From f7b0af0d608bd669b2ba4cc9ae57cd4bf52880c3 Mon Sep 17 00:00:00 2001 From: Mehrdad Biukian <80095851+mehrdadbn9@users.noreply.github.com> Date: Mon, 31 Aug 2026 07:18:08 +0400 Subject: [PATCH] fix: render routingMode native when cilium_tunnel_mode is disabled (#13427) * fix: render routingMode native when cilium_tunnel_mode is disabled When cilium_tunnel_mode is set to 'disabled', the previous template rendered 'tunnelProtocol: disabled', which Cilium does not recognise and falls back to vxlan. With native routing this conflicts and agents CrashLoopBackOff. Render 'routingMode: native' instead when disabled, matching the Cilium Helm chart API (per maintainer review on #13427 and #13314). Refs kubernetes-sigs/kubespray#13267 Signed-off-by: Mehrdad Biukian Naeini * fix(cilium): tighten routingMode native render (remove stray blank line) Per review comment on kubernetes-sigs/kubespray#13427, drop the extra blank line after the routingMode/tunnelProtocol if-block so the rendered Helm values file is clean. Validated by rendering the template for cilium_tunnel_mode in {disabled, vxlan, geneve}: disabled yields 'routingMode: native' with no tunnelProtocol; vxlan/geneve yield 'tunnelProtocol: '. Signed-off-by: Mehrdad Biukian Naeini --------- Signed-off-by: Mehrdad Biukian Naeini --- roles/network_plugin/cilium/defaults/main.yml | 5 ++++- roles/network_plugin/cilium/templates/values.yaml.j2 | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/roles/network_plugin/cilium/defaults/main.yml b/roles/network_plugin/cilium/defaults/main.yml index 79681e054..8496c8716 100644 --- a/roles/network_plugin/cilium/defaults/main.yml +++ b/roles/network_plugin/cilium/defaults/main.yml @@ -26,7 +26,10 @@ cilium_cpu_limit: 500m cilium_memory_requests: 64M cilium_cpu_requests: 100m -# Overlay Network Mode +# Cilium tunnel mode. Possible values: vxlan, geneve, disabled. +# Set to 'disabled' to use native routing without tunneling. +# When set to 'disabled', Kubespray renders routingMode: native in the Helm +# values instead of tunnelProtocol, which is required by Cilium >= 1.14. cilium_tunnel_mode: vxlan # LoadBalancer Mode (snat/dsr/hybrid) Ref: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/#dsr-mode diff --git a/roles/network_plugin/cilium/templates/values.yaml.j2 b/roles/network_plugin/cilium/templates/values.yaml.j2 index 8e2da3f0a..39179fb8c 100644 --- a/roles/network_plugin/cilium/templates/values.yaml.j2 +++ b/roles/network_plugin/cilium/templates/values.yaml.j2 @@ -25,7 +25,11 @@ healthPort: {{ cilium_agent_health_port }} identityAllocationMode: {{ cilium_identity_allocation_mode }} +{% if cilium_tunnel_mode == 'disabled' %} +routingMode: native +{% else %} tunnelProtocol: {{ cilium_tunnel_mode }} +{% endif %} loadBalancer: mode: {{ cilium_loadbalancer_mode }}