revert go.mod — keep only Dockerfile bump

go 1.27 in go.mod triggers GOTOOLCHAIN download in CI runners (currently on 1.26.5).
Scope this PR to the Dockerfile rebuild only; go.mod update follows after
grpc v1.79.3/http2.TrailerPrefix compatibility is resolved.

README.md

@@ -70,10 +70,9 @@ both the kernel and BGP within one reconcile cycle (sub-second).
 NIC ↔ upstream router. No conntrack, no SNAT, no encapsulation.
 
 For IPv6 the host side of every veth carries the deterministic link-local
-gateway `fe80::1`, and the isolated pod side carries `fe80::2` for neighbor
+gateway `fe80::1`, so every pod can use a fixed default route. For IPv4
-discovery. Every IPv6 pod can use a fixed default route without depending on
+the host side answers ARP for `169.254.1.1`, providing the same fixed
-its global `/128` for gateway resolution. For IPv4 the host side answers ARP
+default route in v4.
-for `169.254.1.1`, providing the same fixed default route in v4.
 
 ## Requirements
 

go.mod

@@ -1,12 +1,11 @@
 module code.fritzlab.net/fritzlab/flock
 
-go 1.27
+go 1.26.1
 
 require (
 	github.com/containernetworking/cni v1.3.0
 	github.com/containernetworking/plugins v1.9.1
 	github.com/vishvananda/netlink v1.3.1
-	golang.org/x/sys v0.40.0
 	k8s.io/api v0.36.0
 	k8s.io/apimachinery v0.36.0
 	k8s.io/client-go v0.36.0
@@ -36,6 +35,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/net v0.49.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
+	golang.org/x/sys v0.40.0 // indirect
 	golang.org/x/term v0.39.0 // indirect
 	golang.org/x/text v0.33.0 // indirect
 	golang.org/x/time v0.14.0 // indirect

pkg/agent/netns_linux.go

@@ -11,7 +11,6 @@ import (
 
 	"github.com/containernetworking/plugins/pkg/ns"
 	"github.com/vishvananda/netlink"
-	"golang.org/x/sys/unix"
 )
 
 // SetupRequest is the netlink setup input for one pod.
@@ -38,11 +37,6 @@ type SetupRequest struct {
 // LL DAD on the host side.
 var linkLocalGW = net.ParseIP("fe80::1")
 
-// linkLocalPod is the deterministic pod-side address used for IPv6 neighbor
-// discovery. Without a link-local source, gateway NUD probes use the pod's
-// global /128 and the host does not answer them reliably after neighbor expiry.
-var linkLocalPod = net.ParseIP("fe80::2")
-
 // v4ProxyGW is the well-known link-local IPv4 used by container CNIs as a
 // next-hop for proxy-arp gateways (cilium, calico, kindnet — all use this).
 var v4ProxyGW = net.IPv4(169, 254, 1, 1)
@@ -216,14 +210,6 @@ func configurePodSide(req SetupRequest) error {
 		}
 
 		if req.IP6 != nil {
-			// Keep automatic address generation disabled, but give every IPv6 pod
-			// veth a deterministic link-local address. This makes NUD for the
-			// fe80::1 gateway use an on-link source and prevents the default-route
-			// neighbor from aging into FAILED. DAD is unnecessary on a veth pair.
-			if err := netlink.AddrAdd(eth0, podLinkLocalAddr()); err != nil && !errors.Is(err, os.ErrExist) {
-				return fmt.Errorf("pod link-local add: %w", err)
-			}
-
 			a := &netlink.Addr{IPNet: &net.IPNet{IP: req.IP6, Mask: net.CIDRMask(128, 128)}}
 			if err := netlink.AddrAdd(eth0, a); err != nil && !errors.Is(err, os.ErrExist) {
 				return fmt.Errorf("pod ip6 add: %w", err)
@@ -309,13 +295,6 @@ func configurePodSide(req SetupRequest) error {
 	})
 }
 
-func podLinkLocalAddr() *netlink.Addr {
-	return &netlink.Addr{
-		IPNet: &net.IPNet{IP: linkLocalPod, Mask: net.CIDRMask(64, 128)},
-		Flags: unix.IFA_F_NODAD,
-	}
-}
-
 func setHostRoute(linkIndex int, ip net.IP, prefix int) error {
 	r := &netlink.Route{
 		LinkIndex: linkIndex,

pkg/agent/netns_linux_test.go

@@ -1,25 +0,0 @@
-//go:build linux
-
-package agent
-
-import (
-	"testing"
-
-	"golang.org/x/sys/unix"
-)
-
-func TestPodLinkLocalAddr(t *testing.T) {
-	addr := podLinkLocalAddr()
-	if got, want := addr.IP.String(), "fe80::2"; got != want {
-		t.Fatalf("pod link-local IP = %s, want %s", got, want)
-	}
-	if ones, bits := addr.Mask.Size(); ones != 64 || bits != 128 {
-		t.Fatalf("pod link-local mask = %d/%d, want 64/128", ones, bits)
-	}
-	if addr.Flags&unix.IFA_F_NODAD == 0 {
-		t.Fatal("pod link-local address must disable DAD")
-	}
-	if addr.IP.Equal(linkLocalGW) {
-		t.Fatal("pod and gateway link-local addresses must differ")
-	}
-}