From 2d0cbd75fa67e08c4a142153950ed57dc61257ff Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Sun, 23 Aug 2026 22:10:36 +0200
Subject: [PATCH] Import existing metallb configuration to git

---
 README.md    | 18 ++++++++++++++++--
 install.sh   | 37 +++++++++++++++++++++++++++++++++++++
 metallb.yaml | 14 ++++++++++++++
 3 files changed, 67 insertions(+), 2 deletions(-)
 create mode 100755 install.sh
 create mode 100644 metallb.yaml

diff --git a/README.md b/README.md
index 75073c7..859e1a5 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,17 @@
-# metallb-kubernetes
+# MetalLB configuration
 
-My metallb kubernetes configuration used to make kubernetes services accessible from the internet via port-forwarding from mikrotik internet gateway (to l2 advertisements)
\ No newline at end of file
+This folder installs MetalLB `v0.16.0` from its pinned upstream native manifest
+and configures the L2 address pool. MetalLB, not Cilium, announces
+load-balancer addresses from `192.168.0.10-192.168.0.49`.
+
+```sh
+./install.sh
+```
+
+The files contain no credentials. The private LAN address range is
+infrastructure information, so decide whether that disclosure is acceptable
+before publishing the repository.
+
+The installer verifies the upstream manifest against the committed SHA-256
+checksum before applying it, waits for the controller and all speakers, and
+then applies `metallb.yaml`.
diff --git a/install.sh b/install.sh
new file mode 100755
index 0000000..5af373e
--- /dev/null
+++ b/install.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+
+set -eu
+
+METALLB_VERSION=v0.16.0
+METALLB_MANIFEST_URL="https://raw.githubusercontent.com/metallb/metallb/$METALLB_VERSION/config/manifests/metallb-native.yaml"
+METALLB_MANIFEST_SHA256=b0b9be2802f10aa32d45308b4457d06cde0c70544712c8d0cf5511657ffd2b69
+NAMESPACE=metallb-system
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+for command in curl kubectl sha256sum; do
+    if ! command -v "$command" >/dev/null 2>&1; then
+        echo "Required command not found: $command" >&2
+        exit 1
+    fi
+done
+
+UPSTREAM_MANIFEST=$(mktemp)
+trap 'rm -f "$UPSTREAM_MANIFEST"' EXIT HUP INT TERM
+
+curl --fail --silent --show-error --location \
+  --output "$UPSTREAM_MANIFEST" "$METALLB_MANIFEST_URL"
+printf '%s  %s\n' "$METALLB_MANIFEST_SHA256" "$UPSTREAM_MANIFEST" \
+  | sha256sum --check
+
+kubectl apply --dry-run=server --validate=false \
+  --filename "$UPSTREAM_MANIFEST"
+kubectl apply --validate=false --filename "$UPSTREAM_MANIFEST"
+
+kubectl wait --for=condition=Available deployment/controller \
+  --namespace "$NAMESPACE" --timeout=5m
+kubectl rollout status daemonset/speaker \
+  --namespace "$NAMESPACE" --timeout=5m
+
+kubectl apply --dry-run=server --validate=false \
+  --filename "$SCRIPT_DIR/metallb.yaml"
+kubectl apply --validate=false --filename "$SCRIPT_DIR/metallb.yaml"
diff --git a/metallb.yaml b/metallb.yaml
new file mode 100644
index 0000000..de5bdbe
--- /dev/null
+++ b/metallb.yaml
@@ -0,0 +1,14 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: default
+  namespace: metallb-system
+spec:
+  addresses:
+    - 192.168.0.10-192.168.0.49
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: l2
+  namespace: metallb-system