fix: [alert] NetbirdRelayMemberDown (monitoring) (#603 )

2026-08-26 05:48:17 +00:00
1 changed files with 35 additions and 0 deletions
@@ -409,3 +409,38 @@ The retired Crucial leaves a stale entry in `ceph device ls`. Remove it with
  `cilium_drop_count_total{reason=~"VLAN.*"}` per node rather than by reading
  the CNI logs, and check `node_network_receive_packets_total{device="ens19"}`
  — it reads 0 on an affected node.
+
+- The conversion drops the node's global IPv6 on `mgmt0`, and nothing in the
+  config says so. **This happened** (issue #603). Pods get only a ULA
+  (`fd10:244::/48`) and reach global IPv6 by being masqueraded to the node's
+  global address, so a node without one silently loses outbound IPv6 for every
+  pod scheduled onto it. The only in-cluster symptom is one line at Cilium
+  agent startup — `k8s-1` and `k8s-2` log it, `k8s-3` does not:
+
+  ```
+  level=warn msg="IPv6 is enabled, but Cilium cannot find the IPv6 address
+  for this node" module=agent.controlplane.local-node-sync
+  ```
+
+  It surfaced as `NetbirdRelayMemberDown` plus both v6 `blackbox-edge-wan`
+  probes going red the moment the blackbox exporter was rescheduled onto a
+  converted node. The relays themselves were healthy throughout.
+
+  Settle where the address comes from before converting the last VM. It
+  decides the fix and is not visible through kubectl — nodes publish only a
+  v4 `InternalIP`:
+
+  ```sh
+  talosctl -n <unconverted> get addresses    # while a VM is still up
+  talosctl -n <converted>   get addresses
+  ```
+
+  DHCPv6 means the converted nodes need a `DHCPv6Config` document for `mgmt0`
+  beside `DHCPv4Config`; SLAAC means they need RA acceptance instead and
+  `DHCPv6Config` alone would not help. Legacy `dhcp: true` requests DHCPv4
+  only, so SLAAC is the likelier source. Validate either with
+  `talosctl apply-config --mode=try`, per section 6.
+
+  Converting the last VM before this is settled leaves no IPv6 path at all:
+  `proxy-1` is the v6-only edge/relay member and goes from unmonitorable to
+  genuinely unreachable.