From 50dedbaee2956efadecf7941f722dc72ec66c553 Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Sun, 12 Oct 2025 20:20:38 +0200 Subject: [PATCH] fix(cilium): explicitly assign appProtocol to gRPC services This fixes NetBird agents not connecting to the manager ./caller_not_available:0: 2025/10/12 18:16:42 WARNING: [core] [Channel #98 SubChannel #99]grpc: addrConn.createTransport failed to connect to { Addr: "netbird.stonegarden.dev:443", ServerName: "netbird.stonegarden.dev:443", BalancerAttributes: { "<%!p(pickfirstleaf.managedByPickfirstKeyType={})>": "<%!p(bool=true)>" } }. Err: connection error: desc = "transport: authentication handshake failed: credentials: cannot check peer: missing selected ALPN property. If you upgraded from a grpc-go version earlier than 1.67, your TLS connections may have stopped working due to ALPN enforcement. For more details, see: https://github.com/grpc/grpc-go/issues/434" Related to https://github.com/cilium/cilium/issues/39484 Signed-off-by: Vegard Hagen --- k8s/infra/network/cilium/values.yaml | 4 ++-- k8s/infra/vpn/netbird/management/svc.yaml | 1 + k8s/infra/vpn/netbird/signal/svc.yaml | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/k8s/infra/network/cilium/values.yaml b/k8s/infra/network/cilium/values.yaml index 8bc2e2c..196c69a 100644 --- a/k8s/infra/network/cilium/values.yaml +++ b/k8s/infra/network/cilium/values.yaml @@ -76,8 +76,8 @@ loadBalancer: gatewayAPI: enabled: true -# enableAlpn: true -# enableAppProtocol: true + enableAlpn: true + enableAppProtocol: true envoy: prometheus: diff --git a/k8s/infra/vpn/netbird/management/svc.yaml b/k8s/infra/vpn/netbird/management/svc.yaml index ae8b148..722b620 100644 --- a/k8s/infra/vpn/netbird/management/svc.yaml +++ b/k8s/infra/vpn/netbird/management/svc.yaml @@ -10,4 +10,5 @@ spec: ports: - name: http port: 80 + appProtocol: kubernetes.io/h2c targetPort: http diff --git a/k8s/infra/vpn/netbird/signal/svc.yaml b/k8s/infra/vpn/netbird/signal/svc.yaml index a834de2..207493f 100644 --- a/k8s/infra/vpn/netbird/signal/svc.yaml +++ b/k8s/infra/vpn/netbird/signal/svc.yaml @@ -10,4 +10,5 @@ spec: ports: - name: http port: 80 + appProtocol: kubernetes.io/h2c targetPort: http