revert(vpn-ingress): withdraw the L2 lease-collision fix — a node CAN reach a VIP it announces

PR #69 claimed a node cannot reach a LoadBalancer VIP whose Cilium L2 announcement lease it holds, and excluded the VPN ingress node from announcing on that basis. The claim makes a sharp prediction; today's power-cycle put ALL EIGHT cilium-l2announce-* leases on k3s-prod-1, and the prediction failed. Measured 2026-10-17 from the wireguard pod's host netns on each node: the holder reaches 192.168.2.20/.22/.23/.24 normally (curl 200 in 18ms on .20) while its ip neigh for every one of them sits at FAILED. The asserted cause is present without the asserted effect, which falsifies it. .21 (unifi) fails from all three nodes and is a separate pre-existing fault. It is inert because no path resolves a VIP by ARP: cilium-dbg reports KubeProxyReplacement on [eno1, wg0] and programs 192.168.2.20:443 => 127.0.0.1:13606, so VIPs are DNAT'd in BPF before any neighbour lookup, on the forwarded path as well as the host one. Both probes behind the original diagnosis were bad. `ip neigh` FAILED is permanent and harmless, and a ping artefact. `curl --interface wg0` — the control used to rule out a host-netns artefact — fails on all three nodes, including ones whose ARP resolves, so it discriminates nothing. The deeper error: a MASQUERADEd client is FORWARDED while every pod-runnable probe is socket-originated. Sharing a netns is not sharing a hook. Reverted the policy nodeSelector, the Ansible node label, both alerts, their promtool tests and the kube-state-metrics allowlist entry. Kept documentation only: the measurements, which probes lie, and the fact that the forwarded path remains unmeasured without a connected client. Also recorded, for the reported "LAN and cluster work, internet does not": new-peer.sh has emitted a FULL tunnel (0.0.0.0/0) by default since f92707f, so there is no full-tunnel option to add and no code change is made. The server side is capable — ip_forward=1, the 10.90.0.0/24 MASQUERADE present with an empty CILIUM_POST_nat ahead of it, FORWARD accepts, default route intact, nodes reach 1.1.1.1. A full tunnel egresses the HOUSE WAN, not PIA: the egress policy selects pods by egress-class=vpn, this pod is labelled internet, and tun0 exists on k3s-prod-3 only. Root cause NOT found; no client has connected since the power-cycle (0 forwarded packets, no handshake), so it is not reproducible here. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
2026-10-17 23:58:40 -05:00
1 parent 4656b07178
commit e82dab5df5
@@ -1147,97 +1147,6 @@ spec:
              metricLabelsAllowlist.
            runbook_url: "https://${BASE_DOMAIN}/runbooks/vpn-egress-stale"
        # -----------------------------------------------------------------------------------------
-        # REMOTE-ACCESS VPN (platform/vpn-ingress) -- NOT the egress tunnel above. Different
-        # direction, different workload: this is inbound WireGuard for remote devices.
-        # -----------------------------------------------------------------------------------------
-        - alert: VpnIngressNodeAnnouncesL2VIP
-          # THE FAILURE THIS CATCHES. MEASURED on prod 2026-10-08: a node CANNOT reach a
-          # LoadBalancer VIP whose Cilium L2 announcement lease it holds itself -- the announcer
-          # does not answer its own ARP request, so the neighbour entry settles at `FAILED` and
-          # packets die before leaving the node (`ip neigh show 192.168.2.20` -> FAILED on the
-          # lease holder, resolved on both others). platform/vpn-ingress runs WireGuard on
-          # `hostNetwork` and MASQUERADEs remote clients to the node's own address, so if the node
-          # the router forwards udp/51820 to is also a lease holder, VPN clients cannot reach the
-          # VIPs it announces. On 2026-10-08 that was the `shared` Gateway: all 16 app hostnames
-          # dead over the VPN, while PiHole DNS kept answering (its VIP has two Services and the
-          # other lease sat on prod-2) -- so the tunnel handshook, names resolved, and every app
-          # hung. Nothing reported it for ~2 days.
-          #
-          # platform-config/cilium/l2-announcement-policy.yaml now excludes the node labelled
-          # `homelab.keithjackson.dev/vpn-ingress=true` from announcing, so this should be
-          # permanently unsatisfiable. The alert exists because the exclusion has ways to stop
-          # working that no static check on that file's TEXT can see: the label being removed or
-          # moved to the wrong node, a Cilium upgrade changing `NotIn` semantics or the
-          # nodeSelector field, and the selector silently failing to match. This watches the
-          # OUTCOME -- who actually holds the lease -- so all of them surface the same way.
