claude-bot
56d55b6228
First step of moving the world-to-pod class onto ingress0 (#576). This changes nothing about where the cluster peers from — it only widens what the UDM will accept. The order matters. Cilium's sessions are outbound to the UDM, and the UDM accepts them through `bgp listen range`. Moving the cluster to ingress0 before the UDM listens on 10.2.47.0/24 would drop every session, and with them every advertised LoadBalancer VIP, so external ingress would go down until the UDM caught up. Listing both segments first removes that window entirely: a listen range only accepts a session, it never opens one, so the 47 ranges sit idle until the cluster actually moves. The prefix-lists and route-maps are untouched. They filter which prefixes the UDM accepts — pod CIDRs and the LB pool — and the cluster advertises the same prefixes either way. Only the next hop changes. Uploaded by hand at UniFi UI -> Settings -> Routing -> BGP, as before. Verify with `vtysh -c "show ip bgp summary"`: the six existing sessions on 10.2.40.x and fd40:: must still be established afterwards, and no new ones appear until the cluster side moves. The 40 ranges come out in a later change, once every session is established on 47. Refs #576
73 lines
2.7 KiB
Plaintext
73 lines
2.7 KiB
Plaintext
! UDM FRR BGP config — peers with the k8s cluster (ASN 64513) over the
|
|
! management LAN, dual-stack: v6 sessions on fd40::/64 carry the IPv6
|
|
! Unicast SAFI, v4 sessions on 10.2.40.0/24 carry the IPv4 Unicast SAFI.
|
|
! Cluster side: kubernetes/infrastructure/post-crds/cilium-bgp.yaml.
|
|
!
|
|
! Upload procedure: UniFi UI → Settings → Routing → BGP → upload as
|
|
! `bgp.conf` (do NOT name it `frr.conf` — some versions reject that name).
|
|
! Verify with `vtysh -c "show ip bgp summary"` on the UDM CLI.
|
|
!
|
|
frr defaults traditional
|
|
hostname udm
|
|
log syslog informational
|
|
!
|
|
router bgp 64512
|
|
bgp router-id 10.2.40.1
|
|
bgp ebgp-requires-policy
|
|
bgp bestpath as-path multipath-relax
|
|
maximum-paths 4
|
|
!
|
|
neighbor K8S peer-group
|
|
neighbor K8S remote-as 64513
|
|
neighbor K8S timers 30 90
|
|
neighbor K8S timers connect 10
|
|
neighbor K8S advertisement-interval 1
|
|
neighbor K8S maximum-prefix 200
|
|
!
|
|
! Two parallel sessions per node, one per family. Cilium 1.19 doesn't
|
|
! advertise extended-nexthop for the IPv6 Unicast SAFI when v6 routes
|
|
! are carried over a v4 transport, so we run a native v6 session that
|
|
! carries v6 routes with v6 next-hops and skip the capability dance
|
|
! entirely. Dynamic neighbors — nodes are SLAAC-addressed, so the listen
|
|
! ranges cover the SLAAC suffix space rather than naming each peer.
|
|
!
|
|
! Both segments are listed while the ingress split lands (#576). The
|
|
! cluster peers from mgmt (40) today and moves to ingress (47), and a
|
|
! listen range only accepts a session, it does not open one — so having
|
|
! both costs nothing and means the move never has a window where the UDM
|
|
! is not listening where the nodes are calling from. Drop the 40 ranges
|
|
! once every session is established on 47.
|
|
bgp listen range 10.2.40.0/24 peer-group K8S
|
|
bgp listen range fd40::/64 peer-group K8S
|
|
bgp listen range 10.2.47.0/24 peer-group K8S
|
|
bgp listen range fd02:47::/64 peer-group K8S
|
|
!
|
|
address-family ipv4 unicast
|
|
neighbor K8S activate
|
|
neighbor K8S route-map K8S-IN in
|
|
neighbor K8S soft-reconfiguration inbound
|
|
exit-address-family
|
|
!
|
|
address-family ipv6 unicast
|
|
neighbor K8S activate
|
|
neighbor K8S route-map K8S-IN-V6 in
|
|
neighbor K8S soft-reconfiguration inbound
|
|
exit-address-family
|
|
!
|
|
! Prefix-lists MUST appear after the router bgp block — FRR on the UDM
|
|
! silently ignores them if they're declared earlier in the file.
|
|
ip prefix-list K8S-ALLOWED-V4 seq 10 permit 10.244.0.0/16 le 24
|
|
ip prefix-list K8S-ALLOWED-V4 seq 20 permit 10.2.99.0/24 le 32
|
|
!
|
|
ipv6 prefix-list K8S-ALLOWED-V6 seq 10 permit fd10:244::/56 le 64
|
|
ipv6 prefix-list K8S-ALLOWED-V6 seq 20 permit fd99::/64 le 128
|
|
!
|
|
route-map K8S-IN permit 10
|
|
match ip address prefix-list K8S-ALLOWED-V4
|
|
!
|
|
route-map K8S-IN-V6 permit 10
|
|
match ipv6 address prefix-list K8S-ALLOWED-V6
|
|
!
|
|
line vty
|
|
!
|