# ------------------------------------------------------------------------------
# Cilium LB IPAM — IP Address Pools
#
# Pool 1: ingress-nginx pool  — 10.1.71.80 - 10.1.71.89
# Pool 2: cilium-gateway pool — 10.1.71.90 - 10.1.71.99
#
# Pools are separated so ingress-nginx and Gateway API services never
# compete for the same IPs. Each pool uses a serviceSelector to ensure
# IPs are only assigned to the right controller.
# ------------------------------------------------------------------------------

# Pool for ingress-nginx LoadBalancer service
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
  name: ingress-nginx-pool
  namespace: kube-system
spec:
  blocks:
    - start: 10.1.71.80
      stop: 10.1.71.89
  serviceSelector:
    matchLabels:
      app.kubernetes.io/name: ingress-nginx

---
# Pool for Cilium Gateway API — only assigned to Gateway-owned services
# Cilium automatically labels Gateway services with io.cilium.gateway/owning-gateway
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
  name: cilium-gateway-pool
  namespace: kube-system
spec:
  blocks:
    - start: 10.1.71.90
      stop: 10.1.71.99
  serviceSelector:
    matchExpressions:
      - key: io.cilium.gateway/owning-gateway
        operator: Exists

---
# L2 Announcement Policy — ARP on server VLAN for both pools
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
  name: fastpass-l2-policy
  namespace: kube-system
spec:
  loadBalancerIPs: true
  # All nodes participate — Cilium handles failover automatically
  interfaces:
    - ^eth[0-9]+