Cilium

Your pod is Running, your Service exists, the curl still hangs. Most Kubernetes traffic diagrams stop at a Load Balancer cloud. On bare metal that cloud is a Cisco Nexus EVPN fabric. Here is one HTTPS request traced all the way to the pod, with the command that proves every hop.

One Gateway claims the BGP-advertised VIP, a cert-manager chain makes every app green-padlock HTTPS, sixteen HTTPRoutes share one door, and split-view DNS gives the same names two honest answers.

One helm install, three jobs: the pod network, kube-proxy's whole duty in eBPF, and BGP from every node to its leaf pair's anycast gateway. Plus the consent chain that keeps VIP announcements deliberate, and the anycast peering quirk worth knowing.

How my bare-metal k8s cluster gets cloud-style LoadBalancer IPs: Cilium allocates a VIP, every node advertises it over eBGP to the NX-OS leaves, and the fabric ECMPs traffic into the cluster. Full walk from IPAM pool to leaf routing table.

A build series: from an empty hypervisor to a real app on a routed VXLAN/EVPN fabric with Kubernetes and Cilium BGP, every config shown. Part 1 is the map: the whole architecture, the addressing plan, and why BGP runs at literally every layer.