fix(config): Harden production DaemonSet manifests

cmd/galactic-cni/main.go

@@ -68,7 +68,8 @@ func newRunCommand() *cobra.Command {
 		},
 	}
 	runCmd.Flags().IntVar(&grpcHealthPort, "grpc-health-port", 5180, "gRPC health check port")
-	runCmd.Flags().IntVar(&metricsPort, "metrics-port", 9091, "Prometheus metrics HTTP port")
+	// 9180 sits next to galactic-router's own metrics port (9179).
+	runCmd.Flags().IntVar(&metricsPort, "metrics-port", 9180, "Prometheus metrics HTTP port")
 	return runCmd
 }
 

config/cni/daemonset.yaml

@@ -9,13 +9,25 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: galactic-cni
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
   template:
     metadata:
       labels:
         app.kubernetes.io/name: galactic-cni
     spec:
       serviceAccountName: galactic-cni
       hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      # galactic-cni is more fundamental than any other node component: if
+      # evicted under node pressure, no pod (including the CNI's own peers)
+      # can schedule on this node at all.
+      priorityClassName: system-node-critical
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       tolerations:
         - operator: Exists
       # Only worker nodes run VPC pods; galactic-cni has nothing to do on
@@ -50,7 +62,10 @@ spec:
                   fieldPath: spec.nodeName
           securityContext:
             runAsUser: 0
+            capabilities:
+              drop: ["ALL"]
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
           resources:
             requests:
               cpu: 10m
@@ -72,6 +87,19 @@ spec:
           # placeholder, not a published tag.
           image: ghcr.io/datum-cloud/galactic-cni:latest
           command: ["/galactic-cni", "run"]
+          # Documentation only: hostNetwork: true means these are the
+          # process's actual listen ports on the node, not something
+          # Kubernetes publishes -- containerPort here doesn't change
+          # behavior, it just makes both ports (--grpc-health-port/
+          # --metrics-port defaults) visible to `kubectl describe pod`
+          # instead of only the gRPC one showing up via the probes below.
+          ports:
+            - name: grpc-health
+              containerPort: 5180
+              protocol: TCP
+            - name: metrics
+              containerPort: 9180
+              protocol: TCP
           # --- PRIVILEGE EXPANSION (Milestone 3.1 of
           # .local/implementation-plan-ebpf-xdp-usid-datapath.md) ---
           # This container previously ran with allowPrivilegeEscalation:
@@ -89,10 +117,12 @@ spec:
           securityContext:
             runAsUser: 0
             capabilities:
+              drop: ["ALL"]
               add:
                 - BPF
                 - NET_ADMIN
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
           resources:
             requests:
               cpu: 5m
@@ -109,6 +139,18 @@ spec:
               mountPath: /host/var/log/galactic
             - name: bpf-fs
               mountPath: /sys/fs/bpf
+          # BPF map creation under load (image pull + verifier work on a
+          # slow node) can outrun readinessProbe/livenessProbe's short
+          # initialDelaySeconds, risking a liveness-triggered restart loop
+          # before the process finishes initializing. startupProbe reuses
+          # the same gRPC health check with a much longer failureThreshold
+          # so liveness doesn't start counting until this succeeds once.
+          startupProbe:
+            grpc:
+              port: 5180
+              service: ebpf-datapath
+            periodSeconds: 5
+            failureThreshold: 30
           livenessProbe:
             grpc:
               port: 5180

config/fabric/daemonset.yaml

@@ -21,6 +21,9 @@ spec:
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
       priorityClassName: system-node-critical
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       # FRR here establishes the underlay eBGP session to the physical fabric
       # and brings up the node's lo address, both of which galactic-router
       # depends on before it can start — so this must tolerate NotReady the
@@ -110,6 +113,16 @@ spec:
       containers:
         - name: frr
           image: ghcr.io/datum-cloud/fabric-router:latest
+          # Documentation only (hostNetwork: true, so this doesn't change
+          # behavior): the standard BGP port, opened by bgpd itself once
+          # the per-node frr.conf.<nodename> (see fabric-config's
+          # frr-init above) enables it -- nothing here actually declares
+          # or gates it, this just makes it visible without reading FRR's
+          # own config.
+          ports:
+            - name: bgp
+              containerPort: 179
+              protocol: TCP
           lifecycle:
             preStop:
               exec:

