Story Crater Bot
18f2f94f8e
- Cilium LB-IPAM pool (192.168.1.160-192.168.1.170) - Fixed IP assignment for LoadBalancer services
37 lines
1.5 KiB
YAML
37 lines
1.5 KiB
YAML
# k8s/cilium/lb-ipam-pool.yaml
|
||
# CiliumLoadBalancerIPPool — tells Cilium LB-IPAM which IPs it can assign
|
||
# to LoadBalancer services in this cluster.
|
||
#
|
||
# CIDR 192.168.1.160/28 covers .160–.175 on the LAN:
|
||
# .160 talos-cp-1 (node — not assignable to services)
|
||
# .161 reserved
|
||
# .162 talos-worker-1 (node — not assignable to services)
|
||
# .163–.175 free for LoadBalancer services
|
||
#
|
||
# Current service IP assignments (via io.cilium/lb-ipam-ips annotation):
|
||
# 192.168.1.165 forgejo-gitea-http (cicd)
|
||
# 192.168.1.165 forgejo-gitea-ssh (cicd) — same IP, different ports
|
||
# 192.168.1.166 shadowsocks (vpn)
|
||
#
|
||
# Apply once after cluster bootstrap:
|
||
# kubectl apply -f k8s/cilium/lb-ipam-pool.yaml
|
||
#
|
||
# Verify assignment:
|
||
# kubectl get svc -n cicd forgejo-gitea-http forgejo-gitea-ssh
|
||
# # EXTERNAL-IP should change from <pending> to 192.168.1.165
|
||
|
||
apiVersion: "cilium.io/v2alpha1"
|
||
kind: CiliumLoadBalancerIPPool
|
||
metadata:
|
||
name: homelab-pool
|
||
spec:
|
||
blocks:
|
||
- cidr: "192.168.1.160/28"
|
||
# DO NOT add any 10.6.0.0/24 block here. That is the WireGuard subnet
|
||
# (10.6.0.1 = talos-cp-1 tunnel IP, 10.6.0.2 = DNS — see
|
||
# cluster-config/controlplane.yaml). A 10.6.0.x block let Cilium LB-IPAM
|
||
# auto-assign the CP's own tunnel IP to a Service, which broke the
|
||
# WireGuard tunnel and locked out the default kubectl context. It also
|
||
# can't work over WireGuard anyway — L2 announcements only ARP on eno1
|
||
# (the LAN interface), not wg0. Keep this pool LAN-only.
|