fix(cilium): restrict L2 announcement to control-plane nodes — GPU worker lacks eno1 (Mellanox enp28s0f*), so when it won the .160 lease it couldn't ARP the VIP, black-holing all ingress (flapped on reboots)

terraform/files/cilium/l2-announcement.yaml

@@ -11,3 +11,10 @@ spec:
   loadBalancerIPs: true
   interfaces:
     - eno1
+  # Only control-plane nodes may hold the L2 lease. They have the `eno1` LAN NIC;
+  # the GPU worker's NICs are enp28s0f*np* (Mellanox) with NO eno1 — if it won the
+  # lease it held the LB VIP but couldn't ARP it, turning .160 into a LAN black
+  # hole (cluster-wide outage that flapped as reboots reshuffled the lease).
+  nodeSelector:
+    matchLabels:
+      node-role.kubernetes.io/control-plane: ""