<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <docs>https://blogs.law.harvard.edu/tech/rss</docs>
    <title>BGP on Fuchsbau</title>
    <link>https://this-is-fine.io/tags/bgp/</link>
    <description>Recent content in BGP on Fuchsbau</description>
    <image>
      <title>BGP on Fuchsbau</title>
      <link>https://this-is-fine.io/tags/bgp/</link>
      <url>https://source.unsplash.com/2000x1322/?fox</url>
    </image>
    <ttl>1440</ttl>
    <generator>Hugo 0.125.4</generator>
    <language>de-DE</language>
    <lastBuildDate>Wed, 20 May 2026 22:26:11 UT</lastBuildDate>
    <atom:link href="https://this-is-fine.io/tags/bgp/index.xml" rel="self" type="application/rss+xml" />
    <item>
      <title>Cilium BGP and a UniFi UDM-SE as the Lab iBGP Router</title>
      <link>https://this-is-fine.io/posts/20251122-cilium-bgp-unifi-udm/</link>
      <pubDate>Sat, 22 Nov 2025 09:00:00 UT</pubDate>
      <dc:creator>ff0x</dc:creator>
      <guid>https://this-is-fine.io/posts/20251122-cilium-bgp-unifi-udm/</guid>
      <description>You can get MetalLB-style service IPs without MetalLB. Cilium includes a BGP control plane that advertises LoadBalancer addresses on the LAN. The lab peers worker nodes with a UniFi UDM-SE as the default-gateway iBGP peer so phones, laptops, and the tailnet can reach Envoy Gateway VIPs without NodePorts.
Without BGP (or something like MetalLB), a LoadBalancer Service on bare metal often sits Pending forever. Advertising routes into the LAN gateway fixes that: the UDM learns /32 (or the pool) and forwards traffic to the node Cilium chose for the Service.
</description>
      <category domain="https://this-is-fine.io/categories/infrastructure">Infrastructure</category>
      <content:encoded><![CDATA[You can get MetalLB-style service IPs without MetalLB. Cilium includes a BGP control plane that advertises LoadBalancer addresses on the LAN. The lab peers worker nodes with a UniFi UDM-SE as the default-gateway iBGP peer so phones, laptops, and the tailnet can reach Envoy Gateway VIPs without NodePorts.
Without BGP (or something like MetalLB), a LoadBalancer Service on bare metal often sits Pending forever. Advertising routes into the LAN gateway fixes that: the UDM learns /32 (or the pool) and forwards traffic to the node Cilium chose for the Service.
Topology LAN: UniFi UDM-SE (iBGP peer, ASN 65535) iBGP to Talos workers (ASN 64512, bgp-policy=worker) workers advertise LoadBalancer pool 10.103.0.0/28 .0.1 external gateway, .0.2 internal, .0.3 tailnet, ... Controllers are not BGP speakers (bgp-policy: controller); only workers export routes. That matches how the lab uses workers for ingress dataplane traffic while keeping the control plane off the BGP session.
Cilium objects (upstream docs) Resource Role CiliumBGPClusterConfig Local ASN, node selectors, peer discovery CiliumBGPPeerConfig Neighbour capabilities CiliumBGPAdvertisement Export LoadBalancerIP services CiliumLoadBalancerIPPool Service IP CIDR Helm enables bgpControlPlane and l2announcements; GitOps overlays add the CRs and substitute ${CLUSTER_LOAD_BALANCER_CIDR} per cluster.
UniFi side On the UDM-SE, configure BGP to accept ASN 64512 and install learned routes (often /32 or the advertised /28 — steps depend on firmware; see UniFi’s BGP documentation). Cilium auto-discovers the peer via each worker’s default gateway, using CLUSTER_BGP_ROUTER_ADDR in cluster config instead of a static neighbour list per node.
Why it matters in this lab Envoy gateways keep stable .0.1 / .0.2 / .0.3 addresses from one pool. Headscale advertises the same /28 to the tailnet (tag:fabric) so mesh clients reach those VIPs. ARM64 Talos nodes on Turing Pi speak BGP like any other Linux host. Related Envoy gateways — services on those IPs Tailscale mesh — tailnet route approval Lab GitOps — Cilium in the common layer More: Cilium BGP v2, Talos with Cilium.
]]></content:encoded>
    </item>
  </channel>
</rss>
