cilium: remove L2 announcement pool and policy

The iot-pool LoadBalancerIPPool and iot CiliumL2AnnouncementPolicy
became orphaned when home-assistant-iot (the only L2-announced
Service) was retired in ac57502. No remaining Service uses the
iot-vlan label, so the policy never elects a lease holder and the
pool never allocates an IP.

Moved bgp-pool into cilium-bgp.yaml (it was the only other resource
in cilium-l2.yaml) and deleted cilium-l2.yaml entirely; the file's
name no longer described its contents. The matter-server, otbr, and
shelly-manager macvlan NetworkAttachments still hand-allocate IPs
from the 10.2.30.0/24 block — those are outside Cilium IPAM and
unaffected by this cleanup.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/infrastructure/post-crds/cilium-bgp.yaml

@@ -1,4 +1,29 @@
 ---
+# BGP-routed LB pool. IPs in this range live on no device VLAN — they
+# exist only as BGP advertisements to the UDM (peer + advertisement
+# config below; UDM-side FRR at `unifi/bgp.conf`). Devices reach them
+# via the UDM's BGP-learned routes; no on-link ARP. This is the home
+# for every LB Service in the cluster.
+#
+# Selector is opt-in via `lb-pool: bgp`. There is no default pool —
+# Services without this label do not get a LoadBalancer IP.
+#
+# IPv4 + IPv6 ranges keep matching last bytes (10.2.99.x ↔ fd99::x)
+# so each LB has the same "tail" in both families.
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: bgp-pool
+spec:
+  serviceSelector:
+    matchLabels:
+      lb-pool: bgp
+  blocks:
+    - start: "10.2.99.0"
+      stop: "10.2.99.255"
+    - start: "fd99::"
+      stop: "fd99::ff"
+---
 # Cilium BGPv2 control-plane config peering each k8s node with the UDM
 # over its MGMT LAN interface (10.2.40.1) — NOT over v30iot. Control-
 # plane traffic belongs on the management network; the IoT VLAN is the

kubernetes/infrastructure/post-crds/cilium-l2.yaml

@@ -1,67 +0,0 @@
-# IoT VLAN pool — exists specifically so home-assistant-iot lives on the
-# v30iot subnet itself. IoT devices reach HA on-link via L2 (no UDM L3
-# routing, no inter-VLAN firewall rule), which is the whole point of
-# this LB existing instead of being collapsed into the bgp-pool.
-#
-# Range .80-.89 — historically allocated as:
-#   .80 — home-assistant-iot (only current allocation; the design intent)
-#   .81 — mosquitto (migrated to bgp-pool 2026-05-19; clients now reach
-#         mqtt.renner.uno → 10.2.99.81 via BGP through the UDM)
-#   .226 — matter-server (multus macvlan net1, *not* a Cilium LB; see
-#          kubernetes/apps/matter-server/network-attachment.yaml)
-#   .227 — otbr (multus macvlan net1, *not* a Cilium LB)
-# .226/.227 sit outside the pool block but are listed here so the
-# documented ledger stays single-source.
-apiVersion: cilium.io/v2alpha1
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: iot-pool
-spec:
-  serviceSelector:
-    matchLabels:
-      iot-vlan: "true"
-  blocks:
-    - start: 10.2.30.80
-      stop: 10.2.30.89
----
-apiVersion: cilium.io/v2alpha1
-kind: CiliumL2AnnouncementPolicy
-metadata:
-  name: iot
-spec:
-  loadBalancerIPs: true
-  serviceSelector:
-    matchLabels:
-      iot-vlan: "true"
-  # All k8s nodes have a v30iot NIC (see opentofu/vm_15{0,1,2,3}_*.tf
-  # and patches/k8s-{1,2,3,edge}.yaml), so the lease can land on any of
-  # them. With only one Service in the pool, lease churn is minimal.
-  interfaces:
-    - ^eth[0-9]+
----
-# BGP-routed off-link LB pool. IPs in this range live on no device VLAN —
-# they exist only as BGP advertisements to the UDM (see cilium-bgp.yaml
-# and unifi/bgp.conf). Devices reach them via the UDM's BGP-learned
-# routes; no on-link ARP. This is the home for every LB Service that
-# does NOT need direct on-link L2 presence in a device VLAN.
-#
-# Selector is opt-in via `lb-pool: bgp`. Default-pool was deleted in
-# the same change that landed this end state — Services that pick
-# neither this label nor the `iot-vlan` label have no eligible pool
-# and won't get a LoadBalancer IP.
-#
-# IPv4 + IPv6 ranges keep matching last bytes (10.2.99.x ↔ fd99::x)
-# so an LB has the same "tail" in both families.
-apiVersion: cilium.io/v2alpha1
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: bgp-pool
-spec:
-  serviceSelector:
-    matchLabels:
-      lb-pool: bgp
-  blocks:
-    - start: "10.2.99.0"
-      stop: "10.2.99.255"
-    - start: "fd99::"
-      stop: "fd99::ff"

kubernetes/infrastructure/post-crds/kustomization.yaml

@@ -3,7 +3,6 @@ kind: Kustomization
 resources:
   - clusterissuer.yaml
   - cloudflare-secret.sops.yaml
-  - cilium-l2.yaml
   - cilium-bgp.yaml
   - cnpg-barman-certs.yaml
   - velero-schedules.yaml