fix(cilium): restrict L2 announcement to control-plane nodes — GPU worker lacks eno1 (Mellanox enp28s0f*), so when it won the .160 lease it couldn't ARP the VIP, black-holing all ingress (flapped on reboots)

2026-08-18 15:08:04 -07:00
parent 5467d2ff6a
commit 2866a2aa93
1 changed files with 7 additions and 0 deletions
@@ -11,3 +11,10 @@ spec:
  loadBalancerIPs: true
  interfaces:
    - eno1
+  # Only control-plane nodes may hold the L2 lease. They have the `eno1` LAN NIC;
+  # the GPU worker's NICs are enp28s0f*np* (Mellanox) with NO eno1 — if it won the
+  # lease it held the LB VIP but couldn't ARP it, turning .160 into a LAN black
+  # hole (cluster-wide outage that flapped as reboots reshuffled the lease).
+  nodeSelector:
+    matchLabels:
+      node-role.kubernetes.io/control-plane: ""