Commit Graph
18 Commits
Author SHA1 Message Date
Vegard Hagen 6f93a2c9d4 wip(netbird): fix config
Signed-off-by: Vegard Hagen <[email protected]>
2025-11-16 19:00:02 +01:00
Vegard Hagen 3b812ed476 fix(cilium): turn on l2-announcements (ARP) again to troubleshoot connection problems
I'm experiencing issues reaching services directly exposed to the internet

At first only some carriers didn't load the pages, but it appears to be getting worse somehow

Signed-off-by: Vegard Hagen <[email protected]>
2025-11-16 19:00:02 +01:00
Vegard Hagen 329981ea1a fix(cilium): disable bpf.hostLegacyRouting
It's no longer a requirement for Talos

Enable bpf.masquerade
https://docs.cilium.io/en/stable/operations/performance/tuning/#ebpf-host-routing

Signed-off-by: Vegard Hagen <[email protected]>
2025-11-16 19:00:02 +01:00
Vegard Hagen ee41262cc2 feat(bgp): enable bgp in cilium and disable l2 announcements
Change IP of all LB Services to a different subnet

Use externalTrafficPolicy on some LB Services

Signed-off-by: Vegard Hagen <[email protected]>
2025-11-16 18:59:51 +01:00
Vegard Hagen 5c14ae1682 fix(argocd): use http-route and grpc-route instead of a single tls-route
Also stop serving certificate from Argo CD

This fixes issues with GatewayAPI/Cilium/ALPN not playing together

Signed-off-by: Vegard Hagen <[email protected]>
2025-10-27 09:32:37 +01:00
Vegard Hagen 50dedbaee2 fix(cilium): explicitly assign appProtocol to gRPC services
This fixes NetBird agents not connecting to the manager

./caller_not_available:0:
    2025/10/12 18:16:42 WARNING: [core] [Channel #98 SubChannel #99]grpc:
    addrConn.createTransport failed to connect to
        {
            Addr: "netbird.stonegarden.dev:443",
            ServerName: "netbird.stonegarden.dev:443",
            BalancerAttributes: {
                "<%!p(pickfirstleaf.managedByPickfirstKeyType={})>": "<%!p(bool=true)>"
            }
        }.
    Err: connection error:
        desc = "transport: authentication handshake failed:
            credentials: cannot check peer: missing selected ALPN property.
            If you upgraded from a grpc-go version earlier than 1.67,
            your TLS connections may have stopped working due to ALPN enforcement.
            For more details, see: https://github.com/grpc/grpc-go/issues/434"

Related to https://github.com/cilium/cilium/issues/39484

Signed-off-by: Vegard Hagen <[email protected]>
2025-10-25 15:17:56 +02:00
Vegard Hagen 7a7b53c56c chore(cilium): remove deprecated option in values
Signed-off-by: Vegard Hagen <[email protected]>
2025-08-05 21:05:34 +02:00
Vegard Hagen 3452ba1cb2 feat(grafana): install grafana using grafana-operator
Decommission kube-prometheus-stack installed Grafana and use
grafana-operator instead.

Signed-off-by: Vegard Hagen <[email protected]>
2025-08-05 21:05:28 +02:00
Vegard Hagen 559b4c3d24 feat(cilium): add grafana dashboards
Signed-off-by: Vegard Hagen <[email protected]>
2025-07-25 22:29:24 +02:00
Vegard Hagen c1b1719e8c fix(cilium): disable alpn
I have a hunch that this somehow interferes with Argo CD.

The Argo CD login page shows up in Safari 18.5, Brave 1.80.120 and
Firefox 140.0.4.
After logging in using Authelia (OIDC), Argo CD starts to display 404
error in Brave and Firefox, but it works in Safari.
Clearing site data makes the login page show up in Brave and Firefox
again.

Signed-off-by: Vegard Hagen <[email protected]>
2025-07-21 10:27:13 +02:00
Vegard Hagen a788e2e12c feat(argocd): enable argocd cli
Also change Argo CD to use a proper certificate

Signed-off-by: Vegard Hagen <[email protected]>
2025-07-20 13:18:31 +02:00
Vegard Stenhjem HagenandGitHub 1deb5aced1 feat(devcontainer): build a Devcontainer with useful tools for this project
Also use said devcontainer i GitHub workflows to validate config.

* feat(devcontainer): build devcontainer

Signed-off-by: Vegard Hagen <[email protected]>

* feat(ci): validate tofu files on push

Signed-off-by: Vegard Hagen <[email protected]>

* feat(devcontainer): simplify devcontainer

Signed-off-by: Vegard Hagen <[email protected]>

* fix(devcontainer): don't cache package index

This will reduce the final image size.

Signed-off-by: Vegard Hagen <[email protected]>

* feat(devcontainer): switch to ubuntu and use devcontainer features as much as possible

Signed-off-by: Vegard Hagen <[email protected]>

---------

Signed-off-by: Vegard Hagen <[email protected]>
2025-07-13 23:18:26 +02:00
Vegard Hagen 063b5da94f fix(cilium): use legacy host routing
requirement for running on talos
2025-02-08 22:10:10 +01:00
Vegard Hagen c524a6ab65 feat(cilium): enable maglev loadBalancer
Maglev Consistent Hashing should improve resiliency in case of failures https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/\#maglev-consistent-hashing
2024-11-17 17:03:32 +01:00
Vegard Hagen d79f57efd3 chore(ingress): remove all ingress resources in favour of http-routes 2024-11-17 17:03:29 +01:00
Vegard Hagen 5abde08753 fix: conflicting svc name 2024-11-17 17:03:28 +01:00
Vegard Hagen 8668f58a38 chore(gateway): update to Gateway API 1.1.0 2024-11-17 17:03:28 +01:00
Vegard Hagen 207b1892bf feat: cleanup of remodelling
move remodel folder down to root and delete old unused manifests
2024-07-21 23:21:12 +02:00