32 lines
1.3 KiB
YAML
32 lines
1.3 KiB
YAML
# Establishes one external BGP session from each labelled worker to the
|
|
# MikroTik RB5009. BGP (Border Gateway Protocol) lets the workers advertise
|
|
# service IP routes from the dedicated 10.10.60.0/24 range even though their
|
|
# own interfaces remain in 10.10.10.0/24.
|
|
#
|
|
# The node selector deliberately excludes the Raspberry Pi control planes.
|
|
# Both workers share private ASN 64520 and peer with the router's private ASN
|
|
# 64512. The router supports ECMP, so it can retain equal-cost routes through
|
|
# both workers when both advertise the same Service address.
|
|
#
|
|
# No BGP password is used on this trusted internal network. Never add one in
|
|
# plaintext here: this repository is public, so authentication would require
|
|
# a separately managed Kubernetes Secret.
|
|
apiVersion: metallb.io/v1beta2
|
|
kind: BGPPeer
|
|
metadata:
|
|
name: mikrotik
|
|
namespace: metallb-system
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "1"
|
|
spec:
|
|
myASN: 64520
|
|
peerASN: 64512
|
|
peerAddress: 10.10.10.1
|
|
# Kubernetes' own convention for node-role.kubernetes.io/* labels is an
|
|
# empty string value (kubectl's ROLES column reads the key, not the value).
|
|
# Match that convention exactly, or this selector matches zero nodes and
|
|
# MetalLB silently generates BGP configuration for nobody.
|
|
nodeSelectors:
|
|
- matchLabels:
|
|
node-role.kubernetes.io/worker: ""
|