Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(cilium): point cgroup.hostRoot at the host cgroup2 root (socket-LB never covered host processes) #42

Merged
jakman85 merged 1 commits from fix/cilium-cgroup-hostroot into main 2026-10-04 07:10:31 +00:00
Conversation 0 Commits 1 Files Changed 4
+109 -9
1 Commits
Author SHA1 Message Date
jakman85andClaude Opus 5.5 9a69f6906a fix(cilium): point cgroup.hostRoot at the host's real cgroup2 root
gate / gate (pull_request) Successful in 1m47s
Details
gate / conformance (pull_request) Has been skipped
Details 
hostRoot was /run/cilium/cgroupv2 with autoMount disabled, but nothing
mounts cgroup2 there. The agent mounted one from inside its own private
cgroup namespace, so socket-LB attached to the agent's own cgroup and
host processes got no Service/LB translation. k3s-prod-1 (Gateway L2
lease holder + kube-vip VIP) therefore could not reach the Gateway VIP,
and its apiserver's OIDC authenticator has failed since 2026-09-12.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-10-03 18:07:18 -05:00