config/gateway/base/daemonset.yaml

@@ -9,6 +9,10 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: galactic-gateway
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
   template:
     metadata:
       labels:
@@ -36,6 +40,14 @@ spec:
       # bindings grant the union of what each container needs.
       serviceAccountName: galactic-gateway
       hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      # Loss of galactic-gateway blackholes edge traffic through this
+      # node, so the scheduler/kubelet must never preempt it for ordinary
+      # workloads under node pressure.
+      priorityClassName: system-node-critical
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       tolerations:
         - operator: Exists
       containers:
@@ -67,23 +79,32 @@ spec:
             - name: GALACTIC_ROUTER_GC_NAMESPACE
               value: galactic-system
             - name: GALACTIC_ROUTER_BGP_LISTEN_PORT
+              # Same as config/router/tenant/daemonset-patch.yaml: -1
+              # disables the inbound BGP listener, so there's no BGP
+              # containerPort to declare on this container either -- this
+              # role only dials out to iBGP peers.
               value: "-1"
-            # Talos nodes permanently bind 127.0.0.1:5000 for the built-in
-            # /sbin/dashboard; since this DaemonSet runs hostNetwork: true,
-            # the default gRPC health port (5000) always collides on Talos
-            # — see docs/router/configuration.md. This pod's galactic-gateway
-            # container shares the same network namespace (hostNetwork:
-            # true), so its own grpc-health port (below) must also differ
-            # from this one, not just from 5000.
+            # 5179 is also the binary's own default. Set explicitly here
+            # anyway so it can't silently drift, and — more importantly —
+            # this pod's galactic-gateway container shares the same
+            # network namespace (hostNetwork: true), so its own
+            # grpc-health port (below) must always differ from this one.
             - name: GALACTIC_ROUTER_GRPC_HEALTH_PORT
               value: "5179"
           ports:
             - name: metrics
-              containerPort: 8080
+              containerPort: 9179
               protocol: TCP
             - name: grpc-health
               containerPort: 5179
               protocol: TCP
+          # See config/router/base/daemonset.yaml: same GoBGP cold-start
+          # rationale for startupProbe.
+          startupProbe:
+            grpc:
+              port: 5179
+            periodSeconds: 5
+            failureThreshold: 30
           livenessProbe:
             grpc:
               port: 5179
@@ -97,9 +118,11 @@ spec:
           securityContext:
             runAsUser: 0
             capabilities:
+              drop: ["ALL"]
               add:
                 - NET_ADMIN
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
           resources:
             requests:
               cpu: 50m
@@ -149,6 +172,14 @@ spec:
             - name: grpc-health
               containerPort: 5181
               protocol: TCP
+          # The eBPF XDP loader (map creation/attach) has the same
+          # slow-cold-start shape as galactic-cni's — see that manifest's
+          # startupProbe comment.
+          startupProbe:
+            grpc:
+              port: 5181
+            periodSeconds: 5
+            failureThreshold: 30
           livenessProbe:
             grpc:
               port: 5181
@@ -176,11 +207,13 @@ spec:
           securityContext:
             runAsUser: 0
             capabilities:
+              drop: ["ALL"]
               add:
                 - NET_ADMIN
                 - BPF
                 - PERFMON
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
           resources:
             requests:
               cpu: 50m

