aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

fix: add cilium-secrets to reflector allowed namespaces (HOMELAB-468) #91

Merged
aaron merged 1 commit from plane/HOMELAB-468-reflector-fix into live 2026-03-27 14:30:26 +00:00
Conversation 0 Commits 1 Files changed 1 +2 -2
aaron commented 2026-03-27 14:30:10 +00:00
Owner
Copy link

Summary

  • Cilium Gateway API syncs TLS secrets to cilium-secrets namespace with inherited reflector annotations
  • Reflector detected these as unauthorized reflections and entered a tight delete loop (~10/sec)
  • Fix: add cilium-secrets to both reflection-allowed-namespaces and reflection-auto-namespaces
  • Live secret already patched, this makes it persistent through ArgoCD sync

Test Plan

  • Live secret patched and reflector loop confirmed stopped
  • All reflected secrets properly reconciled (8 namespaces)
## Summary - Cilium Gateway API syncs TLS secrets to cilium-secrets namespace with inherited reflector annotations - Reflector detected these as unauthorized reflections and entered a tight delete loop (~10/sec) - Fix: add cilium-secrets to both reflection-allowed-namespaces and reflection-auto-namespaces - Live secret already patched, this makes it persistent through ArgoCD sync ## Test Plan - [x] Live secret patched and reflector loop confirmed stopped - [x] All reflected secrets properly reconciled (8 namespaces)
fix: add cilium-secrets to reflector allowed namespaces (HOMELAB-468)
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
7260efc4bd 
Cilium Gateway API syncs TLS secrets to cilium-secrets namespace with
inherited reflector annotations. Reflector detected these as unauthorized
reflections and entered a tight delete loop (~10/sec), causing liveness
probe failures and continuous restarts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
aaron merged commit 8687fc5d1d into live 2026-03-27 14:30:26 +00:00
aaron deleted branch plane/HOMELAB-468-reflector-fix 2026-03-27 14:30:26 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!91
No description provided.