k8s-starter-pack/apps/metallb.yaml

# MetalLB, installed like any other app: an Application pointing at
# apps/metallb, a Helm chart (see apps/metallb/Chart.yaml) that pulls in the
# upstream chart and carries this cluster's IPAddressPool, BGPPeer, and
# BGPAdvertisement templates. Together they let the MikroTik route dedicated
# 10.10.60.x addresses to LoadBalancer Services—something bare-metal
# Kubernetes does not provide on its own. See docs/05-metallb.md.
#
# Everything — MetalLB's own resources (including its CRDs) and our two
# custom resources that depend on them — comes from this one Application,
# in one sync. The ordering that makes that safe lives on the individual
# resources in apps/metallb/templates/, via the
# argocd.argoproj.io/sync-wave annotation: MetalLB's chart resources apply
# at the default wave ("0"), and our IPAddressPool/L2Advertisement are
# marked wave "1" so Argo CD waits for MetalLB to be synced and healthy
# (CRDs registered, controller and speaker running) before applying them.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: metallb
  namespace: argocd
  # Without this finalizer, deleting this Application object only makes
  # Argo CD forget about its resources — MetalLB's Pods, CRDs, and our
  # BGPPeer/BGPAdvertisement would keep running, orphaned. This finalizer
  # makes deletion cascade properly. Safe here because MetalLB holds no
  # data of its own — contrast with apps/longhorn.yaml below.
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default

  source:
    repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git
    targetRevision: main
    path: apps/metallb

  destination:
    server: https://kubernetes.default.svc
    namespace: metallb-system

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    # MetalLB's speaker and FRR Pods use host networking and Linux network
    # capabilities so they can establish BGP sessions. Kubernetes' baseline
    # Pod Security policy rejects those by design; privilege is scoped to this
    # dedicated namespace rather than weakened cluster-wide.
    managedNamespaceMetadata:
      labels:
        pod-security.kubernetes.io/enforce: privileged
        pod-security.kubernetes.io/audit: privileged
        pod-security.kubernetes.io/warn: privileged
    syncOptions:
      - CreateNamespace=true