refactor(k8s): Reorganize into 5-layer structure with production kustomizations

k8s/bootstrap/cilium/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources: []
+# Cilium deployed via Helm chart

k8s/bootstrap/cilium/l2-announcement-policy.yaml

@@ -0,0 +1,39 @@
+# k8s/cilium/l2-announcement-policy.yaml
+# CiliumL2AnnouncementPolicy — without this, LB-IPAM (lb-ipam-pool.yaml)
+# assigns IPs to LoadBalancer Services but nothing ARPs for them on the LAN,
+# so they're unreachable from outside the cluster even though `kubectl get
+# svc` shows a real EXTERNAL-IP. Confirmed both forgejo's .165 and
+# shadowsocks' .166 were 100% packet loss / incomplete ARP before this.
+#
+# loadBalancerIPs: true makes Cilium announce every Service's LB-IPAM IP via
+# ARP from whichever node currently holds the lease for it (one node per IP,
+# decided by leaderElection — not all nodes simultaneously, which would
+# otherwise cause ARP flapping/duplicate-IP confusion on the LAN).
+#
+# externalIPs/loadBalancerIPs split exists because Cilium also supports
+# announcing Service externalIPs (a different field, unused in this repo);
+# we only need loadBalancerIPs since every exposed Service here is type
+# LoadBalancer via lb-ipam-pool.yaml.
+#
+# requires kube-proxy replacement (already the case — see
+# k8s/talos-iam or helmfile.yaml.gotmpl kubeProxyReplacement=true) and a
+# Cilium build with L2 announcements enabled (default since v1.14).
+#
+# Apply once after cluster bootstrap, alongside lb-ipam-pool.yaml:
+#   kubectl apply -f k8s/cilium/l2-announcement-policy.yaml
+#
+# Verify:
+#   kubectl get ciliuml2announcementpolicy
+#   ping 192.168.1.165 && ping 192.168.1.166   # both should now respond
+#   arp -a | grep 192.168.1.16                 # should resolve to a real MAC
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: homelab-l2-announce
+spec:
+  loadBalancerIPs: true
+  interfaces:
+    - eno1
+  # No nodeSelector restriction — all 3 nodes already run workloads
+  # (allowSchedulingOnControlPlanes: true in controlplane.yaml), and with
+  # 3 zone-labeled nodes, redundancy for per-IP leader election is maintained.

k8s/bootstrap/cilium/lb-ipam-pool.yaml

@@ -0,0 +1,36 @@
+# k8s/cilium/lb-ipam-pool.yaml
+# CiliumLoadBalancerIPPool — tells Cilium LB-IPAM which IPs it can assign
+# to LoadBalancer services in this cluster.
+#
+# CIDR 192.168.1.160/28 covers .160–.175 on the LAN:
+#   .160  talos-cp-1       (node — not assignable to services)
+#   .161  reserved
+#   .162  talos-worker-1   (node — not assignable to services)
+#   .163–.175  free for LoadBalancer services
+#
+# Current service IP assignments (via io.cilium/lb-ipam-ips annotation):
+#   192.168.1.165  forgejo-gitea-http (cicd)
+#   192.168.1.165  forgejo-gitea-ssh  (cicd)  — same IP, different ports
+#   192.168.1.166  shadowsocks        (vpn)
+#
+# Apply once after cluster bootstrap:
+#   kubectl apply -f k8s/cilium/lb-ipam-pool.yaml
+#
+# Verify assignment:
+#   kubectl get svc -n cicd forgejo-gitea-http forgejo-gitea-ssh
+#   # EXTERNAL-IP should change from <pending> to 192.168.1.165
+
+apiVersion: "cilium.io/v2alpha1"
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: homelab-pool
+spec:
+  blocks:
+    - cidr: "192.168.1.160/28"
+    # DO NOT add any 10.6.0.0/24 block here. That is the WireGuard subnet
+    # (10.6.0.1 = talos-cp-1 tunnel IP, 10.6.0.2 = DNS — see
+    # cluster-config/controlplane.yaml). A 10.6.0.x block let Cilium LB-IPAM
+    # auto-assign the CP's own tunnel IP to a Service, which broke the
+    # WireGuard tunnel and locked out the default kubectl context. It also
+    # can't work over WireGuard anyway — L2 announcements only ARP on eno1
+    # (the LAN interface), not wg0. Keep this pool LAN-only.