# ─── Cilium IP pools — fastpass cluster ──────────────────────────────────────
# Apply AFTER Cilium is healthy:
#   kubectl apply -f talos/cilium/ip-pools.yaml
#
# NOTE: CRD API version must be cilium.io/v2 (not v1alpha1/v1beta1).
# Using the wrong version causes silent failures — pool is created but
# never activates. Verify with: kubectl get ciliumloadbalancerippool
# ─────────────────────────────────────────────────────────────────────────────

---
# Pool for ingress-nginx — primary ingress controller
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
  name: ingress-nginx-pool
spec:
  blocks:
    - start: "10.1.71.80"
      stop:  "10.1.71.89"

---
# Pool for Cilium Gateway API — secondary/future ingress path
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
  name: cilium-gateway-pool
spec:
  blocks:
    - start: "10.1.71.90"
      stop:  "10.1.71.99"

---
# L2 announcement policy — advertise IPs from both pools on VLAN 71
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
  name: default-l2-policy
spec:
  # Announce all LoadBalancer IPs from both pools
  loadBalancerIPs: true
  # Scope to all nodes (no node selector = cluster-wide)
  nodeSelector:
    matchLabels: {}
  interfaces:
    - ens18