This folder installs MetalLB v0.16.0 from its pinned upstream native manifest and configures the L2 address pool. MetalLB, not Cilium, announces load-balancer addresses from 192.168.0.10-192.168.0.49.

./install.sh

The files contain no credentials. The private LAN address range is infrastructure information, so decide whether that disclosure is acceptable before publishing the repository.

The installer verifies the upstream manifest against the committed SHA-256 checksum before applying it, waits for the controller and all speakers, and then applies metallb.yaml.

Gitea Actions CI/CD

Every push and pull request validates the scripts, the site-specific resources, and the downloaded upstream manifest against its pinned checksum. A successful push to main applies metallb.yaml and verifies that both the controller and all speaker pods are ready.

The upstream MetalLB installation remains an administrator bootstrap. CI owns only the existing IPAddressPool/default and L2Advertisement/l2; it cannot change MetalLB's workloads, CRDs, RBAC, webhook certificate, or Secrets. After changing METALLB_VERSION, run ./install.sh once as an administrator before merging the matching CI constants.

Create the restricted deployment identity once:

./create-ci-kubeconfig.sh

For remote cluster access:

KUBECTL_SSH_HOST=arschrock ./create-ci-kubeconfig.sh

Store only the final output line as the Gitea Actions repository secret KUBE_CONFIG_BASE64. Revoke it by deleting metallb-system/metallb-config-deployer-token and the repository secret.

Run ./test.sh for local shell and Kubernetes schema validation.