#69 - docs(vpn-ingress): withdraw the L2-lease diagnosis — it was falsified by measurement - home-network-k3s-impl

Conversation 1 Commits 1 Files Changed 3

+356

1 Commits

Author	SHA1	Message	Date
jakman85andClaude Opus 5	b258e47aa6	docs(vpn-ingress): withdraw the L2-lease diagnosis — it was falsified by measurement gate / gate (pull_request) Successful in 1m55s Details gate / conformance (pull_request) Has been skipped Details The claim this branch originally shipped (a node cannot reach a LoadBalancer VIP whose Cilium L2 announcement lease it holds, so VPN clients inherit that via hostNetwork MASQUERADE) is FALSE. Re-measured with all 8 l2announce leases on k3s-prod-1: ip neigh show 192.168.2.20 -> INCOMPLETE (cause present) nc -z 192.168.2.20 443 -> OK curl --resolve ... :192.168.2.20 -> 200 in 25ms (effect absent) Cause present, effect absent. prod-2 and prod-3 return the same 200. Why it was never going to bite: cilium-dbg status shows `KubeProxyReplacement: True [eno1 ..., wg0 10.90.0.1]` and `Masquerading: BPF [eno1, wg0]` -- Cilium's LB datapath is attached to wg0, so a client packet for a VIP is DNAT'd in BPF BEFORE any neighbour lookup, and the Gateway backend is a node-local Envoy socket anyway. The methodological error, which is the part worth keeping: every probe was run from the wireguard pod on the grounds that sharing the host netns made it "the path a MASQUERADEd client takes". False. A MASQUERADEd client is FORWARDED (netfilter FORWARD + routing); a probe started in the pod is SOCKET-ORIGINATED (Cilium socket-LB). Different hooks -- sharing a namespace is not sharing a hook. The `curl --interface wg0` control cited to rule out a host-netns artefact fails on ALL THREE nodes including ones whose ARP resolves, so it discriminated nothing. A raw-IP `curl -k https://192.168.2.20/` returning rc=35 is missing SNI, not unreachability. Also corrected: new-peer.sh emits AllowedIPs = 0.0.0.0/0 (FULL tunnel) by default; `--split` is the opt-in. An earlier reading had the branches backwards. All code is withdrawn -- the nodeSelector exclusion, the node_baseline label tasks, both alerts, the promtool tests and the KSM allowlist entry are gone. Net change is three documentation files, purely additive (356 insertions, 0 deletions), recording what was measured so the next person does not redo it. The reported internet-routing problem is NOT diagnosed here: no client had connected since the power-cycle (no peer endpoint, 0 packets through FORWARD and MASQUERADE), so the forwarded path was unmeasurable. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>	2026-10-18 03:14:28 -05:00

Author

SHA1

Message

Date

jakman85andClaude Opus 5

b258e47aa6

docs(vpn-ingress): withdraw the L2-lease diagnosis — it was falsified by measurement

gate / gate (pull_request) Successful in 1m55s

Details

gate / conformance (pull_request) Has been skipped

Details

The claim this branch originally shipped (a node cannot reach a LoadBalancer VIP
whose Cilium L2 announcement lease it holds, so VPN clients inherit that via
hostNetwork MASQUERADE) is FALSE. Re-measured with all 8 l2announce leases on
k3s-prod-1:

  ip neigh show 192.168.2.20   -> INCOMPLETE   (cause present)
  nc -z 192.168.2.20 443       -> OK
  curl --resolve ... :192.168.2.20  -> 200 in 25ms   (effect absent)

Cause present, effect absent. prod-2 and prod-3 return the same 200.

Why it was never going to bite: cilium-dbg status shows
`KubeProxyReplacement: True [eno1 ..., wg0 10.90.0.1]` and
`Masquerading: BPF [eno1, wg0]` -- Cilium's LB datapath is attached to wg0, so a
client packet for a VIP is DNAT'd in BPF BEFORE any neighbour lookup, and the
Gateway backend is a node-local Envoy socket anyway.

The methodological error, which is the part worth keeping: every probe was run
from the wireguard pod on the grounds that sharing the host netns made it "the
path a MASQUERADEd client takes". False. A MASQUERADEd client is FORWARDED
(netfilter FORWARD + routing); a probe started in the pod is SOCKET-ORIGINATED
(Cilium socket-LB). Different hooks -- sharing a namespace is not sharing a hook.
The `curl --interface wg0` control cited to rule out a host-netns artefact fails
on ALL THREE nodes including ones whose ARP resolves, so it discriminated
nothing. A raw-IP `curl -k https://192.168.2.20/` returning rc=35 is missing SNI,
not unreachability.

Also corrected: new-peer.sh emits AllowedIPs = 0.0.0.0/0 (FULL tunnel) by
default; `--split` is the opt-in. An earlier reading had the branches backwards.

All code is withdrawn -- the nodeSelector exclusion, the node_baseline label
tasks, both alerts, the promtool tests and the KSM allowlist entry are gone.
Net change is three documentation files, purely additive (356 insertions, 0
deletions), recording what was measured so the next person does not redo it.

The reported internet-routing problem is NOT diagnosed here: no client had
connected since the power-cycle (no peer endpoint, 0 packets through FORWARD and
MASQUERADE), so the forwarded path was unmeasurable.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

2026-10-18 03:14:28 -05:00

docs(vpn-ingress): withdraw the L2-lease diagnosis — it was falsified by measurement #69