Sean HoodMar 12

Dabbled with enabling #IPv6 on my #cilium based #k3s cluster this morning. Seems that it /is/ possible to enable without a full cluster/node rebuild*.

Mostly went fine, prefix, prefix mask, masq set to off. After poking a couple of the Cilium Pods new Pods got an IPv6 addr. ...but couldn't ping anything. Traffic made it out based on what Hubble was showing, but not the reverse.

Enabled v6 masquerading, and it all started to work, yay. Suspect I need to try setting up a static route on my router for this to work.

I have a couple pods w/ quirky networking so they got unhappy. v6 IP, dns query replying w/ AAAA but no dice as they really only have v4 connectivity.

Back off for now but promising that it could work.

*.spec.PodCIDR(s) are immutable on v1.Node resources, but cilium in it's default configuration doesn't get it's PodCIDR from there in the default config.

Daniel NeumannMar 9

Deep dive into enabling Cilium native routing on Azure Kubernetes Service with BYOCNI - a 3-part experiment:

Part 1: https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-1/

Part 2: https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-2/

Part 3: https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-3/

#Azure #AKS #Kubernetes #Cilium #Networking

An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI – Part 1 – Daniel's Tech Blog

Daniel NeumannMar 5
An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI – Part 3 https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-3/ #Azure #AKS #Kubernetes #Cilium
An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI – Part 3 – Daniel's Tech Blog

devopstalesMar 2

Cilium deprecated external workload? Deploy HAProxy Ingress in DMZ w/ BGP+BIRD. Pod CIDR export, firewalld hardening, AlmaLinux-ready. Secure & tested! 👇

https://devopstales.github.io/kubernetes/k8s-dmz-bgp-external-haproxy/

#Kubernetes #BGP #HAProxy #NetworkSecurity #DevOps #Cilium

Kubernetes DMZ Ingress with HAProxy and BGP: External Mode Without Cilium External Workload

Learn how to deploy HAProxy Ingress Controller on AlmaLinux in a DMZ network outside your Kubernetes cluster—without Cilium’s deprecated external workload mode. This guide covers BGP peering with BIRD, Cilium’s Pod CIDR export, firewalld configuration, and production-ready setup for secure ingress traffic isolation.

DevOpsTales
Daniel NeumannMar 1
An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI – Part 2 https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-2/ #Azure #AKS #Kubernetes #Cilium
An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI – Part 2 – Daniel's Tech Blog

Daniel NeumannMar 1
An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI – Part 1 https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-1/ #Azure #AKS #Kubernetes #Cilium
An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI – Part 1 – Daniel's Tech Blog

RachelFeb 22

One last oddity from my NetworkPolicy project over the last few days.....

I am getting the following in my hubble logs:

Feb 22 20:48:28.333: :: (ID:16777244) <> ff02::1:ff99:2a81 (ID:16777244) Unknown L3 target address DROPPED (ICMPv6 NeighborSolicitation) Feb 22 20:48:29.325: fe80::b85f:80ff:fed7:6193 (ID:2435) <> ff02::16 (ID:16777244) Invalid source ip DROPPED (ICMPv6 143(0)) Feb 22 20:48:29.325: fe80::b85f:80ff:fed7:6193 (ID:2435) <> ff02::2 (ID:16777244) Invalid source ip DROPPED (ICMPv6 RouterSolicitation) Feb 22 20:49:43.117: :: (ID:9705) <> ff02::16 (ID:16777244) Invalid source ip DROPPED (ICMPv6 143(0)) Feb 22 20:49:43.213: :: (ID:16777244) <> ff02::1:ffaf:3d08 (ID:16777244) Unknown L3 target address DROPPED (ICMPv6 NeighborSolicitation)
I haven't quite gotten to the bottom of this one, I found some cilium issues that look almost relevant, but didn't get me anywhere.

I feel like I must be missing something with my cilium config? ​​
#Homelab #Kubernetes #Cilium #IPv6

Show threadselfhosting.shFeb 20

@rachel The Hubble-generated dashboards (from cilium/hubble) tend to work better than third-party ones. The official Grafana integration at grafana.com/grafana/dashboards/16611 is solid for flow visibility.

For DNS-specific monitoring, dashboard 16612 covers Hubble DNS metrics well.

Avoid anything built for pre-1.14 Cilium — the metric names changed significantly.

#kubernetes #cilium #grafana #monitoring

Show threadStefan 'stelb' Le Breton 🇪🇺🇺🇦💚Feb 15

Well... I have setup my demo lab on cheap mini pc and mikrotik router without much preparation in maybe 2 hours.

now tune the scripts, maybe throw in terraform/tofu instead of semi-manual vm creation (talos is installed automatically via PXE)

#talos #kubernetes #k8s #cilium #pxe #proxmox #nerd

Stefan 'stelb' Le Breton 🇪🇺🇺🇦💚Feb 13
Finally resurrected my talos homelab cluster. Did not get much attention after my vacation last summer.
Moved the rack, no clean shutdown, different network, everything broken.. 🙈
Next: upgrades and fix headscale setup.
#talos #k8s #kubernetes #cilium #nerd #homelab