refactor(k8s): Reorganize into 5-layer structure with production kustomizations

2026-07-16 14:28:19 -07:00
parent a81b9b6169
commit 2d7330798b
214 changed files with 405 additions and 885 deletions
@@ -0,0 +1,36 @@
+# k8s/cilium/lb-ipam-pool.yaml
+# CiliumLoadBalancerIPPool — tells Cilium LB-IPAM which IPs it can assign
+# to LoadBalancer services in this cluster.
+#
+# CIDR 192.168.1.160/28 covers .160–.175 on the LAN:
+#   .160  talos-cp-1       (node — not assignable to services)
+#   .161  reserved
+#   .162  talos-worker-1   (node — not assignable to services)
+#   .163–.175  free for LoadBalancer services
+#
+# Current service IP assignments (via io.cilium/lb-ipam-ips annotation):
+#   192.168.1.165  forgejo-gitea-http (cicd)
+#   192.168.1.165  forgejo-gitea-ssh  (cicd)  — same IP, different ports
+#   192.168.1.166  shadowsocks        (vpn)
+#
+# Apply once after cluster bootstrap:
+#   kubectl apply -f k8s/cilium/lb-ipam-pool.yaml
+#
+# Verify assignment:
+#   kubectl get svc -n cicd forgejo-gitea-http forgejo-gitea-ssh
+#   # EXTERNAL-IP should change from <pending> to 192.168.1.165
+
+apiVersion: "cilium.io/v2alpha1"
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: homelab-pool
+spec:
+  blocks:
+    - cidr: "192.168.1.160/28"
+    # DO NOT add any 10.6.0.0/24 block here. That is the WireGuard subnet
+    # (10.6.0.1 = talos-cp-1 tunnel IP, 10.6.0.2 = DNS — see
+    # cluster-config/controlplane.yaml). A 10.6.0.x block let Cilium LB-IPAM
+    # auto-assign the CP's own tunnel IP to a Service, which broke the
+    # WireGuard tunnel and locked out the default kubectl context. It also
+    # can't work over WireGuard anyway — L2 announcements only ARP on eno1
+    # (the LAN interface), not wg0. Keep this pool LAN-only.