-proxy disabled (ADR-0001/0002)
|
||||
# k8sServiceHost / k8sServicePort # = Ansible bootstrap API endpoint (WS-INFRA contract)
|
||||
# gatewayAPI.enabled: true # ingress via Gateway API, no Traefik (docs/09)
|
||||
# egressGateway.enabled: true # egress-class steering (ADR-0002, VPN model ADR-0013)
|
||||
# hubble.{enabled,relay,ui} # flow observability + isolation audit
|
||||
# l2announcements.enabled: true # ingress VIP on flat LAN (docs/09, OQ-1)
|
||||
# ipam / ipv4NativeRoutingCIDR # TODO: pin to the cluster pod/LAN CIDRs at bring-up
|
||||
# encryption (wireguard/ipsec) # TODO(WS-SEC/WS-NET): decide east-west encryption later
|
||||
# SOURCE OF TRUTH (all [parity] fields MUST equal these):
|
||||
# infra/ansible/roles/cilium/templates/cilium-values.yaml.j2
|
||||
# infra/ansible/roles/cilium/defaults/main.yml (cilium_version: 1.16.5, k3s_api_host/port)
|
||||
#
|
||||
# chart version (helmrelease.yaml chart.spec.version): 1.16.5 # [parity] = cilium_version
|
||||
|
||||
# [parity] k3s kube-proxy disabled → Cilium replaces it (ADR-0001/0002)
|
||||
kubeProxyReplacement: true
|
||||
# [parity] = the k3s API endpoint (primary control-plane node IP) + port
|
||||
k8sServiceHost: "10.73.0.11"
|
||||
k8sServicePort: 6443
|
||||
# [parity] ingress via Gateway API, no Traefik (docs/09)
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
# [parity] egress-class steering (ADR-0002; VPN model ADR-0013)
|
||||
egressGateway:
|
||||
enabled: true
|
||||
# [parity] Egress Gateway REQUIRES masquerade; ipv4 + eBPF is the Phase-1 crash fix — keep BOTH
|
||||
enableIPv4Masquerade: true
|
||||
bpf:
|
||||
masquerade: true
|
||||
# [parity] flow observability / isolation audit
|
||||
hubble:
|
||||
enabled: true
|
||||
relay:
|
||||
enabled: true
|
||||
ui:
|
||||
enabled: true
|
||||
# [parity] ingress VIP announcement on the flat LAN (docs/09, OQ-1)
|
||||
l2announcements:
|
||||
enabled: true
|
||||
# [parity] k3s provides the cgroupv2 mount; do not auto-mount
|
||||
cgroup:
|
||||
autoMount:
|
||||
enabled: false
|
||||
hostRoot: /run/cilium/cgroupv2
|
||||
# NON-parity (Flux/prod may differ; dev sets 1 to save RAM) — omitted from the HelmRelease:
|
||||
# operator.replicas
|
||||
#
|
||||
# TODO (Phase 2, WS-NET): ipam / ipv4NativeRoutingCIDR pinned to cluster CIDRs; east-west
|
||||
# encryption (wireguard/ipsec) decision (WS-SEC/WS-NET).
|
||||
Reference in new issue
Block a user