From 6542ab58eb86b28691bfc55595310a3c671dd05c Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Mon, 9 Feb 2026 17:22:42 +0100 Subject: [PATCH 1/2] feat(kilo): add configurable MTU for WireGuard interface Expose the --mtu flag in values.yaml to allow overriding the default WireGuard interface MTU (1420). This is needed for environments where the underlying network has a lower MTU, such as Azure VMs (eth0 MTU 1400), to avoid packet fragmentation in the WireGuard tunnel. Co-Authored-By: Claude Signed-off-by: Andrei Kvapil --- packages/system/kilo/templates/kilo.yaml | 1 + packages/system/kilo/values.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/packages/system/kilo/templates/kilo.yaml b/packages/system/kilo/templates/kilo.yaml index 298c0400..b0561b58 100644 --- a/packages/system/kilo/templates/kilo.yaml +++ b/packages/system/kilo/templates/kilo.yaml @@ -41,6 +41,7 @@ spec: {{- with .Values.kilo.transitCIDR }} - --subnet={{ . }} {{- end }} + - --mtu={{ .Values.kilo.mtu | default 1420 }} - --internal-cidr=$(NODE_IP)/32 env: - name: NODE_NAME diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml index 7bcfc55c..4d32420e 100644 --- a/packages/system/kilo/values.yaml +++ b/packages/system/kilo/values.yaml @@ -8,3 +8,4 @@ kilo: transitCIDR: 100.66.0.0/16 meshGranularity: location cleanUpInterface: false + mtu: 1420 From bb39a0f73f20636b137dbe25cb1474d206a21e1a Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 10 Feb 2026 20:07:16 +0100 Subject: [PATCH 2/2] Update kilo v0.7.0 from a fork Signed-off-by: Andrei Kvapil --- Makefile | 1 - packages/system/kilo/Makefile | 22 +- packages/system/kilo/images/kilo/Dockerfile | 47 ---- .../system/kilo/images/kilo/patches/1.diff | 246 ------------------ .../system/kilo/images/kilo/patches/2.diff | 30 --- packages/system/kilo/templates/kilo.yaml | 2 +- packages/system/kilo/values.yaml | 4 +- 7 files changed, 8 insertions(+), 344 deletions(-) delete mode 100644 packages/system/kilo/images/kilo/Dockerfile delete mode 100644 packages/system/kilo/images/kilo/patches/1.diff delete mode 100644 packages/system/kilo/images/kilo/patches/2.diff diff --git a/Makefile b/Makefile index ba0c8df7..f658747f 100644 --- a/Makefile +++ b/Makefile @@ -27,7 +27,6 @@ build: build-deps make -C packages/system/dashboard image make -C packages/system/metallb image make -C packages/system/kamaji image - make -C packages/system/kilo image make -C packages/system/bucket image make -C packages/system/objectstorage-controller image make -C packages/system/grafana-operator image diff --git a/packages/system/kilo/Makefile b/packages/system/kilo/Makefile index 3d278db3..fcce8bd9 100644 --- a/packages/system/kilo/Makefile +++ b/packages/system/kilo/Makefile @@ -5,21 +5,9 @@ include ../../../hack/common-envs.mk include ../../../hack/package.mk update: - wget https://raw.githubusercontent.com/squat/kilo/refs/heads/main/manifests/crds.yaml -O templates/crds.yaml - wget https://raw.githubusercontent.com/squat/kilo/refs/heads/main/manifests/kilo-typhoon-flannel.yaml -O templates/kilo.yaml - sed -i 's|kube-system|cozy-kilo|g' templates/kilo.yaml - sed -i 's|--compatibility=flannel|--compatibility=cilium|' templates/kilo.yaml - sed -i '/- --local=false/a \ - --mesh-granularity=full\n - --service-cidr=10.244.0.0/24\n - --service-cidr=10.96.0.0/24' templates/kilo.yaml - -image: - docker buildx build images/kilo \ - --tag $(REGISTRY)/kilo:$(call settag,$(TAG)) \ - --cache-from type=registry,ref=$(REGISTRY)/kilo:latest \ - --cache-to type=inline \ - --metadata-file images/kilo.json \ - $(BUILDX_ARGS) - REPOSITORY="$(REGISTRY)/kilo" \ - yq -i '.kilo.image.repository = strenv(REPOSITORY)' values.yaml - TAG=$(TAG)@$$(yq e '."containerimage.digest"' images/kilo.json -o json -r) \ + tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/kilo | awk -F'[/^]' 'END{print $$3}') && \ + digest=$$(skopeo inspect --override-os linux --format '{{.Digest}}' docker://ghcr.io/cozystack/cozystack/kilo:$${tag}) && \ + REPOSITORY="ghcr.io/cozystack/cozystack/kilo" \ + yq -i '.kilo.image.repository = strenv(REPOSITORY)' values.yaml && \ + TAG="$${tag}@$${digest}" \ yq -i '.kilo.image.tag = strenv(TAG)' values.yaml - rm -f images/kilo.json diff --git a/packages/system/kilo/images/kilo/Dockerfile b/packages/system/kilo/images/kilo/Dockerfile deleted file mode 100644 index b36a85d0..00000000 --- a/packages/system/kilo/images/kilo/Dockerfile +++ /dev/null @@ -1,47 +0,0 @@ -# Build the manager binary -ARG FROM=alpine -FROM $FROM AS cni -ARG GOARCH=amd64 -ARG CNI_PLUGINS_VERSION=v1.1.1 -RUN apk add --no-cache curl && \ - curl -Lo cni.tar.gz https://github.com/containernetworking/plugins/releases/download/$CNI_PLUGINS_VERSION/cni-plugins-linux-$GOARCH-$CNI_PLUGINS_VERSION.tgz && \ - tar -xf cni.tar.gz - -FROM golang:1.19.0 as builder - -ARG VERSION=0.6.0 -ARG TARGETOS -ARG TARGETARCH - -WORKDIR /workspace - -RUN curl -sSL https://github.com/squat/kilo/archive/refs/tags/${VERSION}.tar.gz | tar -xzvf- --strip=1 - -COPY patches /patches -RUN git apply /patches/*.diff - - -RUN set -eux; \ - GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 \ - go build -mod=vendor \ - -ldflags "-X github.com/squat/kilo/pkg/version.Version=$VERSION" \ - -o /out/kg \ - ./cmd/kg/... ; \ - GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 \ - go build -mod=vendor \ - -ldflags "-X github.com/squat/kilo/pkg/version.Version=$VERSION" \ - -o /out/kgctl \ - ./cmd/kgctl/... - -FROM alpine:3.20 -ARG GOARCH -ARG ALPINE_VERSION=v3.20 -LABEL maintainer="squat " -RUN echo -e "https://alpine.global.ssl.fastly.net/alpine/$ALPINE_VERSION/main\nhttps://alpine.global.ssl.fastly.net/alpine/$ALPINE_VERSION/community" > /etc/apk/repositories && \ - apk add --no-cache ipset iptables ip6tables graphviz font-noto -COPY --from=cni bridge host-local loopback portmap /opt/cni/bin/ -ADD https://raw.githubusercontent.com/kubernetes-sigs/iptables-wrappers/e139a115350974aac8a82ec4b815d2845f86997e/iptables-wrapper-installer.sh / -RUN chmod 700 /iptables-wrapper-installer.sh && /iptables-wrapper-installer.sh --no-sanity-check -COPY --from=builder /out/kg /opt/bin/ -COPY --from=builder /out/kgctl /opt/bin/ -ENTRYPOINT ["/opt/bin/kg"] \ No newline at end of file diff --git a/packages/system/kilo/images/kilo/patches/1.diff b/packages/system/kilo/images/kilo/patches/1.diff deleted file mode 100644 index 9597593e..00000000 --- a/packages/system/kilo/images/kilo/patches/1.diff +++ /dev/null @@ -1,246 +0,0 @@ -diff --git a/cmd/kg/main.go b/cmd/kg/main.go -index c2ad6d5..301819f 100644 ---- a/cmd/kg/main.go -+++ b/cmd/kg/main.go -@@ -120,6 +120,7 @@ var ( - topologyLabel string - port int - serviceCIDRsRaw []string -+ internalCIDRsRaw []string - subnet string - resyncPeriod time.Duration - iptablesForwardRule bool -@@ -152,6 +153,7 @@ func init() { - cmd.Flags().StringVar(&topologyLabel, "topology-label", k8s.RegionLabelKey, "Kubernetes node label used to group nodes into logical locations.") - cmd.Flags().IntVar(&port, "port", mesh.DefaultKiloPort, "The port over which WireGuard peers should communicate.") - cmd.Flags().StringSliceVar(&serviceCIDRsRaw, "service-cidr", nil, "The service CIDR for the Kubernetes cluster. Can be provided optionally to avoid masquerading packets sent to service IPs. Can be specified multiple times.") -+ cmd.Flags().StringSliceVar(&internalCIDRsRaw, "internal-cidr", nil, "CIDRs to consider for internal IP