From a2e97e8cd376fc932355a5b28cd7374f05b95e0e Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 13 Aug 2026 07:58:12 -0700
Subject: [PATCH] =?UTF-8?q?fix(cilium):=20restrict=20L2=20announcement=20t?=
 =?UTF-8?q?o=20control-plane=20nodes=20=E2=80=94=20GPU=20worker=20lacks=20?=
 =?UTF-8?q?eno1=20(Mellanox=20enp28s0f*),=20so=20when=20it=20won=20the=20.?=
 =?UTF-8?q?160=20lease=20it=20couldn't=20ARP=20the=20VIP,=20black-holing?=
 =?UTF-8?q?=20all=20ingress=20(flapped=20on=20reboots)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 terraform/files/cilium/l2-announcement.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/terraform/files/cilium/l2-announcement.yaml b/terraform/files/cilium/l2-announcement.yaml
index a3ba764..3e95db6 100644
--- a/terraform/files/cilium/l2-announcement.yaml
+++ b/terraform/files/cilium/l2-announcement.yaml
@@ -11,3 +11,10 @@ spec:
   loadBalancerIPs: true
   interfaces:
     - eno1
+  # Only control-plane nodes may hold the L2 lease. They have the `eno1` LAN NIC;
+  # the GPU worker's NICs are enp28s0f*np* (Mellanox) with NO eno1 — if it won the
+  # lease it held the LB VIP but couldn't ARP it, turning .160 into a LAN black
+  # hole (cluster-wide outage that flapped as reboots reshuffled the lease).
+  nodeSelector:
+    matchLabels:
+      node-role.kubernetes.io/control-plane: ""