55 lines
1.6 KiB
YAML
55 lines
1.6 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# Cilium LB IPAM — IP Address Pools
|
|
#
|
|
# Pool 1: ingress-nginx pool — 10.1.71.80 - 10.1.71.89
|
|
# Pool 2: cilium-gateway pool — 10.1.71.90 - 10.1.71.99
|
|
#
|
|
# Pools are separated so ingress-nginx and Gateway API services never
|
|
# compete for the same IPs. Each pool uses a serviceSelector to ensure
|
|
# IPs are only assigned to the right controller.
|
|
# ------------------------------------------------------------------------------
|
|
|
|
# Pool for ingress-nginx LoadBalancer service
|
|
apiVersion: cilium.io/v2alpha1
|
|
kind: CiliumLoadBalancerIPPool
|
|
metadata:
|
|
name: ingress-nginx-pool
|
|
namespace: kube-system
|
|
spec:
|
|
blocks:
|
|
- start: 10.1.71.80
|
|
stop: 10.1.71.89
|
|
serviceSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
|
|
---
|
|
# Pool for Cilium Gateway API — only assigned to Gateway-owned services
|
|
# Cilium automatically labels Gateway services with io.cilium.gateway/owning-gateway
|
|
apiVersion: cilium.io/v2alpha1
|
|
kind: CiliumLoadBalancerIPPool
|
|
metadata:
|
|
name: cilium-gateway-pool
|
|
namespace: kube-system
|
|
spec:
|
|
blocks:
|
|
- start: 10.1.71.90
|
|
stop: 10.1.71.99
|
|
serviceSelector:
|
|
matchExpressions:
|
|
- key: io.cilium.gateway/owning-gateway
|
|
operator: Exists
|
|
|
|
---
|
|
# L2 Announcement Policy — ARP on server VLAN for both pools
|
|
apiVersion: cilium.io/v2alpha1
|
|
kind: CiliumL2AnnouncementPolicy
|
|
metadata:
|
|
name: fastpass-l2-policy
|
|
namespace: kube-system
|
|
spec:
|
|
loadBalancerIPs: true
|
|
# All nodes participate — Cilium handles failover automatically
|
|
interfaces:
|
|
- ^eth[0-9]+
|