failover: initial failover chain for vhaudiquet.fr

- vhaudiquet.fr, caddy, cert-manager, coredns, traefik are now tolerating failover nodes
- l2 announcements policy should make vip really virtual

kubernetes/system/cilium/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 
 resources:
   - pool.yaml
+  - l2-announcement.yaml

kubernetes/system/cilium/l2-announcement.yaml

@@ -0,0 +1,24 @@
+# Cilium L2 Announcement Policy
+#
+# This makes LoadBalancer VIPs (from the local-pool in pool.yaml) truly virtual:
+# Cilium answers ARP/NDP for the VIP from whichever node currently has healthy
+# service endpoints. Without this policy, L2 announcements are disabled even
+# though enable-l2-announcements=true in the Cilium config — the CRD policy is
+# the gate that controls which services get announced and on which interfaces.
+apiVersion: cilium.io/v2
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: default-l2-announcement
+  namespace: kube-system
+spec:
+  # Announce IPs for LoadBalancer services and pod IPs (for external reachability).
+  loadBalancerIPs: true
+  # Also announce the node's own IPs (optional, useful for node-local services).
+  nodeIPs: false
+  # Announce externalIPs assigned to services.
+  externalIPs: true
+  # Which interfaces to announce on. empty = all interfaces.
+  interfaces: []
+  # Select which services to announce. empty selector = all services with
+  # type=LoadBalancer.
+  serviceSelector: {}