feat(cilium): stage homogeneous wildcard device selection for datapath activation#2697
Conversation
…h activation Stages a default-off homogeneous-devices component (devices: "en+ eth+") so the BPF masquerade program can attach to the public default-route NICs when ebpf-host-routing activates, and restructures the live private-NIC pin into an always-on private-nic-devices component — render-verified that a parent-patch value can never be overridden by a component, so the pin had to become a component for the staged flip to win (later component wins, also render-verified). Live nine-node inventory (talosctl, 2026-07-18) corrected the stale premise: static nodes (CPs AND workers) are enp1s0/enp7s0, autoscale nodes eth0/eth1 — the old pin covers private NICs only by union. Wildcards are upstream's documented answer for cross-node-inconsistent names and absorb future autoscaler naming drift. Default render is byte-identical (devices: enp7s0 eth1) — merging rolls no agents. Activation is a separate one-line flip following the component's runbook (first-node primary-address verification, rollback documented). Part of #2610. Part of #2029.
CI is green at @codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bb45a3a86b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…e rollout Codex round-1 P2: rollOutCiliumPods: true would auto-roll the fleet the moment the component is referenced, making the runbook's first-node verification unexecutable. The component now also sets the agent updateStrategy to OnDelete, so activation stages config without restarting any agent and the operator steps the roll pod-by-pod; removing the override after the fleet soak is a strategy-only change that rolls nothing, and a mid-activation rollback (re-comment) auto-rolls stepped nodes back under the restored RollingUpdate. Render-verified: OnDelete appears exactly once in the staged render and never in the default.
Round-1 P2 fixed at @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d762635079
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…n runbook Codex round-2 P2: OnDelete only gates template-driven replacement — an incidental pod restart or an autoscaler-added node boots the widened set immediately. The runbook now suspends autoscaler node creation for the window (the deployment is ksail-provisioned, so the scale-down holds), treats incidental restarts as involuntary canaries to verify at once, and corrects the rollback claim accordingly.
Round-2 P2 fixed at @codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Readiness record @
|
1 participant
Why
The staged bandwidth-manager and BPF-masquerade datapath work cannot activate on today's private-NIC device pin: pod egress leaves via the public NICs the pin excludes, and the pin's per-role premise went stale when the control planes were rebuilt (a fresh nine-node inventory shows the split is static-vs-autoscale now, with each node matching only one pinned name by luck of the union).
What
Stages a default-off wildcard device selection (
en+ eth+) that covers both NICs on every node — the upstream-documented mechanism for inconsistent cross-node names — and restructures the live pin into an always-on component so the staged flip can actually take effect (render-proven: a parent-patch value can never be overridden by a component). The default render is byte-identical, so merging rolls no Cilium agents; activation is a later one-line flip with a first-node verification runbook and documented rollback.Part of #2610. Part of #2029.