Skip to content

fix(hubble): separate relay replicas in production #5577

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 5 commits into from
Oct 29, 2026
Merged

fix(hubble): separate relay replicas in production #5577

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
70171b9
fix(hubble): separate relay replicas in production
devantler Oct 29, 2026
9214e41
fix(hubble): retain distinct domains as capacity shrinks
devantler Oct 29, 2026
2b8f1b1
Merge remote-tracking branch 'origin/main' into codex/hubble-relay-pl…
devantler Oct 29, 2026
6439756
fix(hubble): approve the reviewed relay placement surface
devantler Oct 29, 2026
8b0a114
chore(cilium): integrate reviewed platform main
devantler Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions ...roviders/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
---
# The base's soft spread permits both replicas on one node. Production has
# multiple eligible nodes and needs separate failure domains (#5576).
# Keep this in the provider overlay so a one-node local cluster still works.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cilium
namespace: kube-system
spec:
values:
hubble:
relay:
topologySpreadConstraints:
- maxSkew: 1
# A single remaining node must not become two replicas' failure domain.
minDomains: 2
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
k8s-app: hubble-relay
2 changes: 2 additions & 0 deletions k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,8 @@ patches:
- path: kyverno/patches/enable-user-namespaces.yaml
# Prod-only fail-closed WireGuard encryption (egress strict mode) — see file.
- path: cilium/patches/enforce-wireguard-strict-mode.yaml
# Require relay replicas to use separate nodes in prod; local retains soft spread.
- path: cilium/patches/require-relay-node-spread.yaml
# Dormant prod-only SPIRE storage values. Authentication/SPIRE stay disabled
# until a narrow policy consumer lands; if re-enabled, keep the datastore off
# Longhorn to avoid the SPIRE <-> Longhorn <-> mTLS cycle — see file.
Expand Down
2 changes: 1 addition & 1 deletion scripts/validate-eks-ci-role-policy/approved-surface.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ helm.toolkit.fluxcd.io/v2|HelmRelease|kro-system|kro cd7531d09eab1fa5898b2069fef

helm.toolkit.fluxcd.io/v2|HelmRelease|ksail-operator|ksail-operator dfc2fd679b30a0acf35fcddc41eb883980c345036c95b3ebc5a9d21e0354bfa9

helm.toolkit.fluxcd.io/v2|HelmRelease|kube-system|cilium 6d236fa5fb605763ece34cb062940f58e636f3a2c593047ad1ab0d6a489e7df5
helm.toolkit.fluxcd.io/v2|HelmRelease|kube-system|cilium 583656039a7b6f65fab253ef1ce6ea63ffffd4437e404d5d42996208143a3c7a

helm.toolkit.fluxcd.io/v2|HelmRelease|kube-system|descheduler 40d41e62d48b7db3706d544a94b25a75e497d7f11ca6efec1376774c8085de13

Expand Down
Loading