From 3b812ed476b06dcb84939679159abe374c4f4bd5 Mon Sep 17 00:00:00 2001
From: Vegard Hagen <vegard@stonegarden.dev>
Date: Fri, 14 Nov 2025 19:45:34 +0100
Subject: [PATCH] fix(cilium): turn on l2-announcements (ARP) again to
 troubleshoot connection problems

I'm experiencing issues reaching services directly exposed to the internet

At first only some carriers didn't load the pages, but it appears to be getting worse somehow

Signed-off-by: Vegard Hagen <vegard@stonegarden.dev>
---
 k8s/infra/network/cilium/kustomization.yaml |  2 ++
 k8s/infra/network/cilium/l2-announce.yaml   |  8 ++++++++
 k8s/infra/network/cilium/l2-ip-pool.yaml    | 11 +++++++++++
 k8s/infra/network/cilium/values.yaml        |  7 +++++++
 k8s/infra/network/gateway/gw-external.yaml  |  3 +++
 5 files changed, 31 insertions(+)
 create mode 100644 k8s/infra/network/cilium/l2-announce.yaml
 create mode 100644 k8s/infra/network/cilium/l2-ip-pool.yaml

diff --git a/k8s/infra/network/cilium/kustomization.yaml b/k8s/infra/network/cilium/kustomization.yaml
index cfe8749..98a4293 100644
--- a/k8s/infra/network/cilium/kustomization.yaml
+++ b/k8s/infra/network/cilium/kustomization.yaml
@@ -9,6 +9,8 @@ resources:
   - bgp-cluster-config.yaml
   - dashboards/cilium.yaml
   - dashboards/cilium-operator.yaml
+  - l2-announce.yaml
+  - l2-ip-pool.yaml
 
 helmCharts:
   - name: cilium
diff --git a/k8s/infra/network/cilium/l2-announce.yaml b/k8s/infra/network/cilium/l2-announce.yaml
new file mode 100644
index 0000000..14f52b2
--- /dev/null
+++ b/k8s/infra/network/cilium/l2-announce.yaml
@@ -0,0 +1,8 @@
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: default-l2-announcement-policy
+  namespace: kube-system
+spec:
+  externalIPs: true
+  loadBalancerIPs: true
diff --git a/k8s/infra/network/cilium/l2-ip-pool.yaml b/k8s/infra/network/cilium/l2-ip-pool.yaml
new file mode 100644
index 0000000..2265203
--- /dev/null
+++ b/k8s/infra/network/cilium/l2-ip-pool.yaml
@@ -0,0 +1,11 @@
+apiVersion: cilium.io/v2
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: first-pool
+spec:
+  blocks:
+    - start: 192.168.1.220
+      stop: 192.168.1.255
+  serviceSelector:
+    matchLabels:
+      l2.cilium.io/ip-pool: default
diff --git a/k8s/infra/network/cilium/values.yaml b/k8s/infra/network/cilium/values.yaml
index 28a623b..d7dcf03 100644
--- a/k8s/infra/network/cilium/values.yaml
+++ b/k8s/infra/network/cilium/values.yaml
@@ -58,6 +58,13 @@ resources:
 #debug:
 #  enabled: true
 
+k8sClientRateLimit:
+  qps: 20
+  burst: 100
+
+l2announcements:
+  enabled: true
+
 # https://docs.cilium.io/en/latest/network/bgp-control-plane/bgp-control-plane-v2/
 bgpControlPlane:
   enabled: true
diff --git a/k8s/infra/network/gateway/gw-external.yaml b/k8s/infra/network/gateway/gw-external.yaml
index 12779fd..b950f5f 100644
--- a/k8s/infra/network/gateway/gw-external.yaml
+++ b/k8s/infra/network/gateway/gw-external.yaml
@@ -9,9 +9,12 @@ spec:
     labels:
       bgp.cilium.io/advertise-service: default
       bgp.cilium.io/ip-pool: default
+      l2.cilium.io/ip-pool: default
   addresses:
     - type: IPAddress
       value: 172.20.10.110
+    - type: IPAddress
+      value: 192.168.1.222
   listeners:
     - protocol: HTTPS
       port: 443