fritzlab-public/flock
12
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[bug-n1wxwkrtcnds] Fix pod gateway NUD expiry #7

Merged
dfritz merged 1 commits from ops/bug-n1wxwkrtcnds/pod-link-local into main 2026-08-26 23:55:09 +00:00
Conversation 0 Commits 1 Files Changed 4
+51 -4
dfritz commented 2026-08-26 23:44:42 +00:00
Owner
Copy Link
Copy Source

Problem

Flock disables pod-side link-local generation. When the default gateway neighbor expires, the pod sends NDP from its global /128; the host does not answer, the gateway becomes FAILED, and replies through anycast blackhole.

Fix

Assign deterministic fe80::2/64 with NODAD to every IPv6 pod veth while retaining fe80::1 as the host gateway. This gives NUD an on-link source without adding DAD delay.

Validation

  • go test ./...
  • go vet ./...
  • Live host002 capture: before the change, global-source solicitations received no advertisement; after adding fe80::2, every solicitation received a host advertisement and gateway NUD remained healthy.

🤖 Posted by Codex (GPT-5) on behalf of Donavan Fritz, automated, not human-authored.

Production validation

Released as code.fritzlab.net/fritzlab-public/flock@sha256:0eb2e5f9318cb24738e6e2ee5b4dc3c9961b9191fc7bbad9c6e3afc636cb4d98. All six agents are healthy on the exact digest, all existing IPv6 namespaces were remediated, all gateways resolve, and routed probes passed. New-pod canary NUD and router probes also passed.

Fixes bug-n1wxwkrtcnds
Fixes bug-fjqwk753kb14

## Problem Flock disables pod-side link-local generation. When the default gateway neighbor expires, the pod sends NDP from its global /128; the host does not answer, the gateway becomes FAILED, and replies through anycast blackhole. ## Fix Assign deterministic fe80::2/64 with NODAD to every IPv6 pod veth while retaining fe80::1 as the host gateway. This gives NUD an on-link source without adding DAD delay. ## Validation - go test ./... - go vet ./... - Live host002 capture: before the change, global-source solicitations received no advertisement; after adding fe80::2, every solicitation received a host advertisement and gateway NUD remained healthy. --- 🤖 Posted by Codex (GPT-5) on behalf of Donavan Fritz, automated, not human-authored. ## Production validation Released as `code.fritzlab.net/fritzlab-public/flock@sha256:0eb2e5f9318cb24738e6e2ee5b4dc3c9961b9191fc7bbad9c6e3afc636cb4d98`. All six agents are healthy on the exact digest, all existing IPv6 namespaces were remediated, all gateways resolve, and routed probes passed. New-pod canary NUD and router probes also passed. Fixes bug-n1wxwkrtcnds Fixes bug-fjqwk753kb14
dfritz added 1 commit 2026-08-26 23:44:42 +00:00
[bug-n1wxwkrtcnds] add pod link-local NUD source
flock PR validation / validate (pull_request) Successful in 1m54s
Details
5df592e2d1 
Co-Authored-By: Codex (GPT-5) <noreply@openai.com>
dfritz merged commit b67e7894f7 into main 2026-08-26 23:55:09 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-hub (Agent Hub) architect (Evelyn Chen) dev (Dave Kowalski) dfritz (Donavan Fritz) ops (Hank Mueller) perf (Marco Bianchi) security (Mark Reyes) support (Bob Fritz) ux (Margot Devereux)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: fritzlab-public/flock#7