docs(hairpin): list k8s VLANs 46/47/48 as deliberately absent

The nodes hold addresses on 46 (node0), 47 (ingress0) and 48 (pod0), the same asymmetric-reply reason that excludes 40 and 49. (42) Ingress no longer exists; its idx slot stays reserved. Refs S28-13 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 14:38:37 +01:00
1 changed files with 8 additions and 7 deletions
@@ -68,13 +68,14 @@ locals {
  # idx is a static per-network slot for rule_index derivation — never
  # reuse a freed idx for a new network.
  #
-  # Deliberately absent: (40) Server idx=4, (42) Ingress idx=5, and
-  # (49) k8s Ceph idx=6. The cluster nodes have interfaces on those VLANs,
-  # so a DNATed flow's reply would go directly over the shared L2 and
-  # bypass the UDM's conntrack (asymmetric, connection drops) — and
-  # clients there are the nodes themselves, whose DNS chain (CoreDNS ->
-  # k8s_gateway) already resolves the public names in-cluster. Their idx
-  # slots stay reserved.
+  # Deliberately absent: (40) Server idx=4, (49) k8s Ceph idx=6,
+  # (46) k8s Node, (47) k8s Ingress and (48) k8s Pod. The cluster nodes
+  # have interfaces on those VLANs (mgmt0, node0, ingress0, pod0), so a
+  # DNATed flow's reply would go directly over the shared L2 and bypass
+  # the UDM's conntrack (asymmetric, connection drops) — and clients there
+  # are the nodes themselves, whose DNS chain (CoreDNS -> k8s_gateway)
+  # already resolves the public names in-cluster. idx=5 stays reserved
+  # (its network, (42) Ingress, no longer exists).
  hairpin_networks = {
    "Default"              = { id = "5d4fba77ce63ee614841d53d", idx = 0 }
    "(10) Management"      = { id = "600334abf9ee0c059da6be8f", idx = 1 }