Import existing metallb configuration to git

README.md

@@ -1,3 +1,17 @@
-# metallb-kubernetes
+# MetalLB configuration
 
-My metallb kubernetes configuration used to make kubernetes services accessible from the internet via port-forwarding from mikrotik internet gateway (to l2 advertisements)
+This folder installs MetalLB `v0.16.0` from its pinned upstream native manifest
+and configures the L2 address pool. MetalLB, not Cilium, announces
+load-balancer addresses from `192.168.0.10-192.168.0.49`.
+
+```sh
+./install.sh
+```
+
+The files contain no credentials. The private LAN address range is
+infrastructure information, so decide whether that disclosure is acceptable
+before publishing the repository.
+
+The installer verifies the upstream manifest against the committed SHA-256
+checksum before applying it, waits for the controller and all speakers, and
+then applies `metallb.yaml`.

install.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+
+set -eu
+
+METALLB_VERSION=v0.16.0
+METALLB_MANIFEST_URL="https://raw.githubusercontent.com/metallb/metallb/$METALLB_VERSION/config/manifests/metallb-native.yaml"
+METALLB_MANIFEST_SHA256=b0b9be2802f10aa32d45308b4457d06cde0c70544712c8d0cf5511657ffd2b69
+NAMESPACE=metallb-system
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+for command in curl kubectl sha256sum; do
+    if ! command -v "$command" >/dev/null 2>&1; then
+        echo "Required command not found: $command" >&2
+        exit 1
+    fi
+done
+
+UPSTREAM_MANIFEST=$(mktemp)
+trap 'rm -f "$UPSTREAM_MANIFEST"' EXIT HUP INT TERM
+
+curl --fail --silent --show-error --location \
+  --output "$UPSTREAM_MANIFEST" "$METALLB_MANIFEST_URL"
+printf '%s  %s\n' "$METALLB_MANIFEST_SHA256" "$UPSTREAM_MANIFEST" \
+  | sha256sum --check
+
+kubectl apply --dry-run=server --validate=false \
+  --filename "$UPSTREAM_MANIFEST"
+kubectl apply --validate=false --filename "$UPSTREAM_MANIFEST"
+
+kubectl wait --for=condition=Available deployment/controller \
+  --namespace "$NAMESPACE" --timeout=5m
+kubectl rollout status daemonset/speaker \
+  --namespace "$NAMESPACE" --timeout=5m
+
+kubectl apply --dry-run=server --validate=false \
+  --filename "$SCRIPT_DIR/metallb.yaml"
+kubectl apply --validate=false --filename "$SCRIPT_DIR/metallb.yaml"

metallb.yaml

@@ -0,0 +1,14 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: default
+  namespace: metallb-system
+spec:
+  addresses:
+    - 192.168.0.10-192.168.0.49
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: l2
+  namespace: metallb-system