From e1d8ecd9e0f2e95da89d0f456230ae422e8ded5d Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Wed, 20 May 2026 21:11:25 +0200 Subject: [PATCH] cilium: remove L2 announcement pool and policy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The iot-pool LoadBalancerIPPool and iot CiliumL2AnnouncementPolicy became orphaned when home-assistant-iot (the only L2-announced Service) was retired in ac57502. No remaining Service uses the iot-vlan label, so the policy never elects a lease holder and the pool never allocates an IP. Moved bgp-pool into cilium-bgp.yaml (it was the only other resource in cilium-l2.yaml) and deleted cilium-l2.yaml entirely; the file's name no longer described its contents. The matter-server, otbr, and shelly-manager macvlan NetworkAttachments still hand-allocate IPs from the 10.2.30.0/24 block — those are outside Cilium IPAM and unaffected by this cleanup. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../infrastructure/post-crds/cilium-bgp.yaml | 25 +++++++ .../infrastructure/post-crds/cilium-l2.yaml | 67 ------------------- .../post-crds/kustomization.yaml | 1 - 3 files changed, 25 insertions(+), 68 deletions(-) delete mode 100644 kubernetes/infrastructure/post-crds/cilium-l2.yaml diff --git a/kubernetes/infrastructure/post-crds/cilium-bgp.yaml b/kubernetes/infrastructure/post-crds/cilium-bgp.yaml index e5a88826..09fb04c6 100644 --- a/kubernetes/infrastructure/post-crds/cilium-bgp.yaml +++ b/kubernetes/infrastructure/post-crds/cilium-bgp.yaml @@ -1,4 +1,29 @@ --- +# BGP-routed LB pool. IPs in this range live on no device VLAN — they +# exist only as BGP advertisements to the UDM (peer + advertisement +# config below; UDM-side FRR at `unifi/bgp.conf`). Devices reach them +# via the UDM's BGP-learned routes; no on-link ARP. This is the home +# for every LB Service in the cluster. +# +# Selector is opt-in via `lb-pool: bgp`. There is no default pool — +# Services without this label do not get a LoadBalancer IP. +# +# IPv4 + IPv6 ranges keep matching last bytes (10.2.99.x ↔ fd99::x) +# so each LB has the same "tail" in both families. +apiVersion: cilium.io/v2alpha1 +kind: CiliumLoadBalancerIPPool +metadata: + name: bgp-pool +spec: + serviceSelector: + matchLabels: + lb-pool: bgp + blocks: + - start: "10.2.99.0" + stop: "10.2.99.255" + - start: "fd99::" + stop: "fd99::ff" +--- # Cilium BGPv2 control-plane config peering each k8s node with the UDM # over its MGMT LAN interface (10.2.40.1) — NOT over v30iot. Control- # plane traffic belongs on the management network; the IoT VLAN is the diff --git a/kubernetes/infrastructure/post-crds/cilium-l2.yaml b/kubernetes/infrastructure/post-crds/cilium-l2.yaml deleted file mode 100644 index b55279b3..00000000 --- a/kubernetes/infrastructure/post-crds/cilium-l2.yaml +++ /dev/null @@ -1,67 +0,0 @@ -# IoT VLAN pool — exists specifically so home-assistant-iot lives on the -# v30iot subnet itself. IoT devices reach HA on-link via L2 (no UDM L3 -# routing, no inter-VLAN firewall rule), which is the whole point of -# this LB existing instead of being collapsed into the bgp-pool. -# -# Range .80-.89 — historically allocated as: -# .80 — home-assistant-iot (only current allocation; the design intent) -# .81 — mosquitto (migrated to bgp-pool 2026-05-19; clients now reach -# mqtt.renner.uno → 10.2.99.81 via BGP through the UDM) -# .226 — matter-server (multus macvlan net1, *not* a Cilium LB; see -# kubernetes/apps/matter-server/network-attachment.yaml) -# .227 — otbr (multus macvlan net1, *not* a Cilium LB) -# .226/.227 sit outside the pool block but are listed here so the -# documented ledger stays single-source. -apiVersion: cilium.io/v2alpha1 -kind: CiliumLoadBalancerIPPool -metadata: - name: iot-pool -spec: - serviceSelector: - matchLabels: - iot-vlan: "true" - blocks: - - start: 10.2.30.80 - stop: 10.2.30.89 ---- -apiVersion: cilium.io/v2alpha1 -kind: CiliumL2AnnouncementPolicy -metadata: - name: iot -spec: - loadBalancerIPs: true - serviceSelector: - matchLabels: - iot-vlan: "true" - # All k8s nodes have a v30iot NIC (see opentofu/vm_15{0,1,2,3}_*.tf - # and patches/k8s-{1,2,3,edge}.yaml), so the lease can land on any of - # them. With only one Service in the pool, lease churn is minimal. - interfaces: - - ^eth[0-9]+ ---- -# BGP-routed off-link LB pool. IPs in this range live on no device VLAN — -# they exist only as BGP advertisements to the UDM (see cilium-bgp.yaml -# and unifi/bgp.conf). Devices reach them via the UDM's BGP-learned -# routes; no on-link ARP. This is the home for every LB Service that -# does NOT need direct on-link L2 presence in a device VLAN. -# -# Selector is opt-in via `lb-pool: bgp`. Default-pool was deleted in -# the same change that landed this end state — Services that pick -# neither this label nor the `iot-vlan` label have no eligible pool -# and won't get a LoadBalancer IP. -# -# IPv4 + IPv6 ranges keep matching last bytes (10.2.99.x ↔ fd99::x) -# so an LB has the same "tail" in both families. -apiVersion: cilium.io/v2alpha1 -kind: CiliumLoadBalancerIPPool -metadata: - name: bgp-pool -spec: - serviceSelector: - matchLabels: - lb-pool: bgp - blocks: - - start: "10.2.99.0" - stop: "10.2.99.255" - - start: "fd99::" - stop: "fd99::ff" diff --git a/kubernetes/infrastructure/post-crds/kustomization.yaml b/kubernetes/infrastructure/post-crds/kustomization.yaml index 10e4e96f..e72198fa 100644 --- a/kubernetes/infrastructure/post-crds/kustomization.yaml +++ b/kubernetes/infrastructure/post-crds/kustomization.yaml @@ -3,7 +3,6 @@ kind: Kustomization resources: - clusterissuer.yaml - cloudflare-secret.sops.yaml - - cilium-l2.yaml - cilium-bgp.yaml - cnpg-barman-certs.yaml - velero-schedules.yaml