-          #
-          # WHY THE LABEL JOIN RATHER THAN A NODE NAME. The node's identity is NOT written into
-          # this expr, because the harness (tests/extract_rules.py) refuses any alert whose expr
-          # contains a dollar-brace placeholder -- spelled in words because a literal one here is
-          # unparseable to envsubst and would fail this whole Kustomization. Rightly so: the rule it
-          # unit-tests would not be the
-          # rule deployed. Joining `kube_lease_owner` against `kube_node_labels` keeps ONE source
-          # of truth (the label itself, which is also what the policy selects on), so this alert
-          # cannot drift out of agreement with the exclusion it guards. `label_replace` is needed
-          # because kube_lease_owner names the holder `lease_holder` while kube_node_labels names
-          # it `node`; the join is then on a shared `node` label. The label is in
-          # kube-state-metrics' metricLabelsAllowlist (kube-prometheus-stack.yaml) -- without that
-          # line this rule is inert, which `VpnIngressNodeLabelMissing` below exists to catch.
-          #
-          # `for: 15m` because leases legitimately move during a node reboot or a Cilium roll and
-          # Cilium re-elects within seconds; a real collision persists, since the lease holder
-          # keeps renewing and it never self-heals.
-          expr: |
-            max by (lease) (
-              label_replace(
-                kube_lease_owner{namespace="kube-system", lease=~"cilium-l2announce-.*"},
-                "node", "$1", "lease_holder", "(.+)"
-              )
-              * on (node) group_left ()
-              kube_node_labels{label_homelab_keithjackson_dev_vpn_ingress="true"}
-            ) == 1
-          for: 15m
-          labels:
-            severity: critical
-          annotations:
-            summary: "VPN ingress node is announcing a LoadBalancer VIP ({{ $labels.lease }})"
-            description: >-
-              The node labelled homelab.keithjackson.dev/vpn-ingress=true terminates remote-access
-              WireGuard, and it now holds the Cilium L2 announcement lease `{{ $labels.lease }}`. A
-              node cannot reach a VIP it announces itself, so every remote VPN client has just lost
-              all access to that VIP's Service -- silently, with DNS still resolving. Check that
-              platform-config/cilium/l2-announcement-policy.yaml still excludes that label and that
-              the label is still on the node the router forwards udp/51820 to.
-            runbook_url: "https://${BASE_DOMAIN}/runbooks/vpn-ingress-l2-collision"
-        - alert: VpnIngressNodeLabelMissing
-          # THE WATCHDOG for the rule above, and the reason it is not optional. The exclusion in
-          # l2-announcement-policy.yaml is a `NotIn` on this label, and `NotIn` with an ABSENT key
-          # MATCHES -- so if the label is on NO node, the policy excludes nothing, every node is an
-          # announcement candidate again, and the 2026-10-08 failure is fully re-armed. The alert
-          # above would not fire either: its join would match nothing and return no series. Present,
-          # evaluating, and incapable of firing -- the exact "inert critical alert" shape that
-          # VPNEgressUplinkLabelMissing exists for on the egress side, and that this repo has been
-          # burned by before.
-          #
-          # The label is applied by infra/ansible/roles/node_baseline
-          # (node_baseline_vpn_ingress_node); the most likely cause of it going absent is a node
-          # rebuild where that role has not been re-run.
-          expr: absent(kube_node_labels{label_homelab_keithjackson_dev_vpn_ingress="true"})
-          for: 30m
-          labels:
-            severity: warning
-          annotations:
-            summary: "No node carries the vpn-ingress label -- VPN VIP protection is OFF"
-            description: >-
-              No node publishes homelab.keithjackson.dev/vpn-ingress=true, so
-              l2-announcement-policy.yaml's `NotIn` exclusion matches every node and excludes none:
-              any node may now announce a LoadBalancer VIP, including the one terminating
-              remote-access WireGuard. `VpnIngressNodeAnnouncesL2VIP` is INERT while this fires, so
-              the warning matters more than its severity suggests. Re-run the node_baseline role on
-              the forwarded node, and confirm the label is in kube-state-metrics'
-              metricLabelsAllowlist.
-            runbook_url: "https://${BASE_DOMAIN}/runbooks/vpn-ingress-l2-collision"
-        # -----------------------------------------------------------------------------------------
        # (ADR-0015) The former `EgressGatewayUnhealthy` pod-readiness alert was REMOVED with the gluetun
        # retirement: there is no in-cluster egress-gateway pod anymore (the tunnel is a host systemd
        # service, steering is Cilium eBPF). Tunnel + gateway-node health is covered by `VPNTunnelDown`