# Establishes one external BGP session from each labelled worker to the
# MikroTik RB5009. BGP (Border Gateway Protocol) lets the workers advertise
# service IP routes from the dedicated 10.10.60.0/24 range even though their
# own interfaces remain in 10.10.10.0/24.
#
# The node selector deliberately excludes the Raspberry Pi control planes.
# Both workers share private ASN 64520 and peer with the router's private ASN
# 64512. The router supports ECMP, so it can retain equal-cost routes through
# both workers when both advertise the same Service address.
#
# No BGP password is used on this trusted internal network. Never add one in
# plaintext here: this repository is public, so authentication would require
# a separately managed Kubernetes Secret.
apiVersion: metallb.io/v1beta2
kind: BGPPeer
metadata:
  name: mikrotik
  namespace: metallb-system
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  myASN: 64520
  peerASN: 64512
  peerAddress: 10.10.10.1
  nodeSelectors:
    - matchLabels:
        node-role.kubernetes.io/worker: worker