---
# CiliumL2AnnouncementPolicy — ARP-announce LoadBalancer VIPs on the node LAN so LAN hosts (dev
# 192.168.1.0/24, prod 192.168.2.0/24) can reach Gateway listeners at the pool IP. The RANGE itself
# is env-scoped in l2-ip-pool.yaml via CILIUM_LB_POOL_START/STOP; this policy is env-agnostic and
# needs no cluster-vars knob (l2announcements.enabled=true in the
# Cilium HelmRelease turns on the controller; this policy scopes WHAT/WHERE it announces).
# Announces on the primary ethernet interface. On Proxmox VMs the NIC is typically ens18/eth0;
# `^e(n|th)` matches ens*/enp*/eth* so the exact name need not be pinned. VERIFY-AT-BRINGUP: if
# announcement fails, confirm the node's primary NIC name (`ip -o link`) matches this selector.
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
  name: default-l2
spec:
  loadBalancerIPs: true       # announce LoadBalancer Service VIPs (Gateway listeners)
  externalIPs: false
  interfaces:
    - ^e(n|th)
  nodeSelector:
    matchLabels:
      kubernetes.io/os: linux