From 70171b9319e36aae0a4b7043c024a4bf5db60b5a Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 29 Oct 2026 13:03:05 +0100 Subject: [PATCH 1/3] fix(hubble): separate relay replicas in production Part of #5576 --- .../patches/require-relay-node-spread.yaml | 20 +++++++++++++++++++ .../controllers/kustomization.yaml | 2 ++ 2 files changed, 22 insertions(+) create mode 100644 k8s/providers/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml diff --git a/k8s/providers/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml b/k8s/providers/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml new file mode 100644 index 0000000000..5b6c8f359a --- /dev/null +++ b/k8s/providers/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml @@ -0,0 +1,20 @@ +--- +# The base's soft spread permits both replicas on one node. Production has +# multiple eligible nodes and needs separate failure domains (#5576). +# Keep this in the provider overlay so a one-node local cluster still works. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cilium + namespace: kube-system +spec: + values: + hubble: + relay: + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + k8s-app: hubble-relay diff --git a/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml index 536378384e..f1899b3474 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml @@ -139,6 +139,8 @@ patches: - path: kyverno/patches/enable-user-namespaces.yaml # Prod-only fail-closed WireGuard encryption (egress strict mode) — see file. - path: cilium/patches/enforce-wireguard-strict-mode.yaml + # Require relay replicas to use separate nodes in prod; local retains soft spread. + - path: cilium/patches/require-relay-node-spread.yaml # Dormant prod-only SPIRE storage values. Authentication/SPIRE stay disabled # until a narrow policy consumer lands; if re-enabled, keep the datastore off # Longhorn to avoid the SPIRE <-> Longhorn <-> mTLS cycle — see file. From 9214e41e3b41979dc7bfb20c9639a1ff7acecf1c Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 29 Oct 2026 13:05:05 +0100 Subject: [PATCH 2/3] fix(hubble): retain distinct domains as capacity shrinks Part of #5576 --- .../controllers/cilium/patches/require-relay-node-spread.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/k8s/providers/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml b/k8s/providers/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml index 5b6c8f359a..2c4ff8a80a 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml @@ -13,6 +13,8 @@ spec: relay: topologySpreadConstraints: - maxSkew: 1 + # A single remaining node must not become two replicas' failure domain. + minDomains: 2 topologyKey: kubernetes.io/hostname whenUnsatisfiable: DoNotSchedule labelSelector: From 6439756d3a133ff65da3bddd3753fbd816e577c0 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 29 Oct 2026 14:26:01 +0100 Subject: [PATCH 3/3] fix(hubble): approve the reviewed relay placement surface Part of #5576 --- scripts/validate-eks-ci-role-policy/approved-surface.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/validate-eks-ci-role-policy/approved-surface.txt b/scripts/validate-eks-ci-role-policy/approved-surface.txt index 2e422cf0b2..9968925216 100644 --- a/scripts/validate-eks-ci-role-policy/approved-surface.txt +++ b/scripts/validate-eks-ci-role-policy/approved-surface.txt @@ -52,7 +52,7 @@ helm.toolkit.fluxcd.io/v2|HelmRelease|kro-system|kro cd7531d09eab1fa5898b2069fef helm.toolkit.fluxcd.io/v2|HelmRelease|ksail-operator|ksail-operator dfc2fd679b30a0acf35fcddc41eb883980c345036c95b3ebc5a9d21e0354bfa9 -helm.toolkit.fluxcd.io/v2|HelmRelease|kube-system|cilium 6d236fa5fb605763ece34cb062940f58e636f3a2c593047ad1ab0d6a489e7df5 +helm.toolkit.fluxcd.io/v2|HelmRelease|kube-system|cilium 583656039a7b6f65fab253ef1ce6ea63ffffd4437e404d5d42996208143a3c7a helm.toolkit.fluxcd.io/v2|HelmRelease|kube-system|descheduler 40d41e62d48b7db3706d544a94b25a75e497d7f11ca6efec1376774c8085de13