52b87afa9e
1.16.x gateway-api hostNetwork mode is buggy on Sovereigns: cilium-envoy
NACKs listeners with "cannot bind '0.0.0.0:80': Permission denied" and
the loaded RDS for the Sovereign vhost only carries the default `/` route
to catalyst-ui — `/auth/*` and `/api/*` HTTPRoute matches defined in CEC
never reach envoy's live config. Result: console.<sov>/auth/handover?token=…
serves the React shell instead of the catalyst-api Go handler, defeating
the Phase-8b seamless handover. Caught live on otech46.
1.18+ ships the Gateway API implementation graduated from beta with the
hostNetwork bind path fixed; 1.19 is the current stable line (1.19.3).
Values shape verified backward-compatible across the keys we set:
gatewayAPI.hostNetwork.enabled, envoy.enabled, envoyConfig.enabled,
encryption.type=wireguard, encryption.nodeEncryption — all unchanged
between 1.16 and 1.19.
Bumps:
- bp-cilium chart 1.1.5 → 1.2.0 (minor — major upstream version jump)
- upstream cilium subchart 1.16.5 → 1.19.3
- blueprint.yaml spec.version 1.1.3 → 1.2.0 (was already drifted from
Chart.yaml; brings them back in sync per manifest-validation gate)
- clusters/_template/bootstrap-kit/01-cilium.yaml HelmRelease pin
1.1.5 → 1.2.0
Per-cluster overlays under clusters/<sovereign>/bootstrap-kit/ keep
their pinned versions until the operator opts in — fresh otechN
provisions render from _template/ and pick up 1.2.0 on first boot.
Will be verified live on the next fresh Sovereign provision (otech47+).
Co-authored-by: hatiyildiz <hatice@openova.io>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
40 lines
1.2 KiB
YAML
40 lines
1.2 KiB
YAML
apiVersion: catalyst.openova.io/v1alpha1
|
|
kind: Blueprint
|
|
metadata:
|
|
name: bp-cilium
|
|
labels:
|
|
catalyst.openova.io/category: per-host-cluster-infrastructure
|
|
catalyst.openova.io/section: pts-3-1-networking-and-service-mesh
|
|
spec:
|
|
version: 1.2.0
|
|
card:
|
|
title: Cilium
|
|
summary: Unified CNI + Service Mesh (eBPF). mTLS via WireGuard, Hubble observability, Gateway API.
|
|
icon: cilium.svg
|
|
category: infrastructure
|
|
visibility: unlisted # mandatory infra, auto-installed by bootstrap kit
|
|
configSchema:
|
|
type: object
|
|
properties:
|
|
kubeProxyReplacement:
|
|
type: boolean
|
|
default: true
|
|
hubbleUI:
|
|
type: boolean
|
|
default: true
|
|
gatewayAPI:
|
|
type: boolean
|
|
default: true
|
|
l2announcements:
|
|
type: boolean
|
|
default: false
|
|
description: Enable for bare-metal Sovereigns. Cloud Sovereigns use Hetzner LB / AWS NLB.
|
|
placementSchema:
|
|
modes: [single-region, active-active]
|
|
default: active-active # Cilium runs on every host cluster
|
|
manifests:
|
|
chart: ./chart
|
|
depends: [] # foundational — no dependencies
|
|
upgrades:
|
|
from: ["0.x"]
|