network: move ingress VIP announcements to stable control planes

clusters/atlas/flux-system/platform/metallb/kustomization.yaml

@@ -14,3 +14,23 @@ spec:
   prune: true
   wait: true
   targetNamespace: metallb-system
+---
+# Temporary second wave: MetalLB rejects overlapping pools during dry-run.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: ingress-pool-transition
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 10s
+  dependsOn:
+    - name: metallb
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./infrastructure/metallb/ingress-pool-transition
+  # The normal metallb stack adopts the pool after this one-time transition.
+  prune: false
+  wait: false
+  targetNamespace: metallb-system

infrastructure/metallb/ingress-pool-transition/ingress-pool.yaml

@@ -0,0 +1,23 @@
+# infrastructure/metallb/ingress-pool.yaml
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: ingress-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 192.168.22.9/32
+  autoAssign: false
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: ingress-adv
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+    - ingress-pool
+  # Keep the shared public VIP off undervolting and I/O-saturated workers.
+  nodeSelectors:
+    - matchLabels:
+        node-role.kubernetes.io/control-plane: "true"

infrastructure/metallb/ingress-pool-transition/kustomization.yaml

@@ -0,0 +1,5 @@
+# infrastructure/metallb/ingress-pool-transition/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ingress-pool.yaml

infrastructure/metallb/ippool.yaml

@@ -7,7 +7,6 @@ metadata:
 spec:
   addresses:
     - 192.168.22.4-192.168.22.6
-    - 192.168.22.9-192.168.22.9
   autoAssign: true
 ---
 apiVersion: metallb.io/v1beta1

infrastructure/metallb/lan-ai-pool.yaml

@@ -17,3 +17,6 @@ metadata:
 spec:
   ipAddressPools:
     - lan-ai-pool
+  nodeSelectors:
+    - matchLabels:
+        node-role.kubernetes.io/control-plane: "true"