config/router/base/daemonset.yaml

@@ -9,13 +9,25 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: galactic-router
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
   template:
     metadata:
       labels:
         app.kubernetes.io/name: galactic-router
     spec:
       serviceAccountName: galactic-router
       hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      # Loss of galactic-router blackholes every VPC route through this
+      # node, so the scheduler/kubelet must never preempt it for ordinary
+      # workloads under node pressure.
+      priorityClassName: system-node-critical
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       tolerations:
         - operator: Exists
       containers:
@@ -39,19 +51,36 @@ spec:
               value: tenant
             - name: GALACTIC_ROUTER_GC_NAMESPACE
               value: galactic-system
-            # Talos nodes permanently bind 127.0.0.1:5000 for the built-in
-            # /sbin/dashboard; since this DaemonSet runs hostNetwork: true,
-            # the default gRPC health port (5000) always collides on Talos.
-            # See docs/router/configuration.md for details.
+            # 5179 is also the binary's own default. Set explicitly here
+            # anyway, matching this manifest's convention elsewhere, so it
+            # can't silently drift if the binary's default ever changes.
             - name: GALACTIC_ROUTER_GRPC_HEALTH_PORT
               value: "5179"
           ports:
             - name: metrics
-              containerPort: 8080
+              containerPort: 9179
               protocol: TCP
             - name: grpc-health
               containerPort: 5179
               protocol: TCP
+          # No BGP containerPort here: GALACTIC_ROUTER_BGP_LISTEN_PORT
+          # isn't set at this (never-applied-directly) base level at all,
+          # and its real value is role-dependent -- see
+          # ../tenant-control/daemonset-patch.yaml (1790, the one role
+          # that actually listens) and ../tenant/daemonset-patch.yaml
+          # (-1, disabled). Declaring one here would just be wrong for
+          # whichever role doesn't match it.
+          # GoBGP's cold start (peer session setup, RIB population) can
+          # outrun readinessProbe/livenessProbe's short initialDelaySeconds
+          # on a slow node, risking a liveness-triggered restart loop before
+          # the process finishes initializing. startupProbe reuses the same
+          # gRPC health check with a much longer failureThreshold so
+          # liveness doesn't start counting until this succeeds once.
+          startupProbe:
+            grpc:
+              port: 5179
+            periodSeconds: 5
+            failureThreshold: 30
           livenessProbe:
             grpc:
               port: 5179
@@ -65,9 +94,11 @@ spec:
           securityContext:
             runAsUser: 0
             capabilities:
+              drop: ["ALL"]
               add:
                 - NET_ADMIN
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
           resources:
             requests:
               cpu: 50m

config/router/tenant-control/daemonset-patch.yaml

@@ -41,3 +41,14 @@ spec:
               # host's lo interface by default (the stable peering address
               # other tenant routers reflect through). Set it explicitly here
               # only if lo doesn't carry the desired address on this cluster.
+          # Documentation only (hostNetwork: true, so this doesn't change
+          # behavior): the reflector role is the one place galactic-router
+          # actually listens for inbound BGP -- tenant nodes (see
+          # ../tenant/daemonset-patch.yaml) and the router container in
+          # config/gateway/base/daemonset.yaml both set
+          # GALACTIC_ROUTER_BGP_LISTEN_PORT=-1 and open no BGP port at all,
+          # so this entry only belongs on this patch, not the shared base.
+          ports:
+            - name: bgp
+              containerPort: 1790
+              protocol: TCP

config/router/tenant/daemonset-patch.yaml

@@ -34,4 +34,8 @@ spec:
         - name: galactic-router
           env:
             - name: GALACTIC_ROUTER_BGP_LISTEN_PORT
+              # Tenant nodes only dial *out* to iBGP peers (the reflector,
+              # see ../tenant-control/daemonset-patch.yaml); -1 disables
+              # the inbound listener entirely, so no BGP containerPort
+              # belongs on this patch -- there's no port here to document.
               value: "-1"

config/system/namespace.yaml

@@ -9,3 +9,9 @@ metadata:
     # against a cluster with the restricted/baseline PodSecurity default
     # fails admission with no pointer to the fix.
     pod-security.kubernetes.io/enforce: privileged
+    # audit/warn don't change enforcement (enforce: privileged already
+    # allows everything) — they just surface drift from the baseline
+    # profile in events/audit logs as the manifest set evolves, at no
+    # cost since nothing is actually blocked.
+    pod-security.kubernetes.io/audit: baseline
+    pod-security.kubernetes.io/warn: baseline

config/vmtap/daemonset.yaml

@@ -9,13 +9,27 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: vmtap-cni
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
   template:
     metadata:
       labels:
         app.kubernetes.io/name: vmtap-cni
     spec:
       serviceAccountName: vmtap-cni
+      # There's no rbac.yaml for vmtap-cni at all (internal/vmtap has no
+      # k8s client — it only patches a local conflist file and manages
+      # TAP/TC state), so the default ServiceAccount token would grant this
+      # pod zero capability while still being mounted for no reason.
+      automountServiceAccountToken: false
       hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      priorityClassName: system-node-critical
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       tolerations:
         - operator: Exists
       # Placeholder node signal: only nodes actually running kraftlet-managed
@@ -48,6 +62,7 @@ spec:
           securityContext:
             runAsUser: 0
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
           resources:
             requests:
               cpu: 10m
@@ -71,6 +86,7 @@ spec:
           securityContext:
             runAsUser: 0
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
           resources:
             requests:
               cpu: 5m