k.rennerandClaude Opus 4.7
e7fcc67aa0
Previously only k8s-edge had a v30iot NIC, so any IoT-pool LoadBalancer lease that
elected a different node would GARP on the wrong interfaces and the LB IP would be
unreachable from devices on the IoT VLAN. Attaching v30iot to all k8s VMs lets Cilium L2
elect any node and still win ARP on v30iot from that node.
- opentofu/vm_15{0,1,2}_*.tf: extra_network_bridges = ["v30iot"]
- talos/patches/k8s-{1,2,3}.yaml: switch mgmt selector from `driver: virtio_net` to
`interface: eth0` (driver selector would now match both virtio NICs); add `interface:
eth1` for v30iot with routeMetric=4096 to keep the default route on eth0 (same pattern
as k8s-edge). X710 (i40e) keeps its driver selector and stays correct even if its
kernel name shifts to eth2 after the new virtio NIC inserts.
- infrastructure/post-crds/cilium-l2.yaml: drop nodeSelector pinning the iot policy to
k8s-edge — every node is now a valid announcer.
Apply path: deploy-infrastructure pipeline → tofu plan + manual apply (live virtio
hot-plug, no VM destroy); Talos picks up new NIC + machineconfig on next reconcile.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>