fix: set enforce:privileged for Cilium compatibility

talos/cilium/cilium-values.yaml

@@ -0,0 +1,86 @@
+# ─── Cilium Helm values — fastpass cluster ───────────────────────────────────
+# Install command (run from city-hall after cluster bootstrap):
+#
+#   helm repo add cilium https://helm.cilium.io/
+#   helm repo update
+#   helm upgrade --install cilium cilium/cilium \
+#     --version 1.17.3 \
+#     --namespace kube-system \
+#     --values cilium-values.yaml \
+#     --wait
+#
+# Verify:
+#   kubectl -n kube-system get pods -l app.kubernetes.io/name=cilium-agent
+#   cilium status --wait
+#
+# IMPORTANT: Cilium is Helm-only. Never manage this with ArgoCD.
+# ArgoCD manages everything else; this is the one exception.
+# ─────────────────────────────────────────────────────────────────────────────
+
+# ─── Talos-specific requirements ─────────────────────────────────────────────
+# Talos does not have a traditional kernel with modules loadable at runtime.
+# Cilium must be told to use eBPF-native mode and not rely on iptables modules.
+kubeProxyReplacement: true
+
+# kube-proxy is not running in Talos — Cilium replaces it entirely
+k8sServiceHost: 10.1.71.65   # VIP
+k8sServicePort: 6443
+
+# ─── Routing — tunnel mode ───────────────────────────────────────────────────
+# Use VXLAN tunneling. Note: as of Cilium 1.15 the config key changed:
+#   OLD (pre-1.15):  tunnel: vxlan
+#   NEW (1.15+):     routingMode: tunnel + tunnelProtocol: vxlan
+# Both shown here — comment/uncomment based on the Cilium version in use.
+#
+# For Cilium >= 1.15 (current):
+routingMode: tunnel
+tunnelProtocol: vxlan
+#
+# For Cilium < 1.15 (legacy — do not use for new installs):
+# tunnel: vxlan
+
+# ─── L2 announcements (LB IP advertisement) ──────────────────────────────────
+# Required for CiliumLoadBalancerIPPool to actually advertise IPs on the LAN.
+# Without this, LoadBalancer IPs are assigned but unreachable from outside the cluster.
+l2announcements:
+  enabled: true
+
+# Also enable L2 pod announcements so Cilium handles ARP for pod IPs directly
+l2podAnnouncements:
+  enabled: true
+
+# ─── IP pools (defined as CRDs post-install, but referenced here for docs) ───
+# Pool 1: ingress-nginx   10.1.71.80 - 10.1.71.89
+# Pool 2: cilium-gateway  10.1.71.90 - 10.1.71.99
+# Apply these after Cilium is healthy:
+#   kubectl apply -f talos/cilium/ip-pools.yaml
+
+# ─── Operator ────────────────────────────────────────────────────────────────
+operator:
+  replicas: 1   # single-replica is fine for homelab; avoids scheduling issues on 3-node CP
+
+# ─── IPAM ────────────────────────────────────────────────────────────────────
+ipam:
+  mode: kubernetes   # let Kubernetes manage pod CIDRs via the node spec
+
+# ─── Hubble (observability) ───────────────────────────────────────────────────
+hubble:
+  enabled: true
+  relay:
+    enabled: true
+  ui:
+    enabled: true
+    ingress:
+      enabled: false   # expose via ArgoCD-managed ingress later
+
+# ─── Gateway API support (secondary ingress path, future use) ────────────────
+gatewayAPI:
+  enabled: true
+
+# ─── Security ────────────────────────────────────────────────────────────────
+# Restrict host namespace access — pods can't escape to host network by default
+hostNamespaceAccess:
+  enabled: false
+
+# Enable network policies (default deny is applied per-namespace by ArgoCD apps)
+policyEnforcementMode: default

talos/cilium/ip-pools.yaml

@@ -0,0 +1,45 @@
+# ─── Cilium IP pools — fastpass cluster ──────────────────────────────────────
+# Apply AFTER Cilium is healthy:
+#   kubectl apply -f talos/cilium/ip-pools.yaml
+#
+# NOTE: CRD API version must be cilium.io/v2 (not v1alpha1/v1beta1).
+# Using the wrong version causes silent failures — pool is created but
+# never activates. Verify with: kubectl get ciliumloadbalancerippool
+# ─────────────────────────────────────────────────────────────────────────────
+
+---
+# Pool for ingress-nginx — primary ingress controller
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: ingress-nginx-pool
+spec:
+  blocks:
+    - start: "10.1.71.80"
+      stop:  "10.1.71.89"
+
+---
+# Pool for Cilium Gateway API — secondary/future ingress path
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: cilium-gateway-pool
+spec:
+  blocks:
+    - start: "10.1.71.90"
+      stop:  "10.1.71.99"
+
+---
+# L2 announcement policy — advertise IPs from both pools on VLAN 71
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: default-l2-policy
+spec:
+  # Announce all LoadBalancer IPs from both pools
+  loadBalancerIPs: true
+  # Scope to all nodes (no node selector = cluster-wide)
+  nodeSelector:
+    matchLabels: {}
+  interfaces:
+    - eth0