k.renner
253ebb04fe
The Cilium L2 announcer leader-elects the lease holder independently of pod locality. With ETP=Local, whenever the lease landed on a node without a local backend (here: lease on k8s-2, pod on k8s-1) the LB IP ARP-resolved successfully but every TCP SYN got RST'd. Same failure mode the wiki documents from the alloy-syslog incident on 2026-05-02. Cluster matches the convention used by every other cross-VLAN LB service in the cluster; the only documented ETP=Local exception is home-assistant on the iot VLAN where v30iot is L2-shared with the nodes. The allow-ftp-scanner CNP permits world+host+remote-node, so the masquerade-induced source-identity shift doesn't break the policy.