From 12fa954a0591a46ea3b035109b469b0d91c0e908 Mon Sep 17 00:00:00 2001 From: Michal Date: Mon, 6 Jul 2026 21:06:24 +0100 Subject: [PATCH] k3s/cilium: install with cni.exclusive=false + bpf.vlanBypass={10} (Multus + VLAN-10 macvlan mDNS) Co-Authored-By: Claude Opus 4.8 (1M context) --- .../src/modules/modules/k3s/src/operations/cilium.ts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/bastion/src/modules/modules/k3s/src/operations/cilium.ts b/bastion/src/modules/modules/k3s/src/operations/cilium.ts index 6c319cb..7ac05ff 100644 --- a/bastion/src/modules/modules/k3s/src/operations/cilium.ts +++ b/bastion/src/modules/modules/k3s/src/operations/cilium.ts @@ -38,12 +38,20 @@ export const installCilium: Operation = async (ctx): Promise => // Install Cilium // - No hardcoded devices: Cilium auto-detects per node (heterogeneous NICs like eno1 vs enP7s7) // - k8sServiceHost/Port: k3s agents proxy the API on 127.0.0.1:6444 (not 6443) + // - cni.exclusive=false: required so Multus can install its CNI config alongside + // Cilium (Cilium otherwise deletes any non-Cilium CNI conf). + // - bpf.vlanBypass={10}: allow VLAN 10 (LoT) tagged traffic through the eBPF + // host VLAN filter, so pods on a macvlan/VLAN-10 interface receive multicast + // (Matter/mDNS ff02::fb + 224.0.0.251). Without this Cilium drops it + // ("VLAN traffic disallowed by VLAN filter", bpf_host.c). const installResult = await ctx.ssh.exec( `KUBECONFIG=/etc/rancher/k3s/k3s.yaml cilium install \ --set kubeProxyReplacement=true \ --set ipam.mode=kubernetes \ --set k8sServiceHost=127.0.0.1 \ - --set k8sServicePort=6444`, + --set k8sServicePort=6444 \ + --set cni.exclusive=false \ + --set bpf.vlanBypass="{10}"`, { timeoutMs: 300_000 }, ); if (installResult.exitCode !== 0) {