k.rennerandClaude Opus 4.7
6fe33cbb96
Traefik's LoadBalancer moves from the default-pool (10.2.40.86 / fd40::86, L2-announced) to the BGP-routed off-link pool. Every hostname behind traefik — every *.home.renner.uno, vscode.home.renner.uno, the cluster status page, paperless, immich, etc. — now reaches the ingress via the UDM's BGP-learned routes instead of L2 ARP on the mgmt LAN. This is the lever that takes vscode "fully working via the routed network" — the TLS + DNS access path goes through the same BGP route as the direct bgp-pool LB IPs. Same migration covers every other traefik-fronted service in one step. Companion updates: explicit `external-dns.alpha.kubernetes.io/target` annotations on the pve and test-browser IngressRoutes (Traefik doesn't populate IngressRoute.status.loadBalancer, so the target is hardcoded and has to track the LB IP); the bootstrap.sh / e2e-test.sh smoke-test IPs; a stale code comment in cilium-l2.yaml. The label/annotation pattern matches the ha-vscode migration: chart's `service.labels` sets `lb-pool: bgp` (single Service handles both TCP and UDP for HTTP/3, so one label is enough), and the `io.cilium/lb-ipam-ips` annotation pins the IPs deterministically. external-dns publishes the new IPs to Cloudflare + UniFi DNS providers on its next 60s reconcile cycle after the Service IP flips. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>