auto-detection. If specified, only IPs within these CIDRs will be used. Can be specified multiple times.") - cmd.Flags().StringVar(&subnet, "subnet", mesh.DefaultKiloSubnet.String(), "CIDR from which to allocate addresses for WireGuard interfaces.") - cmd.Flags().DurationVar(&resyncPeriod, "resync-period", 30*time.Second, "How often should the Kilo controllers reconcile?") - cmd.Flags().BoolVar(&iptablesForwardRule, "iptables-forward-rules", false, "Add default accept rules to the FORWARD chain in iptables. Warning: this may break firewalls with a deny all policy and is potentially insecure!") -@@ -266,7 +268,16 @@ func runRoot(_ *cobra.Command, _ []string) error { - serviceCIDRs = append(serviceCIDRs, s) - } - -- m, err := mesh.New(b, enc, gr, hostname, port, s, local, cni, cniPath, iface, cleanUp, cleanUpIface, createIface, mtu, resyncPeriod, prioritisePrivateAddr, iptablesForwardRule, serviceCIDRs, log.With(logger, "component", "kilo"), registry) -+ var internalCIDRs []*net.IPNet -+ for _, internalCIDR := range internalCIDRsRaw { -+ _, s, err := net.ParseCIDR(internalCIDR) -+ if err != nil { -+ return fmt.Errorf("failed to parse %q as CIDR: %v", internalCIDR, err) -+ } -+ internalCIDRs = append(internalCIDRs, s) -+ } -+ -+ m, err := mesh.New(b, enc, gr, hostname, port, s, local, cni, cniPath, iface, cleanUp, cleanUpIface, createIface, mtu, resyncPeriod, prioritisePrivateAddr, iptablesForwardRule, internalCIDRs, serviceCIDRs, log.With(logger, "component", "kilo"), registry) - if err != nil { - return fmt.Errorf("failed to create Kilo mesh: %v", err) - } -diff --git a/manifests/kilo-bootkube-flannel.yaml b/manifests/kilo-bootkube-flannel.yaml -index 64e3500..fb3d25f 100644 ---- a/manifests/kilo-bootkube-flannel.yaml -+++ b/manifests/kilo-bootkube-flannel.yaml -@@ -74,11 +74,16 @@ spec: - - --cni=false - - --compatibility=flannel - - --local=false -+ - --internal-cidr=$(NODE_IP)/32 - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName -+ - name: NODE_IP -+ valueFrom: -+ fieldRef: -+ fieldPath: status.hostIP - ports: - - containerPort: 1107 - name: metrics -diff --git a/manifests/kilo-k3s-cilium.yaml b/manifests/kilo-k3s-cilium.yaml -index d75c93c..c98e518 100644 ---- a/manifests/kilo-k3s-cilium.yaml -+++ b/manifests/kilo-k3s-cilium.yaml -@@ -106,11 +106,16 @@ spec: - - --encapsulate=crosssubnet - - --clean-up-interface=true - - --log-level=all -+ - --internal-cidr=$(NODE_IP)/32 - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName -+ - name: NODE_IP -+ valueFrom: -+ fieldRef: -+ fieldPath: status.hostIP - ports: - - containerPort: 1107 - name: metrics -diff --git a/manifests/kilo-k3s-flannel.yaml b/manifests/kilo-k3s-flannel.yaml -index 612cb11..07b4c87 100644 ---- a/manifests/kilo-k3s-flannel.yaml -+++ b/manifests/kilo-k3s-flannel.yaml -@@ -103,11 +103,16 @@ spec: - - --cni=false - - --compatibility=flannel - - --local=false -+ - --internal-cidr=$(NODE_IP)/32 - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName -+ - name: NODE_IP -+ valueFrom: -+ fieldRef: -+ fieldPath: status.hostIP - ports: - - containerPort: 1107 - name: metrics -diff --git a/manifests/kilo-kubeadm-cilium.yaml b/manifests/kilo-kubeadm-cilium.yaml -index 5bf065a..ac0bf90 100644 ---- a/manifests/kilo-kubeadm-cilium.yaml -+++ b/manifests/kilo-kubeadm-cilium.yaml -@@ -79,11 +79,16 @@ spec: - - --clean-up-interface=true - - --subnet=172.31.254.0/24 - - --log-level=all -+ - --internal-cidr=$(NODE_IP)/32 - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName -+ - name: NODE_IP -+ valueFrom: -+ fieldRef: -+ fieldPath: status.hostIP - ports: - - containerPort: 1107 - name: metrics -diff --git a/manifests/kilo-kubeadm-flannel-userspace.yaml