sirius/homek8s
Watch
1
0
Fork
You've already forked homek8s
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: upgrade Cilium to 1.19.7 to resolve operator CrashLoopBackOff #1

Merged
sirius merged 1 commit from fix/cilium-operator-crash into master 2026-09-15 04:08:05 +00:00
Conversation 0 Commits 1 Files changed 1 +1 -1
sirius commented 2026-09-15 04:07:15 +00:00
Owner
Copy link

Summary

Cilium operator has been CrashLoopBackOff for ~3 days on the siriussec node.

Root cause: Cilium 1.18.13 operator tries to set up a field indexer for TLSRoute at gateway.networking.k8s.io/v1alpha2, but the cluster's TLSRoute CRD only supports v1 and v1alpha3. The operator panics fatally on startup.

fatal: failed to populate object graph: failed to create gateway controller:
  failed to setup reconciler: failed to setup field indexer "backendServiceTLSRouteIndex":
  no matches for kind "TLSRoute" in version "gateway.networking.k8s.io/v1alpha2"

Fix: Upgrade Cilium chart from 1.18.13 → 1.19.7. The 1.19 series fixed the gateway API handling to work with the v1/v1alpha3 TLSRoute layout.

Current state:

  • Cilium operator: CrashLoopBackOff (46 restarts, 100s ago)
  • Cilium agents/Envoy on all 3 nodes: Running
  • Gateway (public class): Accepted/Programmed=True
  • Flux: bootstrapped (flux-system kustomization Applied)

Verification after merge:

  1. kubectl get pods -n kube-system -l app.kubernetes.io/name=cilium-operator → 1/1 Running
  2. kubectl get nodes → all Ready, no new taints
  3. curl -sI http://10.10.0.1 via the Gateway should still work

Test plan

  • Operator pod becomes Ready after HelmRelease reconciliation (~15m interval, or force with flux reconcile kustomization flux-system)
  • All existing Cilium agent pods survive the upgrade
  • Gateway still routes traffic
  • No new node taints introduced
## Summary Cilium operator has been CrashLoopBackOff for ~3 days on the siriussec node. **Root cause:** Cilium 1.18.13 operator tries to set up a field indexer for `TLSRoute` at `gateway.networking.k8s.io/v1alpha2`, but the cluster's TLSRoute CRD only supports `v1` and `v1alpha3`. The operator panics fatally on startup. ``` fatal: failed to populate object graph: failed to create gateway controller: failed to setup reconciler: failed to setup field indexer "backendServiceTLSRouteIndex": no matches for kind "TLSRoute" in version "gateway.networking.k8s.io/v1alpha2" ``` **Fix:** Upgrade Cilium chart from `1.18.13` → `1.19.7`. The 1.19 series fixed the gateway API handling to work with the `v1`/`v1alpha3` TLSRoute layout. **Current state:** - Cilium operator: CrashLoopBackOff (46 restarts, 100s ago) - Cilium agents/Envoy on all 3 nodes: Running - Gateway (`public` class): Accepted/Programmed=True - Flux: bootstrapped (flux-system kustomization Applied) **Verification after merge:** 1. `kubectl get pods -n kube-system -l app.kubernetes.io/name=cilium-operator` → 1/1 Running 2. `kubectl get nodes` → all Ready, no new taints 3. `curl -sI http://10.10.0.1` via the Gateway should still work ## Test plan - [ ] Operator pod becomes Ready after HelmRelease reconciliation (~15m interval, or force with `flux reconcile kustomization flux-system`) - [ ] All existing Cilium agent pods survive the upgrade - [ ] Gateway still routes traffic - [ ] No new node taints introduced
Cilium operator 1.18.13 crashes on startup with:
  no matches for kind TLSRoute in version gateway.networking.k8s.io/v1alpha2

The TLSRoute CRD on the cluster only has v1 (no v1alpha2). Cilium 1.19+
fixes the gateway API field indexer to work with the v1/v1alpha3 TLSRoute
layout. Fixes the 3-day operator outage.
sirius merged commit a2b9256d97 into master 2026-09-15 04:08:05 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sirius/homek8s!1
No description provided.