Post

'It worked until I touched it' rarely means your change created the bug - it revealed what the system quietly depended on. A homelab LoadBalancer went unreachable after an unrelated change: Cilium stopped announcing the IP on L2, no ARP reply. A change that 'shouldn't break anything' finds the undoc

0 reposts0 likes

Cilium L2 announcements are leader-elected per service via Leases in kube-system (kubectl get lease -n kube-system | grep l2announce). If the holder node stops matching the policy's nodeSelector, or the policy's interfaces regex no longer matches the NIC name, nobody answers ARP. Silently.