Traefik's LoadBalancer moves from the default-pool (10.2.40.86 / fd40::86,
L2-announced) to the BGP-routed off-link pool. Every hostname behind
traefik — every *.home.renner.uno, vscode.home.renner.uno, the cluster
status page, paperless, immich, etc. — now reaches the ingress via the
UDM's BGP-learned routes instead of L2 ARP on the mgmt LAN.
This is the lever that takes vscode "fully working via the routed
network" — the TLS + DNS access path goes through the same BGP route
as the direct bgp-pool LB IPs. Same migration covers every other
traefik-fronted service in one step.
Companion updates: explicit `external-dns.alpha.kubernetes.io/target`
annotations on the pve and test-browser IngressRoutes (Traefik doesn't
populate IngressRoute.status.loadBalancer, so the target is hardcoded
and has to track the LB IP); the bootstrap.sh / e2e-test.sh smoke-test
IPs; a stale code comment in cilium-l2.yaml.
The label/annotation pattern matches the ha-vscode migration: chart's
`service.labels` sets `lb-pool: bgp` (single Service handles both TCP
and UDP for HTTP/3, so one label is enough), and the
`io.cilium/lb-ipam-ips` annotation pins the IPs deterministically.
external-dns publishes the new IPs to Cloudflare + UniFi DNS providers
on its next 60s reconcile cycle after the Service IP flips.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.7
6fe33cbb96