---
# CiliumL2AnnouncementPolicy — ARP-announce LoadBalancer VIPs on the node LAN so hosts on
# 10.73.0.0/24 can reach Gateway listeners at the pool IP (l2announcements.enabled=true in the
# Cilium HelmRelease turns on the controller; this policy scopes WHAT/WHERE it announces).
# Announces on the primary ethernet interface (cloud-init names it ens3; `^en` matches ens*/enp*).
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
  name: default-l2
spec:
  loadBalancerIPs: true       # announce LoadBalancer Service VIPs (Gateway listeners)
  externalIPs: false
  interfaces:
    - ^en
  nodeSelector:
    matchLabels:
      kubernetes.io/os: linux