# k8s/cilium/lb-ipam-pool.yaml
# CiliumLoadBalancerIPPool — tells Cilium LB-IPAM which IPs it can assign
# to LoadBalancer services in this cluster.
#
# CIDR 192.168.1.160/28 covers .160–.175 on the LAN:
#   .160  talos-cp-1       (node — not assignable to services)
#   .161  reserved
#   .162  talos-worker-1   (node — not assignable to services)
#   .163–.175  free for LoadBalancer services
#
# Current service IP assignments (via io.cilium/lb-ipam-ips annotation):
#   192.168.1.165  forgejo-gitea-http (cicd)
#   192.168.1.165  forgejo-gitea-ssh  (cicd)  — same IP, different ports
#   192.168.1.166  shadowsocks        (vpn)
#
# Apply once after cluster bootstrap:
#   kubectl apply -f k8s/cilium/lb-ipam-pool.yaml
#
# Verify assignment:
#   kubectl get svc -n cicd forgejo-gitea-http forgejo-gitea-ssh
#   # EXTERNAL-IP should change from <pending> to 192.168.1.165

apiVersion: "cilium.io/v2alpha1"
kind: CiliumLoadBalancerIPPool
metadata:
  name: homelab-pool
spec:
  blocks:
    - cidr: "192.168.1.160/28"
    # DO NOT add any 10.6.0.0/24 block here. That is the WireGuard subnet
    # (10.6.0.1 = talos-cp-1 tunnel IP, 10.6.0.2 = DNS — see
    # cluster-config/controlplane.yaml). A 10.6.0.x block let Cilium LB-IPAM
    # auto-assign the CP's own tunnel IP to a Service, which broke the
    # WireGuard tunnel and locked out the default kubectl context. It also
    # can't work over WireGuard anyway — L2 announcements only ARP on eno1
    # (the LAN interface), not wg0. Keep this pool LAN-only.