Repository navigation
feat(cilium): stage eBPF host-routing prerequisites for pod BBR - #2680
Conversation
…d BBR Default-off Hetzner component (bpf.masquerade + explicit bpf.hostLegacyRouting: false) staging the smallest pod-BBR prerequisite set per #2609. Unreferenced by default: both provider controllers renders proven byte-identical to main; a temporary opt-in render proves the complete prerequisite set composes with bandwidth-manager-bbr while its bbrHostNamespaceOnly guard stays true. Compatibility with tunnel WireGuard/strict mode/KPR documented in the component; activation and rollback remain separate low-traffic changes. No netkit. Fixes #2609. Part of #2029. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3c52ca92ff
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ctivation blocker (codex P1) With devices pinned to the private NICs, BPF masquerading would never attach to the public default-route NICs while iptables masquerade is disabled — external egress would break cluster-wide on activation. The component and its opt-in reference now name #2610's extended device selection as a hard precondition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@codex review |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
User-evaluation + self-promotion readiness record (head |
|
🎉 This PR is included in version 1.119.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Why
Pod-scope BBR (the point of the staged bandwidth-manager component) requires eBPF host routing, which today's datapath deliberately lacks — activating BBR without it would roll every Cilium agent for no benefit. This stages the missing prerequisite safely, without touching production.
What
Adds a second default-off Cilium staging component (BPF masquerade + eBPF host routing) next to the bandwidth-manager one, wired as a commented opt-in. Production and local renders are proven unchanged; a temporary opt-in render proves the complete pod-BBR prerequisite set composes. Activation stays a separate, reversible low-traffic change after its own live soak.
Fixes #2609. Part of #2029.