fix: set enforce:privileged for Cilium compatibility

talos/cilium/ip-pools.yaml

@@ -0,0 +1,45 @@
+# ─── Cilium IP pools — fastpass cluster ──────────────────────────────────────
+# Apply AFTER Cilium is healthy:
+#   kubectl apply -f talos/cilium/ip-pools.yaml
+#
+# NOTE: CRD API version must be cilium.io/v2 (not v1alpha1/v1beta1).
+# Using the wrong version causes silent failures — pool is created but
+# never activates. Verify with: kubectl get ciliumloadbalancerippool
+# ─────────────────────────────────────────────────────────────────────────────
+
+---
+# Pool for ingress-nginx — primary ingress controller
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: ingress-nginx-pool
+spec:
+  blocks:
+    - start: "10.1.71.80"
+      stop:  "10.1.71.89"
+
+---
+# Pool for Cilium Gateway API — secondary/future ingress path
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: cilium-gateway-pool
+spec:
+  blocks:
+    - start: "10.1.71.90"
+      stop:  "10.1.71.99"
+
+---
+# L2 announcement policy — advertise IPs from both pools on VLAN 71
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: default-l2-policy
+spec:
+  # Announce all LoadBalancer IPs from both pools
+  loadBalancerIPs: true
+  # Scope to all nodes (no node selector = cluster-wide)
+  nodeSelector:
+    matchLabels: {}
+  interfaces:
+    - eth0