fix(gitops): add Flux Kustomization dependency for MetalLB IPAddressPool

MetalLB IPAddressPool requires MetalLB CRDs to exist first.
Without dependency ordering, Flux dry-run fails with:
  "no matches for kind IPAddressPool in version metallb.io/v1beta1"

Changes:
- Add flux-kustomization.yaml with dependsOn: flux-system
- Move address-pool.yaml to resources/ subdirectory
- Health check waits for MetalLB HelmRelease to be ready

This follows the same pattern as cert-manager-config.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: web-flow

gitops/clusters/homelab/infrastructure-config/metallb-config/flux-kustomization.yaml

@@ -0,0 +1,24 @@
+---
+# Flux Kustomization for MetalLB CRD-dependent resources (IPAddressPool, L2Advertisement)
+# This waits for MetalLB HelmRelease to be ready before applying
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb-config
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./gitops/clusters/homelab/infrastructure-config/metallb-config/resources
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  # Wait for MetalLB HelmRelease to be ready (CRDs installed)
+  dependsOn:
+    - name: flux-system  # Main kustomization deploys MetalLB HelmRelease
+  # Health checks to ensure MetalLB is actually ready
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: metallb
+      namespace: metallb-system

gitops/clusters/homelab/infrastructure-config/metallb-config/kustomization.yaml

@@ -2,4 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - address-pool.yaml
+  # The Flux Kustomization that applies resources/ with dependency on MetalLB HelmRelease
+  - flux-kustomization.yaml
+# NOTE: address-pool.yaml moved to resources/ and applied by the Flux Kustomization above
+# This ensures MetalLB CRDs exist before IPAddressPool is applied

…-config/metallb-config/address-pool.yaml …tallb-config/resources/address-pool.yamlgitops/clusters/homelab/infrastructure-config/metallb-config/address-pool.yaml renamed to gitops/clusters/homelab/infrastructure-config/metallb-config/resources/address-pool.yaml gitops/clusters/homelab/infrastructure-config/metallb-config/address-pool.yaml renamed to gitops/clusters/homelab/infrastructure-config/metallb-config/resources/address-pool.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - address-pool.yaml

gitops/clusters/homelab/infrastructure-config/metallb-config/resources/kustomization.yaml

@@ -13,7 +13,7 @@ resources:
   - infrastructure/cert-manager          #(LetsEncrypt DNS-01 certs - HelmRelease)
   - infrastructure/cert-manager-config  #(ClusterIssuer, Certs - depends on CRDs)
   - infrastructure/traefik-config       #(TLSStore, HA IngressRoute - depends on certs)
-  - infrastructure-config/metallb-config        #(address-pool)
+  - infrastructure-config/metallb-config  #(Flux Kustomization that applies IPAddressPool after MetalLB CRDs ready)
   # Crossplane-managed Proxmox instances (VMs/LXCs)
   # NOTE: Requires crossplane-system secret first - see scripts/crossplane/create-proxmox-secret.sh
   - instances                            # K3s VMs, LXC containers managed by Crossplane