Nik Afiq
e980fcb755
Some checks failed
validate / lint (push) Failing after 1s
CRD, RBAC, thick-plugin DaemonSet (nik-debian only, k3s CNI paths, digest-pinned), the VLAN 50 NAD (macvlan bridge on enp1s0.50), the shared pod egress-guard script, a temporary canary pod, and the not-yet-deployed browser-vpn-proxy workload (kept in reserved/, outside this Application's non-recursive source path). Referenced by argocd/apps/multus.yaml (already pushed) but not deployed by it — that Application has no syncPolicy.automated, so this still needs an explicit selective sync per resource. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
49 lines
2.0 KiB
YAML
49 lines
2.0 KiB
YAML
# Apply: kubectl apply -f manifests/multus/10-nad-vlan50.yaml
|
|
# Description: Namespace-scoped NetworkAttachmentDefinition for VLAN 50,
|
|
# macvlan bridge mode on nik-debian's enp1s0.50 (ansible/roles/
|
|
# vlan50-parent). macvlan bridge chosen over ipvlan L2 per the
|
|
# home-network handoff confirming the managed switch accepts multiple
|
|
# source MACs on nik-debian's port — see plan.md Phase 4 / the
|
|
# coordination handoff in the session that authored this. sync-wave 1 —
|
|
# after Multus itself (00/01/02), before the canary (20) or any
|
|
# workload attachment.
|
|
#
|
|
# ipam.type is "static" deliberately, not a shared pool/allocator
|
|
# (Whereabouts etc.) — this cluster only ever attaches a handful of fixed
|
|
# workloads to VLAN 50 (qBittorrent .10, JDownloader .11, one reserved
|
|
# .12, one canary from 10.10.50.100-149), so each pod's own
|
|
# k8s.v1.cni.cncf.io/networks annotation supplies its ips/gateway
|
|
# directly; there is no dynamic allocation to arbitrate. Excluded from
|
|
# any future allocator by simply never being handed to one: .1 (Flint),
|
|
# .10/.11/.12 (static workloads), and .100-149 (canary/dynamic) are never
|
|
# referenced anywhere else in this repo.
|
|
#
|
|
# capabilities.ips: true is required by the Network Plumbing Working
|
|
# Group CNI spec for a plugin/IPAM combination to accept a runtime-
|
|
# supplied "ips" field at all (https://www.cni.dev/plugins/current/ipam/
|
|
# static/) — without it at the top level of the NAD config, the per-pod
|
|
# k8s.v1.cni.cncf.io/networks annotation's "ips" array is not a
|
|
# recognized capability and the static IPAM plugin has no defined way to
|
|
# receive it.
|
|
apiVersion: k8s.cni.cncf.io/v1
|
|
kind: NetworkAttachmentDefinition
|
|
metadata:
|
|
name: vlan50
|
|
namespace: downloads
|
|
spec:
|
|
config: |
|
|
{
|
|
"cniVersion": "0.3.1",
|
|
"name": "vlan50",
|
|
"type": "macvlan",
|
|
"master": "enp1s0.50",
|
|
"mode": "bridge",
|
|
"mtu": 1500,
|
|
"capabilities": {
|
|
"ips": true
|
|
},
|
|
"ipam": {
|
|
"type": "static"
|
|
}
|
|
}
|