# CiliumL2AnnouncementPolicy — ARPs each LoadBalancer IP (from lb-ippool) on the
# LAN so the EXTERNAL-IP is actually reachable. Without it, LB-IPAM assigns IPs
# but nothing answers ARP (100% packet loss / incomplete ARP). One node per IP
# holds the lease (leaderElection) to avoid ARP flapping. Requires kube-proxy
# replacement (enabled) and Cilium L2 announcements (default since v1.14).
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
  name: homelab-l2-announce
spec:
  loadBalancerIPs: true
  interfaces:
    - eno1
  # Only control-plane nodes may hold the L2 lease. They have the `eno1` LAN NIC;
  # the GPU worker's NICs are enp28s0f*np* (Mellanox) with NO eno1 — if it won the
  # lease it held the LB VIP but couldn't ARP it, turning .160 into a LAN black
  # hole (cluster-wide outage that flapped as reboots reshuffled the lease).
  nodeSelector:
    matchLabels:
      node-role.kubernetes.io/control-plane: ""