🤖 Generated by the Daily AI Assistant
Why
The worker ingress-firewall (talos/workers/*.yaml) still has one NetworkRuleConfig per port, several of which share an identical protocol + subnet-set. AGENTS.md's talos-patch convention says to keep the rule count low by consolidating matching rules — the same ENOBUFS-motivated rule that #2118 already applied to the control-plane firewall (12→4 rules) but never to the workers. CodeRabbit surfaced three of these pairs on #2474.
What
Mirror #2118 on the worker side: fold worker rules that share protocol + subnet-set into single multi-port rules, e.g.
- udp /
10.0.0.0/16: cni-vxlan (8472) + cilium-wireguard (51871) → one rule
- tcp /
10.0.0.0/16: cilium-health (4240) + cilium-mutual-auth (4250) + nodeport (30000-32767) → one rule
- tcp /
{10.0.0.0/16, 10.244.0.0/16}: kubelet (10250) + hubble-peer (4244) + node-exporter (9100) → one rule
Behaviour-preserving (same ports/subnets/protocol). Keep the cilium-mutual-auth incident-history commentary in the merged file (or leave it as a documented one-rule exception). This is a behaviour-adjacent firewall change, so it gets its own focused, separately-validatable PR — exactly as #2118 was — rather than riding on the naming/one-doc PR #2474.
Rough size
S — a handful of talos worker files + validate-talos render check.
Discovered while resolving #2474.
Why
The worker ingress-firewall (
talos/workers/*.yaml) still has oneNetworkRuleConfigper port, several of which share an identical protocol + subnet-set. AGENTS.md's talos-patch convention says to keep the rule count low by consolidating matching rules — the same ENOBUFS-motivated rule that #2118 already applied to the control-plane firewall (12→4 rules) but never to the workers. CodeRabbit surfaced three of these pairs on #2474.What
Mirror #2118 on the worker side: fold worker rules that share protocol + subnet-set into single multi-port rules, e.g.
10.0.0.0/16:cni-vxlan(8472) +cilium-wireguard(51871) → one rule10.0.0.0/16:cilium-health(4240) +cilium-mutual-auth(4250) +nodeport(30000-32767) → one rule{10.0.0.0/16, 10.244.0.0/16}:kubelet(10250) +hubble-peer(4244) +node-exporter(9100) → one ruleBehaviour-preserving (same ports/subnets/protocol). Keep the
cilium-mutual-authincident-history commentary in the merged file (or leave it as a documented one-rule exception). This is a behaviour-adjacent firewall change, so it gets its own focused, separately-validatable PR — exactly as #2118 was — rather than riding on the naming/one-doc PR #2474.Rough size
S — a handful of talos worker files +
validate-talosrender check.Discovered while resolving #2474.