https://johanneskueber.com/tags/networking/Recent content in Networking on johanneskueber.comHugoen_USMon, 01 Jun 2026 00:00:00 +0000https://johanneskueber.com/posts/2026-06-01-cilium-l2-announcements/Mon, 01 Jun 2026 00:00:00 +0000https://johanneskueber.com/posts/2026-06-01-cilium-l2-announcements/<p>This article documents how to replace MetalLB with Cilium&rsquo;s built-in L2 announcement feature, including the IPAM pool, the announcement policy, the supporting Cilium values, and what to verify on the wire.</p> <hr> <h2 id="1-metallbs-role">1. MetalLB&rsquo;s role</h2> <p>On a bare-metal cluster, a <code>Service</code> of <code>type: LoadBalancer</code> is meaningless until something assigns it an external IP and answers ARP for that IP on the local segment. The classic answer is MetalLB in L2 mode: a controller allocates an IP from a pool; a speaker DaemonSet replies to ARP requests, advertising via gratuitous ARP after leader election.</p>https://johanneskueber.com/posts/2026-05-25-netbird-routing-peer/Mon, 25 May 2026 00:00:00 +0000https://johanneskueber.com/posts/2026-05-25-netbird-routing-peer/<p>This article documents how to run a NetBird client <em>inside</em> a Kubernetes cluster as a <strong>routing peer</strong> — rootless, with an in-memory state volume, a shell-based readiness probe, and dropped capabilities — so that remote mesh members can reach cluster-internal services over the encrypted overlay, without exposing kernel WireGuard and without making the cluster a peer of every workload.</p> <hr> <h2 id="1-why-a-netbird-peer-in-the-cluster">1. Why a NetBird peer in the cluster</h2> <p>NetBird is a WireGuard-based identity mesh. Each peer holds keys, exchanges them via the management plane, and routes encrypted traffic to other peers. The default deployment runs the client on a host (Linux VM, MacBook, etc.) and uses the host&rsquo;s kernel WireGuard.</p>