3 Commits

Author	SHA1	Message	Date
Donavan Fritz	677aec2a42	bird: leading-edge reload + 500ms cooldown (was trailing 500ms debounce) ... A single Ready/NotReady transition no longer pays a 500ms reload wait — the first call to scheduleReload fires birdc immediately; further calls within 500ms are coalesced into one tail reload at the cooldown's end. Burst behavior is the same as before: under heavy churn (deploy rolling all replicas at once), at most one reload per 500ms. Steady-state latency from pod Ready transition to crt001 BGP withdraw: - probe period (set in pod spec, 1s minimum) - ~ms informer + reconcile + birdc + BGP UPDATE The 500ms hardcoded delay is gone. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>	2026-04-25 08:26:34 -05:00
Donavan Fritz	3f6dfd3e88	bird: add source address + next hop self (v6 anycast fix) ... Cisco IOS rejects IPv6 BGP advertisements whose next-hop is link-local- only. BIRD2 was synthesising a link-local next-hop for kernel-learned routes whose dev had no via gateway (our anycast /128s). Symptom: v4 anycast worked (Cisco doesn't have the same constraint for /32s), v6 anycast didn't make it past crt001. - pkg/routing/bird/config.go: NodeBGP.LocalV6/LocalV4. Template now emits `local <addr> as <asn>` and `next hop self;` in the BGP channel for both families, mirroring Calico's `source address` + `next hop self` pattern. - pkg/agent/bird.go: localAddrSameSubnet picks an interface address on the peer's /64 or /24 to use as source. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>	2026-04-25 07:45:51 -05:00
Donavan Fritz	eb1f5e0d8d	M2: netlink, IPAM/handler wiring, BIRD sidecar, CNI installer ... Code (Linux build, with no-op stubs for macOS dev): - pkg/agent/netns_linux.go: ensureVeth → host-side configure (addrgenmode none, fe80::1/64, proxy_arp, forwarding) → move peer to pod ns → configure pod side (addr, default route via fe80::1, v4 169.254.1.1 on-link gateway) → host /128 + /32 routes. Idempotent. - pkg/agent/hostiface.go: deterministic host iface name flock<8hex> from FNV-1a-32(containerID). - pkg/agent/annotations.go: parse flock.fritzlab.net/{ipv6,ipv4,cidr6, cidr4,ip-algo,anycast} with design-doc defaults; ParseCNIArgs for the K8S_POD_* keys kubelet sets. - pkg/agent/podinfo.go: shared informer scoped to spec.nodeName==NODE, WaitForPod helper for ADD-vs-informer-sync race. - pkg/agent/handlers.go: PodHandler does cache lookup → annotations → IPAM → store(pending) → SetupFunc → store(committed) → Result. Idempotent on retry. Del symmetric. - pkg/routing/bird/config.go: text/template render with stable ordering; golden tests for host001 + anycast injection + sort stability. - pkg/agent/bird.go: writes /etc/flock/bird/bird.conf, debounces 500ms, execs `birdc -s /run/flock/bird.ctl configure`. Installs blackhole kernel routes for the node summary CIDRs so BIRD's protocol kernel imports them. - pkg/agent/runtime_linux.go: at startup, waits up to 60s for the per- node NodeConfig, reconciles committed allocations into IPAM.used, garbage-collects pending entries, builds PodHandler, swaps RPC handlers in. - cmd/flock-installer: init-container binary that copies /opt/cni/bin/ flock and writes 01-flock.conflist (lex-first so kubelet picks it over Calico's 10-calico.conflist on flock-labeled nodes). Deploy: - Dockerfile: alpine + iproute2 + bird2; multi-binary image. - deploy/daemonset.yaml: install-cni init container; bird sidecar sharing /etc/flock/bird + /run/flock with the agent; ConfigMap-seeded bootstrap bird.conf so the sidecar boots before the agent renders. Privileged on flock-agent + install-cni; bird sidecar uses NET_ADMIN/RAW only. - RBAC: pods + networkpolicies get/list/watch (the latter is reserved for M8 — harmless to grant now). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>	2026-04-24 22:33:48 -05:00