b/manifests/kilo-kubeadm-flannel-userspace.yaml -index c4ce25b..5d1824e 100644 ---- a/manifests/kilo-kubeadm-flannel-userspace.yaml -+++ b/manifests/kilo-kubeadm-flannel-userspace.yaml -@@ -88,11 +88,16 @@ spec: - - --cni=false - - --compatibility=flannel - - --local=false -+ - --internal-cidr=$(NODE_IP)/32 - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName -+ - name: NODE_IP -+ valueFrom: -+ fieldRef: -+ fieldPath: status.hostIP - ports: - - containerPort: 1107 - name: metrics -diff --git a/manifests/kilo-kubeadm-flannel.yaml b/manifests/kilo-kubeadm-flannel.yaml -index fea35dc..ff6bb25 100644 ---- a/manifests/kilo-kubeadm-flannel.yaml -+++ b/manifests/kilo-kubeadm-flannel.yaml -@@ -74,11 +74,16 @@ spec: - - --cni=false - - --compatibility=flannel - - --local=false -+ - --internal-cidr=$(NODE_IP)/32 - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName -+ - name: NODE_IP -+ valueFrom: -+ fieldRef: -+ fieldPath: status.hostIP - ports: - - containerPort: 1107 - name: metrics -diff --git a/manifests/kilo-typhoon-flannel.yaml b/manifests/kilo-typhoon-flannel.yaml -index 0e4d9b2..cbd467a 100644 ---- a/manifests/kilo-typhoon-flannel.yaml -+++ b/manifests/kilo-typhoon-flannel.yaml -@@ -74,11 +74,16 @@ spec: - - --cni=false - - --compatibility=flannel - - --local=false -+ - --internal-cidr=$(NODE_IP)/32 - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName -+ - name: NODE_IP -+ valueFrom: -+ fieldRef: -+ fieldPath: status.hostIP - ports: - - containerPort: 1107 - name: metrics -diff --git a/pkg/mesh/discoverips.go b/pkg/mesh/discoverips.go -index c8991d9..4598472 100644 ---- a/pkg/mesh/discoverips.go -+++ b/pkg/mesh/discoverips.go -@@ -40,7 +40,8 @@ import ( - // - private IP assigned to interface of default route - // - private IP assigned to local interface - // - if no IP was found, return nil and an error. --func getIP(hostname string, ignoreIfaces ...int) (*net.IPNet, *net.IPNet, error) { -+// If allowedCIDRs is not empty, only IPs within these CIDRs will be considered for private IP selection. -+func getIP(hostname string, allowedCIDRs []*net.IPNet, ignoreIfaces ...int) (*net.IPNet, *net.IPNet, error) { - ignore := make(map[string]struct{}) - for i := range ignoreIfaces { - if ignoreIfaces[i] == 0 { -@@ -144,6 +145,10 @@ func getIP(hostname string, ignoreIfaces ...int) (*net.IPNet, *net.IPNet, error) - if _, ok := ignore[tmpPriv[i].String()]; ok { - continue - } -+ // If allowedCIDRs is specified, filter private IPs by these CIDRs. -+ if len(allowedCIDRs) > 0 && !isInCIDRs(tmpPriv[i].IP, allowedCIDRs) { -+ continue -+ } - priv = append(priv, tmpPriv[i]) - } - for i := range tmpPub { -@@ -290,3 +295,13 @@ func defaultInterface() (*net.Interface, error) { - - return nil, errors.New("failed to find default route") - } -+ -+// isInCIDRs checks if the given IP is within any of the provided CIDRs. -+func isInCIDRs(ip net.IP, cidrs []*net.IPNet) bool { -+ for _, cidr := range cidrs { -+ if cidr.Contains(ip) { -+ return true -+ } -+ } -+ return false -+} -diff --git a/pkg/mesh/mesh.go b/pkg/mesh/mesh.go -index 3057d2a..e042467 100644 ---- a/pkg/mesh/mesh.go -+++ b/pkg/mesh/mesh.go -@@ -89,7 +89,7 @@ type Mesh struct { - } - - // New returns a new Mesh instance. --func New(backend Backend, enc encapsulation.Encapsulator, granularity Granularity, hostname string, port int, subnet *net.IPNet, local, cni bool, cniPath, iface string, cleanup bool, cleanUpIface bool, createIface bool, mtu uint, resyncPeriod time.Duration, prioritisePrivateAddr, iptablesForwardRule bool, serviceCIDRs []*net.IPNet, logger log.Logger, registerer prometheus.Registerer) (*Mesh, error) { -+func New(backend Backend, enc encapsulation.Encapsulator, granularity Granularity, hostname