# Cilium L2 Announcement Policy
#
# This makes LoadBalancer VIPs (from the local-pool in pool.yaml) truly virtual:
# Cilium answers ARP/NDP for the VIP from whichever node currently has healthy
# service endpoints. Without this policy, L2 announcements are disabled even
# though enable-l2-announcements=true in the Cilium config — the CRD policy is
# the gate that controls which services get announced and on which interfaces.
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
  name: default-l2-announcement
  namespace: kube-system
spec:
  # Announce IPs for LoadBalancer services and pod IPs (for external reachability).
  loadBalancerIPs: true
  # Also announce the node's own IPs (optional, useful for node-local services).
  nodeIPs: false
  # Announce externalIPs assigned to services.
  externalIPs: true
  # Which interfaces to announce on. empty = all interfaces.
  interfaces: []
  # Select which services to announce. empty selector = all services with
  # type=LoadBalancer.
  serviceSelector: {}