Summary
Env: k8s v1.32.13 5279 latest/stable canonical✓ classic,held
Cilium fails to start ("unable to determine direct routing device") when all K8s node interfaces are OVS bridges
Summary
On a Sunbeam/Canonical OpenStack deployment where all node data interfaces are OVS bridges, every Cilium agent crash-loops and all nodes keep the node.cilium.io/agent-not-ready taint. Dependent workloads (MetalLB, CSI) stay Pending and the k8s charm blocks on Feature 'load-balancer' is not ready.
Cilium fatal error:
Root cause
Canonical K8s refuses to bind Cilium to bridge devices by default. Since every node interface is a bridge, Cilium's runtime device auto-detection fails and the agent aborts. direct-routing-device is empty in cilium-config and no CiliumNodeConfig exists.
Environment
k8s charm rev 1921, channel 1.32/stable, K8s v1.32.13
Cilium v0.14.9-ck8, routing-mode: tunnel, kube-proxy-replacement: false
4 nodes; node IP (10.21.7.x) sits on OVS bridge VLAN br-bond2.3403
Impact
All Cilium agents crash-looping; all nodes tainted.
No CNI-dependent pods can schedule; deployment cannot proceed.
Reproducible on every redeploy.
Steps to reproduce
Deploy Canonical K8s on nodes whose interfaces are all OVS bridges.
kubectl logs -n kube-system → "unable to determine direct routing device".
kubectl get cm cilium-config -n kube-system -o jsonpath='{.data.direct-routing-device}' → empty.
Workaround
juju config k8s cluster-annotations="k8sd/v1alpha1/cilium/devices=br-bond2.3403"
What Should Happen Instead?
Canonical K8s should support configuring Cilium's routing device on bridge-only topologies — either by auto-detecting the node-IP-bearing bridge, exposing a first-class charm config, or documenting the annotation as the supported path.
Reproduction Steps
Deploy Sunbeam with bridge only network topology
- VLANs 3404/3405/3407/3408 use an OVS bridge
- VLANS 3403/3406/3409 use ovs bridge
System information
none
Can you suggest a fix?
No response
Are you interested in contributing with a fix?
Canonical K8s should support configuring Cilium's routing device on bridge-only topologies — either by auto-detecting the node-IP-bearing bridge, exposing a first-class charm config, or documenting the annotation as the supported path.
Summary
Env: k8s v1.32.13 5279 latest/stable canonical✓ classic,held
Cilium fails to start ("unable to determine direct routing device") when all K8s node interfaces are OVS bridges
Summary
On a Sunbeam/Canonical OpenStack deployment where all node data interfaces are OVS bridges, every Cilium agent crash-loops and all nodes keep the node.cilium.io/agent-not-ready taint. Dependent workloads (MetalLB, CSI) stay Pending and the k8s charm blocks on Feature 'load-balancer' is not ready.
Cilium fatal error:
Root cause
Canonical K8s refuses to bind Cilium to bridge devices by default. Since every node interface is a bridge, Cilium's runtime device auto-detection fails and the agent aborts. direct-routing-device is empty in cilium-config and no CiliumNodeConfig exists.
Environment
k8s charm rev 1921, channel 1.32/stable, K8s v1.32.13
Cilium v0.14.9-ck8, routing-mode: tunnel, kube-proxy-replacement: false
4 nodes; node IP (10.21.7.x) sits on OVS bridge VLAN br-bond2.3403
Impact
All Cilium agents crash-looping; all nodes tainted.
No CNI-dependent pods can schedule; deployment cannot proceed.
Reproducible on every redeploy.
Steps to reproduce
Deploy Canonical K8s on nodes whose interfaces are all OVS bridges.
kubectl logs -n kube-system → "unable to determine direct routing device".
kubectl get cm cilium-config -n kube-system -o jsonpath='{.data.direct-routing-device}' → empty.
Workaround
juju config k8s cluster-annotations="k8sd/v1alpha1/cilium/devices=br-bond2.3403"
What Should Happen Instead?
Canonical K8s should support configuring Cilium's routing device on bridge-only topologies — either by auto-detecting the node-IP-bearing bridge, exposing a first-class charm config, or documenting the annotation as the supported path.
Reproduction Steps
Deploy Sunbeam with bridge only network topology
System information
none
Can you suggest a fix?
No response
Are you interested in contributing with a fix?
Canonical K8s should support configuring Cilium's routing device on bridge-only topologies — either by auto-detecting the node-IP-bearing bridge, exposing a first-class charm config, or documenting the annotation as the supported path.