# Apply: kubectl apply -f manifests/multus/10-nad-vlan50.yaml
# Description: Namespace-scoped NetworkAttachmentDefinition for VLAN 50,
#   macvlan bridge mode on nik-debian's enp1s0.50 (ansible/roles/
#   vlan50-parent). macvlan bridge chosen over ipvlan L2 per the
#   home-network handoff confirming the managed switch accepts multiple
#   source MACs on nik-debian's port — see plan.md Phase 4 / the
#   coordination handoff in the session that authored this. sync-wave 1 —
#   after Multus itself (00/01/02), before the canary (20) or any
#   workload attachment.
#
# ipam.type is "static" deliberately, not a shared pool/allocator
# (Whereabouts etc.) — this cluster only ever attaches a handful of fixed
# workloads to VLAN 50 (qBittorrent .10, JDownloader .11, one reserved
# .12, one canary from 10.10.50.100-149), so each pod's own
# k8s.v1.cni.cncf.io/networks annotation supplies its ips/gateway
# directly; there is no dynamic allocation to arbitrate. Excluded from
# any future allocator by simply never being handed to one: .1 (Flint),
# .10/.11/.12 (static workloads), and .100-149 (canary/dynamic) are never
# referenced anywhere else in this repo.
#
# capabilities.ips: true is required by the Network Plumbing Working
# Group CNI spec for a plugin/IPAM combination to accept a runtime-
# supplied "ips" field at all (https://www.cni.dev/plugins/current/ipam/
# static/) — without it at the top level of the NAD config, the per-pod
# k8s.v1.cni.cncf.io/networks annotation's "ips" array is not a
# recognized capability and the static IPAM plugin has no defined way to
# receive it.
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  name: vlan50
  namespace: downloads
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "vlan50",
      "type": "macvlan",
      "master": "enp1s0.50",
      "mode": "bridge",
      "mtu": 1500,
      "capabilities": {
        "ips": true
      },
      "ipam": {
        "type": "static"
      }
    }