Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

infra(net): repoint ansible inventory + Cilium VIPs to the Proxmox LAN

Browse Source 
- ansible hosts.ini: node ansible_host -> 192.168.1.50/.51/.52, with a
  clear note that the PM may need to swap these for the pfSense
  NAT-forwarded address:port once that NAT rule exists (not guessed here).
  k3s_api_host derives from the inventory, so it follows automatically.
- Cilium CiliumLoadBalancerIPPool -> 192.168.1.53-.60 (matches the tofu
  cilium_l2_vip reservation on the new LAN).
- CiliumL2AnnouncementPolicy: broaden interface selector to ^e(n|th) so
  the Proxmox NIC name (ens18/eth0) need not be pinned; flagged
  verify-at-bringup.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-25 10:23:37 -05:00
1 parent 4bb9c8fcbd
commit d57c9cbf12
3 files changed
+21 -12
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

platform-config/cilium/l2-announcement-policy.yaml
+5 -3
View File
@@ -1,8 +1,10 @@
---
# CiliumL2AnnouncementPolicy — ARP-announce LoadBalancer VIPs on the node LAN so hosts on
# 10.73.0.0/24 can reach Gateway listeners at the pool IP (l2announcements.enabled=true in the
# 192.168.1.0/24 can reach Gateway listeners at the pool IP (l2announcements.enabled=true in the
# Cilium HelmRelease turns on the controller; this policy scopes WHAT/WHERE it announces).
# Announces on the primary ethernet interface (cloud-init names it ens3; `^en` matches ens*/enp*).
# Announces on the primary ethernet interface. On Proxmox VMs the NIC is typically ens18/eth0;
# `^e(n|th)` matches ens*/enp*/eth* so the exact name need not be pinned. VERIFY-AT-BRINGUP: if
# announcement fails, confirm the node's primary NIC name (`ip -o link`) matches this selector.
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
@@ -11,7 +13,7 @@ spec:
loadBalancerIPs: true # announce LoadBalancer Service VIPs (Gateway listeners)
externalIPs: false
interfaces:
- ^en
- ^e(n|th)
nodeSelector:
matchLabels:
kubernetes.io/os: linux
platform-config/cilium/l2-ip-pool.yaml
+5 -5
View File
@@ -1,10 +1,10 @@
---
# CiliumLoadBalancerIPPool — reserved VIP range for LoadBalancer Services. Gateway API listeners
# (gatewayClassName: cilium) get their address from here. Range matches the tofu reservation
# (cilium_l2_vip_range 10.73.0.240-.250) on the k3s-dev NAT 10.73.0.0/24; DHCP is OFF on that
# network so the range can never be leased elsewhere.
# (cilium_l2_vip_range 192.168.1.53-.60) on the Proxmox LAN 192.168.1.0/24. These addresses sit
# OUTSIDE the node IPs (.50/.51/.52) and any DHCP scope, so nothing else claims them.
#
# NOTE (dev): the range is hardcoded to the dev NAT reservation. A prod overlay must supply the
# NOTE (dev): the range is hardcoded to the dev LAN reservation. A prod overlay must supply the
# prod LAN range (parameterize via cluster-vars when prod hardware is built). See DECISIONS-LOG.
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
@@ -12,5 +12,5 @@ metadata:
name: default-pool
spec:
blocks:
- start: "10.73.0.240"
stop: "10.73.0.250"
- start: "192.168.1.53"
stop: "192.168.1.60"