jakman85andClaude Opus 4.8
d57c9cbf12
- ansible hosts.ini: node ansible_host -> 192.168.1.50/.51/.52, with a clear note that the PM may need to swap these for the pfSense NAT-forwarded address:port once that NAT rule exists (not guessed here). k3s_api_host derives from the inventory, so it follows automatically. - Cilium CiliumLoadBalancerIPPool -> 192.168.1.53-.60 (matches the tofu cilium_l2_vip reservation on the new LAN). - CiliumL2AnnouncementPolicy: broaden interface selector to ^e(n|th) so the Proxmox NIC name (ens18/eth0) need not be pinned; flagged verify-at-bringup. Co-Authored-By: Claude Opus 4.8 <[email protected]>
20 lines
870 B
YAML
20 lines
870 B
YAML
---
|
|
# CiliumL2AnnouncementPolicy — ARP-announce LoadBalancer VIPs on the node LAN so hosts on
|
|
# 192.168.1.0/24 can reach Gateway listeners at the pool IP (l2announcements.enabled=true in the
|
|
# Cilium HelmRelease turns on the controller; this policy scopes WHAT/WHERE it announces).
|
|
# Announces on the primary ethernet interface. On Proxmox VMs the NIC is typically ens18/eth0;
|
|
# `^e(n|th)` matches ens*/enp*/eth* so the exact name need not be pinned. VERIFY-AT-BRINGUP: if
|
|
# announcement fails, confirm the node's primary NIC name (`ip -o link`) matches this selector.
|
|
apiVersion: cilium.io/v2alpha1
|
|
kind: CiliumL2AnnouncementPolicy
|
|
metadata:
|
|
name: default-l2
|
|
spec:
|
|
loadBalancerIPs: true # announce LoadBalancer Service VIPs (Gateway listeners)
|
|
externalIPs: false
|
|
interfaces:
|
|
- ^e(n|th)
|
|
nodeSelector:
|
|
matchLabels:
|
|
kubernetes.io/os: linux
|