jakman85andClaude Opus 5.5 9a69f6906a fix(cilium): point cgroup.hostRoot at the host's real cgroup2 root ...

hostRoot was /run/cilium/cgroupv2 with autoMount disabled, but nothing
mounts cgroup2 there. The agent mounted one from inside its own private
cgroup namespace, so socket-LB attached to the agent's own cgroup and
host processes got no Service/LB translation. k3s-prod-1 (Gateway L2
lease holder + kube-vip VIP) therefore could not reach the Gateway VIP,
and its apiserver's OIDC authenticator has failed since 2026-09-12.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-03 18:07:18 -05:00

..

cilium

fix(cilium): point cgroup.hostRoot at the host's real cgroup2 root

2026-10-03 18:07:18 -05:00

cluster_verify

feat(ansible): parameterise target groups so prod reuses the roles unchanged (R-ENV-02)

2026-08-31 23:53:36 -05:00

etcd_io_priority

fix(ansible): the NVMe node would have died on an undefined variable

2026-09-07 02:46:26 -05:00

flux_bootstrap

feat(prod): temp Gitea source + wireless disabled + flux bootstrap path

2026-09-04 18:53:17 -05:00

k3s_server

feat(ha): the CNI dials the control-plane VIP — kube-vip becomes a CNI prerequisite

2026-09-06 22:17:30 -05:00

kube_vip

feat(ha): the CNI dials the control-plane VIP — kube-vip becomes a CNI prerequisite

2026-09-06 22:17:30 -05:00

memattr_survey

fix(node_health): "Failed to map" does NOT mean memory lost — plus survey results

2026-09-03 23:50:59 -05:00

node_baseline

fix(node-baseline): pin the OIDC issuer to the Gateway VIP on prod nodes

2026-10-03 17:39:37 -05:00

node_health

feat(node-health): probe the Intel render device, read-only

2026-09-30 13:04:43 -05:00

s3_backup_target

Replace MinIO backup target with versitygw (s3_backup_target role)

2026-08-28 22:48:38 -05:00

vpn_egress_gateway

fix(vpn): two gateways on one pinned PIA server evict each other every 2 minutes

2026-09-12 18:05:49 -05:00