From a254f5ea687dcfaf1ce8485742363a924aa9eb60 Mon Sep 17 00:00:00 2001 From: Kay Yan Date: Thu, 30 Apr 2026 14:13:26 +0800 Subject: [PATCH] network_plugin/cilium: fail fast when Gateway API CRDs are incompatible (#13223) Cilium < 1.20 unconditionally registers a field indexer for TLSRoute v1alpha2 when the Gateway API controller is enabled, but Gateway API >= 1.5.0 ships TLSRoute v1alpha2 with served=false in the standard channel. The result is cilium-operator CrashLoopBackOff with: no matches for kind "TLSRoute" in version "gateway.networking.k8s.io/v1alpha2" The fix landed in Cilium 1.20 only and will not be backported. Add a preflight assert that triggers only when all of the following hold: cilium_gateway_api_enabled, gateway_api_enabled, cilium_version < 1.20.0, gateway_api_version >= 1.5.0, and gateway_api_channel == "standard". Users hit by this combo get a clear error and two workarounds (pin gateway_api_version to 1.4.1, or switch gateway_api_channel to "experimental") instead of debugging a crash loop after the fact. Signed-off-by: Kay Yan --- roles/network_plugin/cilium/tasks/check.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/roles/network_plugin/cilium/tasks/check.yml b/roles/network_plugin/cilium/tasks/check.yml index 7471fe36d..34bab4252 100644 --- a/roles/network_plugin/cilium/tasks/check.yml +++ b/roles/network_plugin/cilium/tasks/check.yml @@ -67,3 +67,19 @@ that: "cilium_hubble_event_buffer_capacity in [1, 3, 7, 15, 31, 63, 127, 255, 511, 1023, 2047, 4095, 8191, 16383, 32767, 65535]" msg: "Error: cilium_hubble_event_buffer_capacity:{{ cilium_hubble_event_buffer_capacity }} is not a power of 2 minus 1 and it should be between 1 and 65535." when: cilium_hubble_event_buffer_capacity is defined + +# Cilium < 1.20 only supports Gateway API v1.4.1; v1.5+ standard channel drops +# TLSRoute v1alpha2 (served=false) which makes cilium-operator CrashLoopBackOff. +# Fix is in Cilium 1.20+ (cilium/cilium#45251) and will not be backported. +- name: Stop if cilium_gateway_api_enabled is incompatible with the Gateway API CRD bundle + assert: + that: + - gateway_api_version is version('1.5.0', '<') or gateway_api_channel != 'standard' + msg: | + Cilium < 1.20 only supports Gateway API v1.4.1, see + https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gateway-api/. + Pin gateway_api_version: '1.4.1', or set gateway_api_channel: 'experimental'. + when: + - cilium_gateway_api_enabled + - gateway_api_enabled + - cilium_version is version('1.20.0', '<')