Reference

IP Allocation

IP address allocation and DNS record tables for the cluster. Networks and DHCP reservations are managed in terraform/unifi/.

Networks

On VLAN 20, everything below 10.20.200.0 is static: nodes, the API VIP, the LoadBalancer pool, Multus pod IPs, and reservations. IPv6 comes from the Init7 delegated prefix 2a02:16a:2a0a::/56: VLAN 20 is slice 2 (2a02:16a:2a0a:2::/64, nodes use SLAAC) and the LoadBalancer pool uses slice 3.

Node Addresses

Other Reservations

LoadBalancer IP Pool

Cilium LB-IPAM allocates LoadBalancer IPs from 10.20.10.128 - 10.20.10.255 (and 2a02:16a:2a0a:3::/112 for IPv6). Addresses are pinned per Service with the lbipam.cilium.io/ips annotation and announced over L2 (ARP) and BGP to the gateway. worker-ai-01 takes part in neither.

Gateway Details

Network Diagram

flowchart TB
    subgraph Internet
        CF[Cloudflare DNS<br/>*.wibrow.dev]
        Hub[towonel hub<br/>tunnel.wibrow.dev]
    end

    subgraph GW["UniFi Cloud Gateway Fiber (10.20.0.1, ASN 64512)"]
        DHCP[DHCP / DNS]
        BGP[BGP]
    end

    subgraph Cluster["VLAN 20 (10.20.0.0/16)"]
        subgraph ControlPlane["Control Plane (VIP 10.20.10.0)"]
            CP[10.20.10.1-3<br/>worker-01..03]
        end
        subgraph Workers["Workers"]
            W[10.20.10.4-11<br/>worker-04..10, worker-ai-01]
        end
        subgraph LB["LoadBalancers (10.20.10.128-255)"]
            EE[10.20.10.239<br/>envoy-external]
            EI[10.20.10.238<br/>envoy-internal]
        end
    end

    CF --> Hub
    Hub -->|tunnel via towonel-agent| EE
    DHCP --> ControlPlane
    DHCP --> Workers
    ControlPlane -.->|LB + pod routes| BGP
    Workers -.->|LB + pod routes| BGP

DNS Records

Cloudflare-Managed Records

The wildcard and external records come from the towonel-agent DNSEndpoint, internal from the envoy-internal DNSEndpoint. A second external-dns instance (networking/external-dns-unifi) publishes records to the UniFi gateway's local DNS.

Traffic Flow by Record

flowchart LR
    subgraph External["External Access"]
        W1["app.wibrow.dev"] -->|CNAME| E1["external.wibrow.dev"]
        E1 -->|CNAME| T1["tunnel.wibrow.dev"]
        T1 -->|towonel tunnel| A1[towonel-agent]
        A1 --> EE1[envoy-external<br/>10.20.10.239]
    end

    subgraph Internal["Internal Access"]
        W3["app.wibrow.dev"] -->|CNAME| I3["internal.wibrow.dev"]
        I3 -->|A record| EI1[envoy-internal<br/>10.20.10.238]
    end

Address Space Summary