---
# CiliumLoadBalancerIPPool — reserved VIP range for LoadBalancer Services. Gateway API listeners
# (gatewayClassName: cilium) get their address from here. The range must match the environment's tofu
# reservation (cilium_l2_vip_range) and sit OUTSIDE the node IPs and any DHCP scope, so nothing else
# claims them.
#
# R-ENV-02: the range was HARDCODED to the dev LAN (192.168.1.53-.60 on the Proxmox LAN 192.168.1.0/24,
# nodes .50/.51/.52) until 2026-08-31; it is now ${CILIUM_LB_POOL_START}..${CILIUM_LB_POOL_STOP} from
# cluster-vars, substituted by the `platform-config` Flux Kustomization.
#
# CONTAINMENT INVARIANT — ${GATEWAY_VIP} MUST be inside this block, and in practice EQUAL to
# ${CILIUM_LB_POOL_START}. The `shared` Gateway (platform/gateway/gateway.yaml) pins NOTHING: it has
# no `lbipam.cilium.io/ips` annotation and no spec.addresses (unlike platform/crafty/service-l4.yaml
# and apps/vms/unifi/50-service-l4.yaml, which DO pin). Cilium's Gateway controller creates a
# `cilium-gateway-shared` LoadBalancer Service and LB-IPAM assigns it the FIRST FREE address of a
# matching pool block — so the Gateway lands on POOL_START, and dev's GATEWAY_VIP (.53) IS dev's
# POOL_START (.53-.60). A GATEWAY_VIP outside every pool is NOT allocatable: the Gateway would come
# up on POOL_START anyway while split-horizon coredns-custom keeps answering *.home.keithjackson.dev
# with the unannounced GATEWAY_VIP, blackholing in-cluster hairpin traffic while looking healthy.
#
# RESOLVED (operator, 2026-08-31): the invariant holds in BOTH environments. An earlier prod
# proposal put GATEWAY_VIP .20 outside a .21-.30 pool; the operator widened the prod pool to
# 192.168.2.20-.30 so GATEWAY_VIP (.20) IS prod's POOL_START, exactly as dev's .53 is dev's.
# Prod's kube-vip CONTROL-PLANE VIP (192.168.2.9) sits deliberately BELOW the pool so kube-vip
# and LB-IPAM can never contend for an address.
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
  name: default-pool
spec:
  blocks:
    - start: "${CILIUM_LB_POOL_START}"
      stop: "${CILIUM_LB_POOL_STOP}"