Three Independent Network Baselines

Management, internal, and external traffic are each configured and secured independently, with a choice of control-plane frontend modes.

Management baseline: out-of-band access to BMC/iLO/IPMI, SSH, and Prometheus scrape, typically on an isolated VLAN.
Internal baseline: pod-to-pod and inter-node gRPC traffic, with Cilium (eBPF/XDP-accelerated) as the default CNI provider.
External baseline: client-facing API and ingress traffic, isolated from internal cluster traffic.
The Kubernetes control-plane frontend is selectable per cluster: kube-vip (default, L2 ARP failover in roughly 2–5 seconds) for smaller control planes, or an external load balancer for larger ones.
Each baseline can run Gough’s built-in dnsmasq for bootstrap, or be migrated to Squawk DNS for HA DHCP/DNS with a non-disruptive cutover.