string, port int, subnet *net.IPNet, local, cni bool, cniPath, iface string, cleanup bool, cleanUpIface bool, createIface bool, mtu uint, resyncPeriod time.Duration, prioritisePrivateAddr, iptablesForwardRule bool, allowedInternalCIDRs []*net.IPNet, serviceCIDRs []*net.IPNet, logger log.Logger, registerer prometheus.Registerer) (*Mesh, error) { - if err := os.MkdirAll(kiloPath, 0700); err != nil { - return nil, fmt.Errorf("failed to create directory to store configuration: %v", err) - } -@@ -134,7 +134,7 @@ func New(backend Backend, enc encapsulation.Encapsulator, granularity Granularit - } - kiloIface = link.Attrs().Index - } -- privateIP, publicIP, err := getIP(hostname, kiloIface, enc.Index(), cniIndex) -+ privateIP, publicIP, err := getIP(hostname, allowedInternalCIDRs, kiloIface, enc.Index(), cniIndex) - if err != nil { - return nil, fmt.Errorf("failed to find public IP: %v", err) - } diff --git a/packages/system/kilo/images/kilo/patches/2.diff b/packages/system/kilo/images/kilo/patches/2.diff deleted file mode 100644 index 730c4469..00000000 --- a/packages/system/kilo/images/kilo/patches/2.diff +++ /dev/null @@ -1,30 +0,0 @@ -diff --git a/pkg/mesh/topology.go b/pkg/mesh/topology.go -index ca22bf6..1de8ae4 100644 ---- a/pkg/mesh/topology.go -+++ b/pkg/mesh/topology.go -@@ -263,17 +263,22 @@ CheckIPs: - } - } - // Check if allowed location IPs intersect with the allowed IPs. -+ // If the allowed location IP fully contains an allowed IP, that's fine - -+ // the more specific route will be used. Only warn if it's a partial overlap -+ // or if the allowed IP contains the allowed location IP. - for _, i := range s.allowedIPs { -- if intersect(ip, i) { -+ if intersect(ip, i) && !ip.Contains(i.IP) { - level.Warn(t.logger).Log("msg", "overlapping allowed location IPnet with allowed IPnets", "IP", ip.String(), "IP2", i.String(), "segment-location", s.location) - continue CheckIPs - } - } - // Check if allowed location IPs intersect with the private IPs of the segment. -+ // If the allowed location IP fully contains a private IP, that's fine. - for _, i := range s.privateIPs { - if ip.Contains(i) { -- level.Warn(t.logger).Log("msg", "overlapping allowed location IPnet with privateIP", "IP", ip.String(), "IP2", i.String(), "segment-location", s.location) -- continue CheckIPs -+ // This is OK - the allowed location IP contains the private IP, -+ // so the more specific route to the private IP will still work. -+ level.Debug(t.logger).Log("msg", "allowed location IPnet contains privateIP", "IP", ip.String(), "IP2", i.String(), "segment-location", s.location) - } - } - } diff --git a/packages/system/kilo/templates/kilo.yaml b/packages/system/kilo/templates/kilo.yaml index b0561b58..e209aed2 100644 --- a/packages/system/kilo/templates/kilo.yaml +++ b/packages/system/kilo/templates/kilo.yaml @@ -41,7 +41,7 @@ spec: {{- with .Values.kilo.transitCIDR }} - --subnet={{ . }} {{- end }} - - --mtu={{ .Values.kilo.mtu | default 1420 }} + - --mtu={{ .Values.kilo.mtu | default "auto" }} - --internal-cidr=$(NODE_IP)/32 env: - name: NODE_NAME diff --git a/packages/system/kilo/values.yaml b/packages/system/kilo/values.yaml index 4d32420e..279f62b0 100644 --- a/packages/system/kilo/values.yaml +++ b/packages/system/kilo/values.yaml @@ -1,11 +1,11 @@ kilo: image: pullPolicy: IfNotPresent - tag: v1.0.0-beta.2@sha256:45ad01a89ebb5311735660a0d1a1df36eda4b6f960be1b6319d2b94d2a7db701 + tag: v0.7.0@sha256:69c14b8292c0dc9045fd646d332811619a2d93bcc1f9e19e11da9a9a172c988c repository: ghcr.io/cozystack/cozystack/kilo podCIDR: 10.244.0.0/16 serviceCIDR: 10.96.0.0/16 transitCIDR: 100.66.0.0/16 meshGranularity: location cleanUpInterface: false - mtu: 1420 + mtu: auto